Implement SeccompProfile CRD and controller #125

cmurphy · 2020-09-03T05:27:24Z

This change implements a SeccompProfile custom resource API. A new
SeccompProfile type is created and the controller Reconciler is modified
to handle either a SeccompProfile Kind or a ConfigMap describing a
seccomp profile. The CRD manifest is generated by the new type.

What type of PR is this?

/kind feature
/kind api-change

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #117

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Added new Custom Resource Definition `seccompprofiles.seccomp-operator.k8s-sigs.io` as an alternative to an annotated ConfigMap for defining seccomp profiles.

k8s-ci-robot · 2020-09-03T05:27:32Z

Hi @cmurphy. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

saschagrunert · 2020-09-03T10:01:37Z

/ok-to-test

saschagrunert

Great work so far, just two nits on the deployment.

deploy/operator.yaml

hasheddan

Thanks for the awesome work here @cmurphy! Excited to see this coming along! 🎉

hasheddan · 2020-09-05T12:42:08Z

deploy/namespace-operator.yaml

+  resources:
+  - seccompprofiles
+  verbs:
+  - create


Do we need create permissions on the SeccompProfile resource?

Nope, will remove

hasheddan · 2020-09-05T12:45:07Z

deploy/base/crd.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: apiextensions.k8s.io/v1


In regards to generating, I think it would be good to do this from the beginning to make sure we stay in sync. This is fairly straightforward with controller-tools. Here is an example of doing so with go generate --> https://github.com/crossplane/crossplane/blob/3ea5d036778e0c257960983d0cdb9271f12dc895/apis/generate.go#L26

hasheddan · 2020-09-05T12:49:52Z

cmd/seccomp-operator/main.go

 )

+func init() {
+	_ = clientgoscheme.AddToScheme(scheme)


Do we need to add the clientgoscheme here?

Apparently not, if I incorporate your other suggestion about the scheme

hasheddan · 2020-09-05T12:51:51Z

cmd/seccomp-operator/main.go

@@ -103,6 +112,7 @@ func run(*cli.Context) error {

 	ctrlOpts := ctrl.Options{
 		SyncPeriod: &sync,
+		Scheme:     scheme,


nitpick: you can leave this empty and ctrl.NewManager() will create a *runtime.Scheme for you, which you can then add types to with something like:

if err := seccompoperatorv1alpha1.AddToScheme(mgr.GetScheme()); err != nil { return errors.Wrap(err, "Cannot add core Seccomp APIs to scheme") }

saschagrunert · 2020-09-16T06:54:25Z

@cmurphy feel free to drop the WIP if you think this is ready for another round of review 😊

cmurphy · 2020-09-16T16:36:25Z

@saschagrunert I will once I get the tests fixed 😄

k8s-ci-robot · 2020-09-18T16:29:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cmurphy, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

cmurphy · 2020-09-18T19:21:33Z

Noticed errors on the validation of flags and architectures, latest revision fixes them

cmurphy · 2020-09-21T22:56:43Z

Added an e2e test.

saschagrunert

Thank you! PTAL @hasheddan @pjbgf

pjbgf

Really good stuff, thank you for this contribution.
Overall it is a lgtm from me once we change the group to a temporary one.

pjbgf · 2020-09-24T18:23:54Z

api/v1alpha1/groupversion_info.go

+
+// Package v1alpha1 contains API Schema definitions for the seccomp-operator v1alpha1 API group
+// +kubebuilder:object:generate=true
+// +groupName=seccomp-operator.k8s-sigs.io


Tricky one! Would you be opposed to use something internal (without k8s-sigs.io) and open an issue for us to resolve this later on depending on whether or not the project gets renamed? I'd rather we go for a name submission/approval only once if possible.

We probably could start with seccompprofiles.seccomp-operator.io and then change and submit for approval when/if we finally decide on the project renaming.

pjbgf

/lgtm

This change implements a SeccompProfile custom resource API. A new SeccompProfile type is created and the controller Reconciler is modified to handle either a SeccompProfile Kind or a ConfigMap describing a seccomp profile. The CRD manifest is generated by the new type.

pjbgf

/lgtm

hasheddan

/lgtm

Thanks for the awesome work here @cmurphy!!

pjbgf · 2020-09-30T14:22:47Z

/unhold

saschagrunert · 2020-09-30T19:42:45Z

Great work @cmurphy! Are there any follow ups we can consider?

cmurphy · 2020-10-01T17:23:55Z

@saschagrunert yes, I just propose #138 as an idea to address #131. I think we might also want another PR to address part of #117 that is not addressed here, "provides a useful abstraction, like the minimum amount of syscalls needed for container runtimes like runc". Also, documentation 😄

