Skip to content

Commit f545991

Browse files
author
Rohit Patil
committed
fix others
1 parent 067031b commit f545991

File tree

9 files changed

+239
-34
lines changed

9 files changed

+239
-34
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 25 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37962,9 +37962,27 @@
3796237962
"com.github.openshift.api.security.v1.RunAsGroupStrategyOptions": {
3796337963
"description": "RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.",
3796437964
"type": "object",
37965+
"required": [
37966+
"type"
37967+
],
3796537968
"properties": {
37969+
"gid": {
37970+
"description": "gid is the group id that containers must run as. Required for the MustRunAs strategy if not using namespace/service account allocated gids.",
37971+
"type": "integer",
37972+
"format": "int64"
37973+
},
37974+
"gidRangeMax": {
37975+
"description": "gidRangeMax defines the max value for a strategy that allocates by range.",
37976+
"type": "integer",
37977+
"format": "int64"
37978+
},
37979+
"gidRangeMin": {
37980+
"description": "gidRangeMin defines the min value for a strategy that allocates by range.",
37981+
"type": "integer",
37982+
"format": "int64"
37983+
},
3796637984
"ranges": {
37967-
"description": "ranges are the allowed ranges of gids. If you would like to force a single gid then supply a single range with the same start and end.",
37985+
"description": "ranges are the allowed ranges of gids. If you would like to force a single gid then supply a single range with the same start and end. When omitted, any gid is allowed (equivalent to RunAsAny strategy).",
3796837986
"type": "array",
3796937987
"items": {
3797037988
"default": {},
@@ -37973,7 +37991,7 @@
3797337991
"x-kubernetes-list-type": "atomic"
3797437992
},
3797537993
"type": {
37976-
"description": "type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.",
37994+
"description": "type is the strategy that will dictate what RunAsGroup is used in the SecurityContext. Valid values are \"MustRunAs\", \"MustRunAsRange\", and \"RunAsAny\".",
3797737995
"type": "string"
3797837996
}
3797937997
}
@@ -38140,7 +38158,7 @@
3814038158
"x-kubernetes-list-type": "atomic"
3814138159
},
3814238160
"runAsGroup": {
38143-
"description": "runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.",
38161+
"description": "runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext. When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.",
3814438162
"default": {},
3814538163
"$ref": "#/definitions/com.github.openshift.api.security.v1.RunAsGroupStrategyOptions"
3814638164
},

‎payload-manifests/crds/0000_03_config-operator_01_securitycontextconstraints.crd.yaml‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ spec:
205205
description: min is the start of the range, inclusive.
206206
format: int64
207207
type: integer
208+
required:
209+
- max
210+
- min
208211
type: object
209212
type: array
210213
x-kubernetes-list-type: atomic
@@ -261,14 +264,31 @@ spec:
261264
type: array
262265
x-kubernetes-list-type: atomic
263266
runAsGroup:
264-
description: runAsGroup is the strategy that will dictate what RunAsGroup
265-
is used in the SecurityContext.
266-
nullable: true
267+
description: |-
268+
runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
269+
When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.
267270
properties:
271+
gid:
272+
description: |-
273+
gid is the group id that containers must run as. Required for the MustRunAs strategy if not using
274+
namespace/service account allocated gids.
275+
format: int64
276+
type: integer
277+
gidRangeMax:
278+
description: gidRangeMax defines the max value for a strategy that
279+
allocates by range.
280+
format: int64
281+
type: integer
282+
gidRangeMin:
283+
description: gidRangeMin defines the min value for a strategy that
284+
allocates by range.
285+
format: int64
286+
type: integer
268287
ranges:
269288
description: |-
270289
ranges are the allowed ranges of gids. If you would like to force a single
271290
gid then supply a single range with the same start and end.
291+
When omitted, any gid is allowed (equivalent to RunAsAny strategy).
272292
items:
273293
description: IDRange provides a min/max of an allowed range of IDs.
274294
properties:
@@ -280,13 +300,24 @@ spec:
280300
description: min is the start of the range, inclusive.
281301
format: int64
282302
type: integer
303+
required:
304+
- max
305+
- min
283306
type: object
307+
maxItems: 256
284308
type: array
285309
x-kubernetes-list-type: atomic
286310
type:
287-
description: type is the strategy that will dictate what RunAsGroup
288-
is used in the SecurityContext.
311+
description: |-
312+
type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
313+
Valid values are "MustRunAs", "MustRunAsRange", and "RunAsAny".
314+
enum:
315+
- MustRunAs
316+
- MustRunAsRange
317+
- RunAsAny
289318
type: string
319+
required:
320+
- type
290321
type: object
291322
runAsUser:
292323
description: runAsUser is the strategy that will dictate what RunAsUser
@@ -376,6 +407,9 @@ spec:
376407
description: min is the start of the range, inclusive.
377408
format: int64
378409
type: integer
410+
required:
411+
- max
412+
- min
379413
type: object
380414
type: array
381415
x-kubernetes-list-type: atomic

