Skip to content
This repository has been archived by the owner on Jan 12, 2023. It is now read-only.

Stopped collection of mutations on DELETE operations #130

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

Kaezon
Copy link

@Kaezon Kaezon commented Nov 2, 2021

The Default Seccomp policy was mutating DELETE operations, which the k8s API does not accept.
This was preventing the normal deletion of pods as long as this policy was enabled.

By adding an early return to the policy which avoids the processing of DELETE requests, #122 should be resolved.

@Kaezon
Copy link
Author

Kaezon commented Nov 2, 2021

Now that I'm thinking about it, maybe blocking the mutation of DELETE operations at a more global level would be a better approach. That would at least prevent future policies and plugins from causing this problem again.

@Kaezon
Copy link
Author

Kaezon commented Nov 3, 2021

I added a guard around the patch list append which prevents mutations from being collected for DELETE requests.
This should effectively prevent future policies and plugins from mutating DELETE requests without interfering with other enforcement actions.

@Kaezon Kaezon changed the title added early return to pod seccomp policy Stopped collection of mutations on DELETE operations Nov 5, 2021
@mark-adams
Copy link
Contributor

👋 The k-rail project has been deprecated and is no longer under active development. We recommend taking a look at OPA Gatekeeper to see if it might meet your needs going forward.

Thanks for your contribution(s) to the project!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants