-
Notifications
You must be signed in to change notification settings - Fork 14.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add seccomp default feature blog post #28951
Add seccomp default feature blog post #28951
Conversation
✔️ Deploy Preview for kubernetes-io-main-staging ready! 🔨 Explore the source changes: 84e472e 🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/61249698af684100079246d8 😎 Browse the preview: https://deploy-preview-28951--kubernetes-io-main-staging.netlify.app |
4223285
to
e730a28
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks like a thorough explanation.
Here's some feedback on the article.
e730a28
to
6d4653b
Compare
0c9aa66
to
3919f2d
Compare
Looks good to review and I don't see a need for a hold (the article is future dated, to a date after the scheduled release). /hold cancel |
Any more feedback or is this OK for LGTM? |
i gave this a read way back, LGTM from my side |
1480b9c
to
0106220
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi. Here's some feedback. It's fine to ship this without addressing the style nits I'm mentioning in this review.
36dca2e
to
d64aa11
Compare
Thank you! I addressed all of the review comments. |
From my point of view the open discussion point has been resolved. Are we good to merge? |
@saschagrunert can you point to a signoff that confirms what this PR is saying is technically correct? If that were available, I'd be happy to approve it right away. |
@PushkarJ are you willing to add /lgtm here? |
I only have source code, container runtimes basically do nothing on privileged containers: CRI-O behaves in the same way. |
From the blog team's perspective, we're looking for a subject matter expert (or someone who is expert enough) to check technical accuracy. SIG Docs can't promise to have the skills for this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These are mostly quick fixes and minor nits. Happy to lgtm after that
- name: test-container-nginx | ||
image: nginx:1.21 | ||
securityContext: | ||
seccompProfile: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for making this change
[strace][strace]) for any executed syscalls which may be blocked by the | ||
default profiles. If that's the case, then you can create a custom seccomp | ||
profile based on the default by adding the additional syscalls to the | ||
`"action": "SCMP_ACT_ALLOW"` section. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1 on blog post
bf7aede
to
3f8b8fc
Compare
Thank you @saschagrunert for patiently resolving all the comments. Looking forward to this blog post and more people using the feature as a result of that :) /lgtm |
LGTM label has been added. Git tree hash: edb48bb7299357c2ce0983dc6863e10171ff0205
|
This adds the blog post about the new Kubernetes `SeccompDefault` alpha feature. Signed-off-by: Sascha Grunert <[email protected]>
3f8b8fc
to
84e472e
Compare
/hold cancel borrowing LGTM from #28951 (comment) |
LGTM label has been added. Git tree hash: ad9c7b7f6f8cd1357b08fc08e1e5aeea81ad8519
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sftim The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This adds the blog post about the new Kubernetes
SeccompDefault
alpha feature./hold
cc @PI-Victor @pmmalinov01 @ashnehete @carlisia @chrisnegus @ritpanjw
Todo