‎security/v1/types.go‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -276,18 +276,27 @@ type SupplementalGroupsStrategyOptions struct {
276276
// RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.
277277
type RunAsGroupStrategyOptions struct {
278278
// type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
279-
// Valid values are "MustRunAs" and "RunAsAny".
279+
// Valid values are "MustRunAs", "MustRunAsRange", and "RunAsAny".
280280
// +required
281-
// +kubebuilder:validation:MinLength=1
282-
// +kubebuilder:validation:MaxLength=32
281+
// +kubebuilder:validation:Enum=MustRunAs;MustRunAsRange;RunAsAny
283282
Type RunAsGroupStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=RunAsGroupStrategyType"`
283+
// gid is the group id that containers must run as. Required for the MustRunAs strategy if not using
284+
// namespace/service account allocated gids.
285+
// +optional
286+
GID *int64 `json:"gid,omitempty" protobuf:"varint,2,opt,name=gid"`
287+
// gidRangeMin defines the min value for a strategy that allocates by range.
288+
// +optional
289+
GIDRangeMin *int64 `json:"gidRangeMin,omitempty" protobuf:"varint,3,opt,name=gidRangeMin"`
290+
// gidRangeMax defines the max value for a strategy that allocates by range.
291+
// +optional
292+
GIDRangeMax *int64 `json:"gidRangeMax,omitempty" protobuf:"varint,4,opt,name=gidRangeMax"`
284293
// ranges are the allowed ranges of gids. If you would like to force a single
285294
// gid then supply a single range with the same start and end.
286295
// When omitted, any gid is allowed (equivalent to RunAsAny strategy).
287296
// +optional
288297
// +listType=atomic
289298
// +kubebuilder:validation:MaxItems=256
290-
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,2,rep,name=ranges"`
299+
Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,5,rep,name=ranges"`
291300
}
292301

293302
// IDRange provides a min/max of an allowed range of IDs.
@@ -351,6 +360,8 @@ const (
351360

352361
// container must have RunAsGroup of X applied.
353362
RunAsGroupStrategyMustRunAs RunAsGroupStrategyType = "MustRunAs"
363+
// container must run with a gid in a range.
364+
RunAsGroupStrategyMustRunAsRange RunAsGroupStrategyType = "MustRunAsRange"
354365
// container may make requests for any RunAsGroup.
355366
RunAsGroupStrategyRunAsAny RunAsGroupStrategyType = "RunAsAny"
356367

‎security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints.crd.yaml‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ spec:
205205
description: min is the start of the range, inclusive.
206206
format: int64
207207
type: integer
208+
required:
209+
- max
210+
- min
208211
type: object
209212
type: array
210213
x-kubernetes-list-type: atomic
@@ -261,14 +264,31 @@ spec:
261264
type: array
262265
x-kubernetes-list-type: atomic
263266
runAsGroup:
264-
description: runAsGroup is the strategy that will dictate what RunAsGroup
265-
is used in the SecurityContext.
266-
nullable: true
267+
description: |-
268+
runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
269+
When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.
267270
properties:
271+
gid:
272+
description: |-
273+
gid is the group id that containers must run as. Required for the MustRunAs strategy if not using
274+
namespace/service account allocated gids.
275+
format: int64
276+
type: integer
277+
gidRangeMax:
278+
description: gidRangeMax defines the max value for a strategy that
279+
allocates by range.
280+
format: int64
281+
type: integer
282+
gidRangeMin:
283+
description: gidRangeMin defines the min value for a strategy that
284+
allocates by range.
285+
format: int64
286+
type: integer
268287
ranges:
269288
description: |-
270289
ranges are the allowed ranges of gids. If you would like to force a single
271290
gid then supply a single range with the same start and end.
291+
When omitted, any gid is allowed (equivalent to RunAsAny strategy).
272292
items:
273293
description: IDRange provides a min/max of an allowed range of IDs.
274294
properties:
@@ -280,13 +300,24 @@ spec:
280300
description: min is the start of the range, inclusive.
281301
format: int64
282302
type: integer
303+
required:
304+
- max
305+
- min
283306
type: object
307+
maxItems: 256
284308
type: array
285309
x-kubernetes-list-type: atomic
286310
type:
287-
description: type is the strategy that will dictate what RunAsGroup
288-
is used in the SecurityContext.
311+
description: |-
312+
type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
313+
Valid values are "MustRunAs", "MustRunAsRange", and "RunAsAny".
314+
enum:
315+
- MustRunAs
316+
- MustRunAsRange
317+
- RunAsAny
289318
type: string
319+
required:
320+
- type
290321
type: object
291322
runAsUser:
292323
description: runAsUser is the strategy that will dictate what RunAsUser
@@ -376,6 +407,9 @@ spec:
376407
description: min is the start of the range, inclusive.
377408
format: int64
378409
type: integer
410+
required:
411+
- max
412+
- min
379413
type: object
380414
type: array
381415
x-kubernetes-list-type: atomic

‎security/v1/zz_generated.deepcopy.go‎

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)