PodSecurityPolicies for addons #55509
Conversation
k8s-ci-robot
added
release-note
|
/cc @liggitt |
| @@ -58,26 +58,12 @@ spec: | |||
| - /heapster | |||
| - --source=kubernetes.summary_api:'' | |||
| - --sink=gcm | |||
| volumeMounts: | |||
| - name: ssl-certs | |||
There was a problem hiding this comment.
Does heapster not need to talk to googleapis.com?
There was a problem hiding this comment.
With this change heapster uses the SSL certs that are built into the container, rather than those on the host. My understanding is that the certificates in the container are sufficient that.
There was a problem hiding this comment.
(To clarify - usually this practice of mounting the host certificates is only needed for FROM scratch containers. However, heapster copies in the host certs when it's built, so this isn't necessary).
There was a problem hiding this comment.
how long are those valid for?
There was a problem hiding this comment.
$ openssl x509 -in heapster/92474ba266e5a063e88a4cc5f136d5bac305cb75538b4086a73c1ac27d834ce6/etc/ssl/certs/ca-certificates.crt -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 6828503384748696800 (0x5ec3b7a6437fa4e0)
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES
Validity
Not Before: May 5 09:37:37 2011 GMT
Not After : Dec 31 09:37:37 2030 GMT
Subject: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES
...
Looks like that shouldn't be a problem, as long as they aren't revoked.
That said, this is a a common requirement for containers. Maybe we need to build a solution that doesn't require a HostPath volume...
|
/lgtm |
k8s-ci-robot
added
the
lgtm
k8s-github-robot
added
the
approved
|
For the heapster changes |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: crassirostris, mikedanese, tallclair Associated issue: 43538 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these OWNERS Files:
You can indicate your approval by writing |
|
Automatic merge from submit-queue (batch tested with PRs 54602, 54877, 55243, 55509, 55128). If you want to cherry-pick this change to another branch, please follow the instructions here. |
jpbetz
added
cherry-pick-approved
…509-upstream-release-1.8 Automatic merge from submit-queue. Automated cherry pick of #55509 upstream release 1.8 Cherry pick of #55509 on release-1.8. #55509: PodSecurityPolicies for addons Justification: configuration-only changes to add PodSecurityPolicies for cluster addons, which is required for enabling the controller. ```release-note - Add PodSecurityPolicies for cluster addons - Remove SSL cert HostPath volumes from heapster addons ```
What this PR does / why we need it:
podsecuritypoliciessubdirectory).Which issue(s) this PR fixes:
#43538
Release note: