Merge pull request #233 from microsoft/danmihai1/uid-for-more-resourc…

…e-types

genpolicy: get UID from PodSecurityContext

src/tools/genpolicy/src/daemon_set.rs

@@ -143,4 +143,8 @@ impl yaml::K8sResource for DaemonSet {
         }
         false
     }
+
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }

src/tools/genpolicy/src/deployment.rs

@@ -141,4 +141,8 @@ impl yaml::K8sResource for Deployment {
         }
         false
     }
+
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }

src/tools/genpolicy/src/job.rs

@@ -115,4 +115,8 @@ impl yaml::K8sResource for Job {
         }
         false
     }
+
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }

src/tools/genpolicy/src/pod.rs

@@ -95,7 +95,7 @@ pub struct PodSpec {
     topologySpreadConstraints: Option<Vec<TopologySpreadConstraint>>,
 
     #[serde(skip_serializing_if = "Option::is_none")]
-    securityContext: Option<PodSecurityContext>,
+    pub securityContext: Option<PodSecurityContext>,
 
     #[serde(skip_serializing_if = "Option::is_none")]
     priorityClassName: Option<String>,
@@ -310,9 +310,9 @@ struct SeccompProfile {
 
 /// See Reference / Kubernetes API / Workload Resources / Pod.
 #[derive(Clone, Debug, Serialize, Deserialize)]
-struct PodSecurityContext {
+pub struct PodSecurityContext {
     #[serde(skip_serializing_if = "Option::is_none")]
-    runAsUser: Option<i64>,
+    pub runAsUser: Option<i64>,
     // TODO: additional fields.
 }
 
@@ -880,11 +880,7 @@ impl yaml::K8sResource for Pod {
     }
 
     fn get_process_fields(&self, process: &mut policy::KataProcess) {
-        if let Some(context) = &self.spec.securityContext {
-            if let Some(uid) = context.runAsUser {
-                process.User.UID = uid.try_into().unwrap();
-            }
-        }
+        yaml::get_process_fields(process, &self.spec.securityContext);
     }
 }
 

src/tools/genpolicy/src/replica_set.rs

@@ -113,4 +113,8 @@ impl yaml::K8sResource for ReplicaSet {
         }
         false
     }
+
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }

src/tools/genpolicy/src/replication_controller.rs

@@ -115,4 +115,8 @@ impl yaml::K8sResource for ReplicationController {
         }
         false
     }
+
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }

src/tools/genpolicy/src/stateful_set.rs

@@ -194,6 +194,9 @@ impl yaml::K8sResource for StatefulSet {
         }
         false
     }
+    fn get_process_fields(&self, process: &mut policy::KataProcess) {
+        yaml::get_process_fields(process, &self.spec.template.spec.securityContext);
+    }
 }
 
 impl StatefulSet {

src/tools/genpolicy/src/yaml.rs

@@ -73,8 +73,8 @@ pub trait K8sResource {
     fn use_host_network(&self) -> bool;
     fn use_sandbox_pidns(&self) -> bool;
     fn get_process_fields(&self, _process: &mut policy::KataProcess) {
-        // Just Pods can have a PodSecurityContext field, so the other
-        // resources can use this default get_process_fields implementation.
+        // No need to implement support for securityContext or similar fields
+        // for some of the K8s resource types.
     }
 }
 
@@ -339,3 +339,14 @@ fn handle_unused_field(path: &str, silent_unsupported_fields: bool) {
         panic!("Unsupported field: {}", path);
     }
 }
+
+pub fn get_process_fields(
+    process: &mut policy::KataProcess,
+    security_context: &Option<pod::PodSecurityContext>,
+) {
+    if let Some(context) = security_context {
+        if let Some(uid) = context.runAsUser {
+            process.User.UID = uid.try_into().unwrap();
+        }
+    }
+}