mirror of
https://github.com/kubernetes/kubernetes.git
synced 2026-11-06 05:17:08 +00:00
Sascha Grunert
44dfc921ce
Add seccompProfile.type OCI with the oci field (a digest-pinned ref and an optional RuntimeDefault or Localhost baseProfile) and the alpha SecurityProfileOCI feature gate, as described in KEP-6061. The oci field is validated declaratively, with custom validators for the reference and the base profile path; the gate check and the rule that privileged containers cannot use an OCI profile stay handwritten. While the gate is disabled the type is rejected unless the old object already uses it. PodSecurity baseline and restricted keep rejecting OCI. The SecurityProfileOCI node declared feature keeps pods with OCI profiles on nodes whose kubelet has the gate enabled and a runtime that supports OCI seccomp profiles. The field is named ref instead of the KEP's reference, following the kube-api-linter naming convention for new fields. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
Kubernetes hack GuideLines
This document describes how you can use the scripts from hack directory
and gives a brief introduction and explanation of these scripts.
Overview
The hack directory contains many scripts that ensure continuous development of kubernetes,
enhance the robustness of the code, improve development efficiency, etc.
The explanations and descriptions of these scripts are helpful for contributors.
For details, refer to the following guidelines.
Key scripts
verify-all.sh: This script is a vestigial redirection, Please do not add "real" logic. It is equivalent tomake verify.update-all.sh: This script is a vestigial redirection, Please do not add "real" logic. Thetruetarget of this makerule ishack/make-rules/update.sh.It is equivalent tomake update.
Attention
Note that all scripts must be run from the Kubernetes root directory.
We should run hack/verify-all.sh before submitting a PR and if anything fails run hack/update-all.sh.