Add seccomp profile support to PodSecurityContext in Kubernetes for Skuber library #366
Conversation
…e json parser to support new field during serialization/deserialization
| case operator => JsError(s"Unknown Seccomp profile '$operator'") | ||
| } | ||
|
|
||
| case _ => JsError(s"Unknown Seccomp") |
There was a problem hiding this comment.
please treat the error in a more resilient way, you can return Option[SeccompProfile] and in that case return None
Or you can configure a profile that is "Unknown"
There was a problem hiding this comment.
replace JsError with "Unknown" profile
There was a problem hiding this comment.
@Dream1Master
Thank you for taking the time and contributing to skuber :)
In addition, if you could invest some time and create an integration test for PodFormat that would be great.
you can take as an example PodFormatSpec integration test under it folder.
| case Some(JsString("Localhost")) => | ||
| val profileConfigPath: String = fields("localhostProfile").as[String] | ||
| JsSuccess(Security.LocalhostProfile(profileConfigPath)) | ||
| case operator => JsError(s"Unknown Seccomp profile '$operator'") |
There was a problem hiding this comment.
replace JsError with "Unknown" profile
I have created integration tests for the PodFormatSpec in the format package, located in the |
|
@Dream1Master v4.0.3 has been released with seccomp profile |
This pull request adds support for seccomp profiles in Kubernetes PodSecurityContext for the Skuber library. This change is necessary for better security compliance of the Skuber library.
The technical details of this change are as follows:
This change is important because it provides better security compliance for the Skuber library. Seccomp profiles restrict the types of system calls that a container can make, reducing the attack surface of the container and improving overall security.
Information about restrict a Container's Syscalls with seccomp available via link https://kubernetes.io/docs/tutorials/security/seccomp/
Linux seccomp overview available via link https://lwn.net/Articles/656307/
Thank you for your time and attention in reviewing this pull request. Please let me know if you have any questions or concerns.