Skip to content

Commit ce3a889

Browse files
ab-ghoshinfernus01
authored and
tekton-robot
committed
Add hostUsers field support to PodTemplate
Signed-off-by: ab-ghosh <abghosh@redhat.com> Co-authored-by: Shubham Bhardwaj <shubbhar@redhat.com>
1 parent 9d0f1c8 commit ce3a889

File tree

13 files changed

+188
-6
lines changed

13 files changed

+188
-6
lines changed

‎config/300-crds/300-pipelinerun.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,18 @@ spec:
330330
hostNetwork:
331331
description: HostNetwork specifies whether the pod may use the node network namespace
332332
type: boolean
333+
hostUsers:
334+
description: |-
335+
HostUsers indicates whether the pod will use the host's user namespace.
336+
Optional: Default to true.
337+
If set to true or not present, the pod will be run in the host user namespace, useful
338+
for when the pod needs a feature only available to the host user namespace, such as
339+
loading a kernel module with CAP_SYS_MODULE.
340+
When set to false, a new user namespace is created for the pod. Setting false
341+
is useful to mitigating container breakout vulnerabilities such as allowing
342+
containers to run as root without their user having root privileges on the host.
343+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
344+
type: boolean
333345
imagePullSecrets:
334346
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
335347
type: array
@@ -1139,6 +1151,18 @@ spec:
11391151
hostNetwork:
11401152
description: HostNetwork specifies whether the pod may use the node network namespace
11411153
type: boolean
1154+
hostUsers:
1155+
description: |-
1156+
HostUsers indicates whether the pod will use the host's user namespace.
1157+
Optional: Default to true.
1158+
If set to true or not present, the pod will be run in the host user namespace, useful
1159+
for when the pod needs a feature only available to the host user namespace, such as
1160+
loading a kernel module with CAP_SYS_MODULE.
1161+
When set to false, a new user namespace is created for the pod. Setting false
1162+
is useful to mitigating container breakout vulnerabilities such as allowing
1163+
containers to run as root without their user having root privileges on the host.
1164+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
1165+
type: boolean
11421166
imagePullSecrets:
11431167
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
11441168
type: array
@@ -3477,6 +3501,18 @@ spec:
34773501
hostNetwork:
34783502
description: HostNetwork specifies whether the pod may use the node network namespace
34793503
type: boolean
3504+
hostUsers:
3505+
description: |-
3506+
HostUsers indicates whether the pod will use the host's user namespace.
3507+
Optional: Default to true.
3508+
If set to true or not present, the pod will be run in the host user namespace, useful
3509+
for when the pod needs a feature only available to the host user namespace, such as
3510+
loading a kernel module with CAP_SYS_MODULE.
3511+
When set to false, a new user namespace is created for the pod. Setting false
3512+
is useful to mitigating container breakout vulnerabilities such as allowing
3513+
containers to run as root without their user having root privileges on the host.
3514+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
3515+
type: boolean
34803516
imagePullSecrets:
34813517
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
34823518
type: array
@@ -4113,6 +4149,18 @@ spec:
41134149
hostNetwork:
41144150
description: HostNetwork specifies whether the pod may use the node network namespace
41154151
type: boolean
4152+
hostUsers:
4153+
description: |-
4154+
HostUsers indicates whether the pod will use the host's user namespace.
4155+
Optional: Default to true.
4156+
If set to true or not present, the pod will be run in the host user namespace, useful
4157+
for when the pod needs a feature only available to the host user namespace, such as
4158+
loading a kernel module with CAP_SYS_MODULE.
4159+
When set to false, a new user namespace is created for the pod. Setting false
4160+
is useful to mitigating container breakout vulnerabilities such as allowing
4161+
containers to run as root without their user having root privileges on the host.
4162+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
4163+
type: boolean
41164164
imagePullSecrets:
41174165
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
41184166
type: array

‎config/300-crds/300-taskrun.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,18 @@ spec:
358358
hostNetwork:
359359
description: HostNetwork specifies whether the pod may use the node network namespace
360360
type: boolean
361+
hostUsers:
362+
description: |-
363+
HostUsers indicates whether the pod will use the host's user namespace.
364+
Optional: Default to true.
365+
If set to true or not present, the pod will be run in the host user namespace, useful
366+
for when the pod needs a feature only available to the host user namespace, such as
367+
loading a kernel module with CAP_SYS_MODULE.
368+
When set to false, a new user namespace is created for the pod. Setting false
369+
is useful to mitigating container breakout vulnerabilities such as allowing
370+
containers to run as root without their user having root privileges on the host.
371+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
372+
type: boolean
361373
imagePullSecrets:
362374
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
363375
type: array
@@ -2558,6 +2570,18 @@ spec:
25582570
hostNetwork:
25592571
description: HostNetwork specifies whether the pod may use the node network namespace
25602572
type: boolean
2573+
hostUsers:
2574+
description: |-
2575+
HostUsers indicates whether the pod will use the host's user namespace.
2576+
Optional: Default to true.
2577+
If set to true or not present, the pod will be run in the host user namespace, useful
2578+
for when the pod needs a feature only available to the host user namespace, such as
2579+
loading a kernel module with CAP_SYS_MODULE.
2580+
When set to false, a new user namespace is created for the pod. Setting false
2581+
is useful to mitigating container breakout vulnerabilities such as allowing
2582+
containers to run as root without their user having root privileges on the host.
2583+
This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
2584+
type: boolean
25612585
imagePullSecrets:
25622586
description: ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
25632587
type: array

