api
api copied to clipboard
openshift
OCPNODE-2387: SCC: add AllowHostUsers field
to allow an SCC to toggle whether a pod is forced to be confined by a user namespace
Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all
![openshift-ci[bot] avatar](https://avatars.githubusercontent.com/in/91280?v=4 "Published by a pub.dev verified publisher"){kind=small}
Hello @haircommander! Some important instructions when contributing to openshift/api: API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.
@haircommander: This pull request references OCPNODE-2387 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.17.0" version, but no target version was set.
In response to this:
to allow an SCC to toggle whether a pod is forced to be confined by a user namespace
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.
@ibihim @wallylewis are you both ok with this addition to SCC, I believe auth team would own this right?
/test minor-e2e-upgrade-minor
Odd that the CLI image is missing suddenly, I don't think that's a configuration problem
updated, thanks @JoelSpeed ! Any reviews I can gather work for me, @deads2k do you have any additional notes?
Adding a new default breaks the integration tests, you'll have to add the new default field to the expected
We are asking folks to fix SSA tags as and when they come up, could you please look into fixing, for most this is just a case of adding +listType=atomic unless there is an obvious need for a map type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.requiredDropCapabilities must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.allowedCapabilities must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.seccompProfiles must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.fsGroup.ranges must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.groups must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.supplementalGroups.ranges must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.defaultAddCapabilities must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.volumes must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.allowedFlexVolumes must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.allowedUnsafeSysctls must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.forbiddenSysctls must set x-kubernetes-list-type
error in security/v1/zz_generated.crd-manifests/0000_03_config-operator_01_securitycontextconstraints-CustomNoUpgrade.crd.yaml: ListsMustHaveSSATags: crd/securitycontextconstraints.security.openshift.io version/v1 field/^.users must set x-kubernetes-list-type
/override ci/prow/verify-crd-schema
We can't fix the existing NoBool issues
@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-crd-schema
In response to this:
/override ci/prow/verify-crd-schema
We can't fix the existing NoBool issues
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.
@JoelSpeed: Overrode contexts on behalf of JoelSpeed: ci/prow/verify-crd-schema
In response to this:
LGTM once the auth team ack /override ci/prow/verify-crd-schema
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: haircommander, JoelSpeed, liouk
The full list of commands accepted by this bot can be found here.
The pull request process is described here
- ~~OWNERS~~ [JoelSpeed]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
/retest-required
Remaining retests: 0 against base HEAD 717c5f8afa740e80c886e8708245e228fd95a1d4 and 2 for PR HEAD 8a4c0e172baf8e2241834f5b68fd44d35dcfc5c0 in total
@mrunalp: Overrode contexts on behalf of mrunalp: ci/prow/verify-crd-schema
In response to this:
/override ci/prow/verify-crd-schema
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.
@mrunalp: Overrode contexts on behalf of mrunalp: ci/prow/verify-crd-schema
In response to this:
/override ci/prow/verify-crd-schema
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.