webhook: enforce min memory limits and allow privileged containers

[Redent0r]

Merge Checklist

• Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
• Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
• Merged using "create a merge commit" rather than "squash and merge" (or similar)

Summary

This merges to msft-main the current webhook implementation we use in conformance tests. We differ from the upstream implementation in 2 ways:

• we enforce min memory limits to account for kata-containers@0ec3403
• we allow privileged containers https://microsoft.visualstudio.com/OS/_workitems/edit/48222512?src=WorkItemMention&src-action=artifact_link

Associated issues

Links to CVEs

Test Methodology

https://dev.azure.com/mariner-org/mariner/_build/results?buildId=963302&view=results

[sprt]

@Redent0r Could you upstream the privileged commit? Do you know who uses the webhook upstream?

@Camelron @danmihai1 Does it make any sense to upstream the memory limit commit (which is already behind a flag) given how we handle memory?

[danmihai1]

@Redent0r Could you upstream the privileged commit? Do you know who uses the webhook upstream?

@Camelron @danmihai1 Does it make any sense to upstream the memory limit commit (which is already behind a flag) given how we handle memory?

Someone would have to carefully compare the upstream behavior with the behavior of CLH + MSHV. I expect that it's very different and the discussion with upstream would take a long time.

[Redent0r]

@Redent0r Could you upstream the privileged commit? Do you know who uses the webhook upstream?

Judging by CI usage, only openshift https://github.com/kata-containers/kata-containers/blob/main/ci/openshift-ci/peer-pods-azure.sh#L269 I'll reach out

[sprt]

@Redent0r Could you upstream the privileged commit? Do you know who uses the webhook upstream?

Judging by CI usage, only openshift https://github.com/kata-containers/kata-containers/blob/main/ci/openshift-ci/peer-pods-azure.sh#L269 I'll reach out

Agreed - we can open a PR and add Lukasz and Greg as reviewers.

[Redent0r]

@Redent0r Could you upstream the privileged commit? Do you know who uses the webhook upstream?

Judging by CI usage, only openshift https://github.com/kata-containers/kata-containers/blob/main/ci/openshift-ci/peer-pods-azure.sh#L269 I'll reach out

Agreed - we can open a PR and add Lukasz and Greg as reviewers.

kata-containers#12008

[sprt]

LGTM but the commit messages could be more descriptive for posterity.