‎docs/podtemplates.md‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -117,12 +117,16 @@ Pod templates support fields listed in the table below.
117117
pulling a container image</a>.</td>
118118
</tr>
119119
<tr>
120-
<td><code>hostNetwork</code></td>
121-
<td><b>Default:</b> <code>false</code>. Determines whether to use the host network namespace.</td>
122-
</tr>
123-
<tr>
124-
<td><code>hostAliases</code></td>
125-
<td>Adds entries to a Pod's `/etc/hosts` to provide Pod-level overrides of hostnames. For further info see [Kubernetes' docs for this field](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).</td>
120+
<td><code>hostNetwork</code></td>
121+
<td><b>Default:</b> <code>false</code>. Determines whether to use the host network namespace.</td>
122+
</tr>
123+
<tr>
124+
<td><code>hostUsers</code></td>
125+
<td><b>Default:</b> <code>true</code>. Determines whether to use the host's user namespace. When set to <code>false</code>, a new user namespace is created for the pod, providing better security isolation. This is useful for mitigating container breakout vulnerabilities. This field is alpha-level and requires the <code>UserNamespacesSupport</code> feature gate to be enabled on the Kubernetes cluster (available in Kubernetes 1.25+).</td>
126+
</tr>
127+
<tr>
128+
<td><code>hostAliases</code></td>
129+
<td>Adds entries to a Pod's `/etc/hosts` to provide Pod-level overrides of hostnames. For further info see [Kubernetes' docs for this field](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).</td>
126130
</tr>
127131
<tr>
128132
<td><code>topologySpreadConstraints</code></td>

‎pkg/apis/pipeline/pod/template.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,18 @@ type Template struct {
132132
// +optional
133133
HostNetwork bool `json:"hostNetwork,omitempty"`
134134

135+
// HostUsers indicates whether the pod will use the host's user namespace.
136+
// Optional: Default to true.
137+
// If set to true or not present, the pod will be run in the host user namespace, useful
138+
// for when the pod needs a feature only available to the host user namespace, such as
139+
// loading a kernel module with CAP_SYS_MODULE.
140+
// When set to false, a new user namespace is created for the pod. Setting false
141+
// is useful to mitigating container breakout vulnerabilities such as allowing
142+
// containers to run as root without their user having root privileges on the host.
143+
// This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.
144+
// +optional
145+
HostUsers *bool `json:"hostUsers,omitempty"`
146+
135147
// TopologySpreadConstraints controls how Pods are spread across your cluster among
136148
// failure-domains such as regions, zones, nodes, and other user-defined topology domains.
137149
// +optional
@@ -229,6 +241,9 @@ func MergePodTemplateWithDefault(tpl, defaultTpl *PodTemplate) *PodTemplate {
229241
if !tpl.HostNetwork && defaultTpl.HostNetwork {
230242
tpl.HostNetwork = true
231243
}
244+
if tpl.HostUsers == nil {
245+
tpl.HostUsers = defaultTpl.HostUsers
246+
}
232247
if tpl.TopologySpreadConstraints == nil {
233248
tpl.TopologySpreadConstraints = defaultTpl.TopologySpreadConstraints
234249
}

‎pkg/apis/pipeline/pod/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/pipeline/v1/openapi_generated.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/pipeline/v1/swagger.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,10 @@
9595
"description": "HostNetwork specifies whether the pod may use the node network namespace",
9696
"type": "boolean"
9797
},
98+
"hostUsers": {
99+
"description": "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.",
100+
"type": "boolean"
101+
},
98102
"imagePullSecrets": {
99103
"description": "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified",
100104
"type": "array",

‎pkg/apis/pipeline/v1alpha1/openapi_generated.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/pipeline/v1alpha1/swagger.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,10 @@
9595
"description": "HostNetwork specifies whether the pod may use the node network namespace",
9696
"type": "boolean"
9797
},
98+
"hostUsers": {
99+
"description": "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.",
100+
"type": "boolean"
101+
},
98102
"imagePullSecrets": {
99103
"description": "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified",
100104
"type": "array",

‎pkg/apis/pipeline/v1beta1/openapi_generated.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)