mirror of
https://github.com/hanzoai/volume.git
synced 2026-10-01 00:48:00 +00:00
zeekay
b61441f7d7
A fork of Rancher's local-path-provisioner at v0.0.36. The behaviour is unchanged and deliberately so — a directory on the node a pod lands on is the right thing for a disk. What changes is identity. The provisioner answers to hanzo.ai/volume rather than rancher.io/local-path. That is not branding: two provisioners sharing one name race for the same claims, and a stock k3s carries the upstream one, so a cluster running both would settle our storage by chance. Data lives at /var/lib/hanzo/volume, so reading a Hanzo cluster does not mean learning another vendor's directory. Apache-2.0 as published, unaltered, with Rancher's attribution in NOTICE. The README says what this is not: durability. A volume here dies with its node. That is hanzoai/replicate's question, one layer up, and keeping the two apart is what lets the disk stay this simple.
122 lines
3.7 KiB
Go
122 lines
3.7 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
|
|
v1 "k8s.io/api/core/v1"
|
|
"sigs.k8s.io/yaml"
|
|
)
|
|
|
|
func loadFile(filepath string) (string, error) {
|
|
f, err := os.Open(filepath)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer func() {
|
|
_ = f.Close()
|
|
}()
|
|
helperPodYaml, err := io.ReadAll(f)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(helperPodYaml), nil
|
|
}
|
|
|
|
func loadHelperPodFile(helperPodYaml string, allowUnsafe bool) (*v1.Pod, error) {
|
|
helperPodJSON, err := yaml.YAMLToJSON([]byte(helperPodYaml))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid YAMLToJSON the helper pod with helperPodYaml: %v", helperPodYaml)
|
|
}
|
|
p := v1.Pod{}
|
|
err = json.Unmarshal(helperPodJSON, &p)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid unmarshal the helper pod with helperPodJson: %v", string(helperPodJSON))
|
|
}
|
|
if len(p.Spec.Containers) == 0 {
|
|
return nil, fmt.Errorf("helper pod template does not specify any container")
|
|
}
|
|
if err := validateHelperPodTemplate(&p, allowUnsafe); err != nil {
|
|
return nil, err
|
|
}
|
|
return &p, nil
|
|
}
|
|
|
|
func validateHelperPodTemplate(p *v1.Pod, allowUnsafe bool) error {
|
|
if allowUnsafe {
|
|
return nil
|
|
}
|
|
|
|
forbid := func(cond bool, field string) error {
|
|
if !cond {
|
|
return nil
|
|
}
|
|
return fmt.Errorf("helper pod template must not %s unless %s is enabled", field, FlagAllowUnsafeHelperPodTemplate)
|
|
}
|
|
|
|
if len(p.Spec.Containers) != 1 {
|
|
return fmt.Errorf("helper pod template must specify exactly one container")
|
|
}
|
|
|
|
container := p.Spec.Containers[0]
|
|
checks := []struct {
|
|
invalid bool
|
|
field string
|
|
}{
|
|
{len(p.Spec.InitContainers) > 0, "define initContainers"},
|
|
{len(p.Spec.EphemeralContainers) > 0, "define ephemeralContainers"},
|
|
{len(p.Spec.Volumes) > 0, "define custom volumes"},
|
|
{p.Spec.HostNetwork || p.Spec.HostPID || p.Spec.HostIPC, "enable host namespaces"},
|
|
{p.Spec.NodeName != "", "set spec.nodeName"},
|
|
{p.Spec.ServiceAccountName != "", "set spec.serviceAccountName"},
|
|
{len(container.VolumeMounts) > 0, "define custom volumeMounts"},
|
|
{len(container.EnvFrom) > 0, "define envFrom"},
|
|
{container.Lifecycle != nil, "define container lifecycle hooks"},
|
|
{container.LivenessProbe != nil, "define container livenessProbe"},
|
|
{container.ReadinessProbe != nil, "define container readinessProbe"},
|
|
{container.StartupProbe != nil, "define container startupProbe"},
|
|
}
|
|
for _, check := range checks {
|
|
if err := forbid(check.invalid, check.field); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
for _, env := range container.Env {
|
|
if err := forbid(env.ValueFrom != nil, fmt.Sprintf("define env.valueFrom (env %q)", env.Name)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
// Validate pod securityContext: block dangerous fields,
|
|
// but allow hardening fields (runAsNonRoot, fsGroup, seccompProfile, etc.)
|
|
if psc := p.Spec.SecurityContext; psc != nil {
|
|
if err := forbid(psc.RunAsUser != nil && *psc.RunAsUser == 0, "set pod runAsUser to 0 (root)"); err != nil {
|
|
return err
|
|
}
|
|
if err := forbid(psc.RunAsGroup != nil && *psc.RunAsGroup == 0, "set pod runAsGroup to 0 (root)"); err != nil {
|
|
return err
|
|
}
|
|
if err := forbid(len(psc.Sysctls) > 0, "define sysctls"); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
// Validate container securityContext: block privilege escalation fields,
|
|
// but allow hardening fields (runAsNonRoot, readOnlyRootFilesystem, etc.)
|
|
if sc := container.SecurityContext; sc != nil {
|
|
if err := forbid(sc.Privileged != nil && *sc.Privileged, "set privileged: true"); err != nil {
|
|
return err
|
|
}
|
|
if err := forbid(sc.Capabilities != nil && len(sc.Capabilities.Add) > 0, "add capabilities"); err != nil {
|
|
return err
|
|
}
|
|
if err := forbid(sc.AllowPrivilegeEscalation != nil && *sc.AllowPrivilegeEscalation, "set allowPrivilegeEscalation: true"); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|