Merge pull request #152 from microsoft/saulparedes/support_seccompPro…

…file genpolicy: Add support for seccompProfile field
microsoft · Jan 26, 2024 · 3d44189 · 3d44189
2 parents 5799fdf + c034bdc
commit 3d44189
Show file tree

Hide file tree

Showing 63 changed files with 80 additions and 63 deletions.
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm3.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm3.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/job/test-job.yaml b/src/agent/samples/policy/yaml/job/test-job.yaml
diff --git a/src/agent/samples/policy/yaml/job/test-job2.yaml b/src/agent/samples/policy/yaml/job/test-job2.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-exec.yaml b/src/agent/samples/policy/yaml/pod/pod-exec.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml b/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-one-container.yaml b/src/agent/samples/policy/yaml/pod/pod-one-container.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml b/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-spark.yaml b/src/agent/samples/policy/yaml/pod/pod-spark.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml b/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml
diff --git a/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml b/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml
diff --git a/src/agent/samples/policy/yaml/replica-set/replica2.yaml b/src/agent/samples/policy/yaml/replica-set/replica2.yaml
diff --git a/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml b/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml
diff --git a/src/agent/samples/policy/yaml/stateful-set/web.yaml b/src/agent/samples/policy/yaml/stateful-set/web.yaml
diff --git a/src/agent/samples/policy/yaml/stateful-set/web2.yaml b/src/agent/samples/policy/yaml/stateful-set/web2.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/dns-test.yaml b/src/agent/samples/policy/yaml/webhook3/dns-test.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/many-layers.yaml b/src/agent/samples/policy/yaml/webhook3/many-layers.yaml
diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
@@ -45,6 +45,9 @@ CreateContainerRequest {
     print("CreateContainerRequest: i_oci.Hooks =", i_oci.Hooks)
     is_null(i_oci.Hooks)
 
+    print("CreateContainerRequest: i_oci.Linux.Seccomp =", i_oci.Linux.Seccomp)
+    is_null(i_oci.Linux.Seccomp)
+
     some p_container in policy_data.containers
     print("======== CreateContainerRequest: trying next policy container")
 

diff --git a/src/tools/genpolicy/src/pod.rs b/src/tools/genpolicy/src/pod.rs
@@ -282,6 +282,19 @@ struct SecurityContext {
 
     #[serde(skip_serializing_if = "Option::is_none")]
     runAsUser: Option<i64>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    seccompProfile: Option<SeccompProfile>,
+}
+
+/// See Reference / Kubernetes API / Workload Resources / Pod.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct SeccompProfile {
+    #[serde(rename = "type")]
+    profile_type: String,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    localhostProfile: Option<String>,
 }
 
 /// See Reference / Kubernetes API / Workload Resources / Pod.
@@ -960,6 +973,7 @@ pub async fn add_pause_container(containers: &mut Vec<Container>, use_cache: boo
             privileged: None,
             capabilities: None,
             runAsUser: None,
+            seccompProfile: None,
         }),
         ..Default::default()
     };