VAULT-14149 Don't override shareProcessNamespace unless annotation is explicitly set #445
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
By having a default of `false`, we would automatically set `shareProcessNamespace` to `false` when injecting the agent pod, regardless of what the main manifest had set. Instead, we should only set `shareProcessNamespace` if the annotation is explicitly set, and otherwise let the default from the main manifest stand. Fixes #436 (thanks @justinas-b for reporting it). I tested this by: * Before this patch: * Create a pod with `shareProcessNamespace: true` with injected agent * Verifying that the containers cannot see each other with `ps -ax` * After this patch: * Create a pod with `shareProcessNamespace: true` with injected agent and no annotation * Verifying that the containers *can* see each other with `ps -ax` * Create a pod with `shareProcessNamespace: true` with injected agent and annotation set to `'false'` * Verifying that the containers *cannot* see each other with `ps -ax`
swenson
force-pushed
the
dont-override-share-process-namespace
branch
from
95317ff to
0573487
Compare
swenson
changed the title
added 2 commits
March 17, 2023 15:11
tvoran
approved these changes
Mar 17, 2023
There was a problem hiding this comment.
Might be nice to add some tests in here for shareProcessNamespace?
|
Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By having a default of
false, we would automatically setshareProcessNamespacetofalsewhen injecting the agent pod, regardless of what the main manifest had set.Instead, we should only set
shareProcessNamespaceif the annotation is explicitly set, and otherwise let the default from the main manifest stand.Fixes #436 (thanks @justinas-b for reporting it).
I tested this by:
shareProcessNamespace: truewith injected agentps -axshareProcessNamespace: truewith injected agent and no annotationps -axshareProcessNamespace: truewith injected agent and annotation set to'false'ps -ax