Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for kubernetes device-ownership-from-security-context #4345

Merged
merged 3 commits into from
Jan 4, 2025
Merged

Add support for kubernetes device-ownership-from-security-context #4345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ac9faa8
feat: use kubernetes device ownership setting
vigh-m Dec 19, 2024
7814cfd
migrations: add migrations for kubernete device ownership
vigh-m Dec 19, 2024
edadf82
settings-sdk: Update tagged version
vigh-m Dec 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Release.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
version = "1.29.0"
version = "1.30.0"

[migrations]
"(0.3.1, 0.3.2)" = ["migrate_v0.3.2_admin-container-v0-5-0.lz4"]
Expand Down Expand Up @@ -380,3 +380,7 @@ version = "1.29.0"
"migrate_v1.28.0_public-control-container-v0-7-18.lz4",
]
"(1.28.0, 1.29.0)" = []
"(1.29.0, 1.30.0)" = [
"migrate_v1.30.0_kubernetes-device-ownership-metadata.lz4",
"migrate_v1.30.0_kubernetes-device-ownership-settings.lz4"
]
2 changes: 1 addition & 1 deletion Twoliter.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
schema-version = 1
release-version = "1.29.0"
release-version = "1.30.0"

[vendor.bottlerocket]
registry = "public.ecr.aws/bottlerocket"
Expand Down
86 changes: 50 additions & 36 deletions sources/Cargo.lock
View file
Open in desktop

Large diffs are not rendered by default.

14 changes: 8 additions & 6 deletions sources/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ members = [
"settings-migrations/v1.28.0/public-admin-container-v0-11-14",
"settings-migrations/v1.28.0/aws-control-container-v0-7-18",
"settings-migrations/v1.28.0/public-control-container-v0-7-18",
"settings-migrations/v1.30.0/kubernetes-device-ownership-settings",
"settings-migrations/v1.30.0/kubernetes-device-ownership-metadata",

"settings-plugins/aws-dev",
"settings-plugins/aws-ecs-1",
Expand Down Expand Up @@ -147,22 +149,22 @@ version = "0.1.0"

[workspace.dependencies.bottlerocket-modeled-types]
git = "https://github.com/bottlerocket-os/bottlerocket-settings-sdk"
tag = "bottlerocket-settings-models-v0.6.0"
version = "0.6.0"
tag = "bottlerocket-settings-models-v0.7.0"
version = "0.7.0"

[workspace.dependencies.bottlerocket-settings-models]
git = "https://github.com/bottlerocket-os/bottlerocket-settings-sdk"
tag = "bottlerocket-settings-models-v0.6.0"
version = "0.6.0"
tag = "bottlerocket-settings-models-v0.7.0"
version = "0.7.0"

[workspace.dependencies.bottlerocket-settings-plugin]
git = "https://github.com/bottlerocket-os/bottlerocket-settings-sdk"
tag = "bottlerocket-settings-plugin-v0.1.0"
tag = "bottlerocket-settings-models-v0.7.0"
version = "0.1.0"

[workspace.dependencies.settings-extension-oci-defaults]
git = "https://github.com/bottlerocket-os/bottlerocket-settings-sdk"
tag = "bottlerocket-settings-models-v0.6.0"
tag = "bottlerocket-settings-models-v0.7.0"
version = "0.1.0"

[profile.release]
Expand Down
1 change: 1 addition & 0 deletions ...defaults/aws-k8s-1.24-nvidia/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ttings-defaults/aws-k8s-1.24/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...defaults/aws-k8s-1.25-nvidia/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ttings-defaults/aws-k8s-1.25/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...defaults/aws-k8s-1.26-nvidia/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ttings-defaults/aws-k8s-1.26/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...defaults/aws-k8s-1.31-nvidia/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ttings-defaults/aws-k8s-1.31/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ings-defaults/metal-k8s-1.30/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
1 change: 1 addition & 0 deletions ...ngs-defaults/vmware-k8s-1.31/defaults.d/55-kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/kubernetes-device-ownership-default-false.toml
15 changes: 15 additions & 0 deletions sources/settings-migrations/v1.30.0/kubernetes-device-ownership-metadata/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
[package]
name = "kubernetes-device-ownership-metadata"
version = "0.1.0"
authors = ["Vighnesh Maheshwari <vighmah@amazon.com>"]
license = "Apache-2.0 OR MIT"
edition = "2021"
publish = false
# Don't rebuild crate just because of changes to README.
exclude = ["README.md"]


# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
migration-helpers.workspace = true
21 changes: 21 additions & 0 deletions sources/settings-migrations/v1.30.0/kubernetes-device-ownership-metadata/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
use migration_helpers::common_migrations::AddSettingsMigration;
use migration_helpers::{migrate, Result};
use std::process;

/// We added a new setting, `settings.kubernetes.device-ownership-from-security-context` to allow containers to gain
/// ownership of the requested device
fn run() -> Result<()> {
migrate(AddSettingsMigration(&[
"settings.kubernetes.device-ownership-from-security-context",
]))
}

// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
// https://github.com/shepmaster/snafu/issues/110
fn main() {
if let Err(e) = run() {
eprintln!("{}", e);
process::exit(1);
}
}
15 changes: 15 additions & 0 deletions sources/settings-migrations/v1.30.0/kubernetes-device-ownership-settings/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
[package]
name = "kubernetes-device-ownership-settings"
version = "0.1.0"
authors = ["Vighnesh Maheshwari <vighmah@amazon.com>"]
license = "Apache-2.0 OR MIT"
edition = "2021"
publish = false
# Don't rebuild crate just because of changes to README.
exclude = ["README.md"]


# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
migration-helpers.workspace = true
22 changes: 22 additions & 0 deletions sources/settings-migrations/v1.30.0/kubernetes-device-ownership-settings/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
use migration_helpers::common_migrations::{AddMetadataMigration, SettingMetadata};
use migration_helpers::{migrate, Result};
use std::process;

/// We added a new setting, `settings.kubernetes.device-ownership-from-security-context` to allow containers to gain
/// ownership of the requested device
fn run() -> Result<()> {
migrate(AddMetadataMigration(&[SettingMetadata {
metadata: &["affected-services"],
setting: "settings.kubernetes.device-ownership-from-security-context",
}]))
}

// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
// https://github.com/shepmaster/snafu/issues/110
fn main() {
if let Err(e) = run() {
eprintln!("{}", e);
process::exit(1);
}
}
5 changes: 5 additions & 0 deletions sources/shared-defaults/kubernetes-device-ownership-default-false.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
[settings.kubernetes]
device-ownership-from-security-context = false

[metadata.settings.kubernetes.device-ownership-from-security-context]
affected-services = ["containerd"]