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 3, 2020

k8s-ci-robot requested review from pjbgf and saschagrunert September 3, 2020 05:27

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 3, 2020

cmurphy mentioned this pull request Sep 3, 2020

Custom Resource Definition (CRD) for profiles #117

Closed

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 3, 2020

saschagrunert reviewed Sep 3, 2020

View reviewed changes

deploy/operator.yaml Outdated Show resolved Hide resolved

deploy/operator.yaml Outdated Show resolved Hide resolved

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 3, 2020

cmurphy force-pushed the crd branch from b3d8990 to 9f06b7d Compare September 3, 2020 23:10

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 4, 2020

cmurphy force-pushed the crd branch from 9f06b7d to 0285d64 Compare September 4, 2020 22:35

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 4, 2020

hasheddan reviewed Sep 5, 2020

View reviewed changes

pjbgf mentioned this pull request Sep 7, 2020

Define behaviour for CRD and ConfigMap containing the same profile #131

Closed

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Sep 15, 2020

cmurphy force-pushed the crd branch from 1ae56c7 to 231b54c Compare September 17, 2020 23:28

cmurphy changed the title ~~[WIP] Implement SeccompProfile CRD and controller~~ Implement SeccompProfile CRD and controller Sep 17, 2020

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 17, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 18, 2020

cmurphy force-pushed the crd branch from 8efacd4 to 439784b Compare September 18, 2020 19:20

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 18, 2020

cmurphy force-pushed the crd branch 2 times, most recently from fdecb90 to fa85960 Compare September 21, 2020 22:56

saschagrunert approved these changes Sep 22, 2020

View reviewed changes

pjbgf requested changes Sep 24, 2020

View reviewed changes

saschagrunert mentioned this pull request Sep 24, 2020

Check if type-based validation is necessary when having a CRD #133

Closed

cmurphy force-pushed the crd branch 2 times, most recently from a86b843 to 7e01b20 Compare September 24, 2020 19:23

pjbgf approved these changes Sep 24, 2020

View reviewed changes

k8s-ci-robot assigned pjbgf Sep 24, 2020

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Sep 24, 2020

cmurphy force-pushed the crd branch from 7e01b20 to 73c0bd8 Compare September 24, 2020 22:56

k8s-ci-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Sep 24, 2020

pjbgf approved these changes Sep 25, 2020

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 25, 2020

hasheddan approved these changes Sep 25, 2020

View reviewed changes

k8s-ci-robot assigned hasheddan Sep 25, 2020

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 30, 2020

k8s-ci-robot merged commit ae1dbf2 into kubernetes-sigs:master Sep 30, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement SeccompProfile CRD and controller #125

Implement SeccompProfile CRD and controller #125

cmurphy commented Sep 3, 2020 •

edited

Loading

k8s-ci-robot commented Sep 3, 2020

saschagrunert commented Sep 3, 2020

saschagrunert left a comment

hasheddan left a comment

hasheddan Sep 5, 2020

cmurphy Sep 14, 2020

hasheddan Sep 5, 2020

hasheddan Sep 5, 2020

cmurphy Sep 14, 2020

hasheddan Sep 5, 2020

cmurphy Sep 14, 2020

saschagrunert commented Sep 16, 2020

cmurphy commented Sep 16, 2020

k8s-ci-robot commented Sep 18, 2020

cmurphy commented Sep 18, 2020

cmurphy commented Sep 21, 2020

saschagrunert left a comment

pjbgf left a comment

pjbgf Sep 24, 2020

pjbgf left a comment

pjbgf left a comment

hasheddan left a comment

pjbgf commented Sep 30, 2020

saschagrunert commented Sep 30, 2020

cmurphy commented Oct 1, 2020

Implement SeccompProfile CRD and controller #125

Implement SeccompProfile CRD and controller #125

Conversation

cmurphy commented Sep 3, 2020 • edited Loading

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

k8s-ci-robot commented Sep 3, 2020

saschagrunert commented Sep 3, 2020

saschagrunert left a comment

Choose a reason for hiding this comment

hasheddan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

saschagrunert commented Sep 16, 2020

cmurphy commented Sep 16, 2020

k8s-ci-robot commented Sep 18, 2020

cmurphy commented Sep 18, 2020

cmurphy commented Sep 21, 2020

saschagrunert left a comment

Choose a reason for hiding this comment

pjbgf left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pjbgf left a comment

Choose a reason for hiding this comment

pjbgf left a comment

Choose a reason for hiding this comment

hasheddan left a comment

Choose a reason for hiding this comment

pjbgf commented Sep 30, 2020

saschagrunert commented Sep 30, 2020

cmurphy commented Oct 1, 2020

cmurphy commented Sep 3, 2020 •

edited

Loading