Merge pull request #64276 from wangzhen127/manifests-seccomp

Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for GCE manifests **What this PR does / why we need it**: This PR sets the default seccomp profile of unprivileged addons to 'docker/default' for GCE manifests. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. This is PR is part of #39845. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Merge pull request #64276 from wangzhen127/manifests-seccomp
e2d997cf · Kubernetes Submit Queue · GitHub · 2f011d01 · 227f7d76 · e2d997cf
Unverified Commit e2d997cf authored Jun 05, 2018 by Kubernetes Submit Queue Committed by GitHub Jun 05, 2018
8 changed files
--- a/cluster/gce/manifests/cluster-autoscaler.manifest
+++ b/cluster/gce/manifests/cluster-autoscaler.manifest
@@ -7,6 +7,9 @@
        "labels": {
            "tier": "cluster-management",
            "component": "cluster-autoscaler"
+        },
+        "annotations": {
+            "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
        }
    },
    "spec": {

--- a/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
+++ b/cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
@@ -5,6 +5,7 @@ metadata:
  namespace: kube-system
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ''
+    seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
  labels:
    k8s-app: etcd-empty-dir-cleanup
 spec:

--- a/cluster/gce/manifests/etcd.manifest
+++ b/cluster/gce/manifests/etcd.manifest
@@ -5,7 +5,8 @@
  "name":"etcd-server{{ suffix }}",
  "namespace": "kube-system",
  "annotations": {
-    "scheduler.alpha.kubernetes.io/critical-pod": ""
+    "scheduler.alpha.kubernetes.io/critical-pod": "",
+    "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
  }
 },
 "spec":{
@@ -62,7 +63,7 @@
    "ports": [
      { "name": "serverport",
        "containerPort": {{ server_port }},
-        "hostPort": {{ server_port }} 
+        "hostPort": {{ server_port }}
      },
      { "name": "clientport",
        "containerPort": {{ port }},

--- a/cluster/gce/manifests/glbc.manifest
+++ b/cluster/gce/manifests/glbc.manifest
@@ -5,6 +5,7 @@ metadata:
  namespace: kube-system
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ''
+    seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
  labels:
    k8s-app: gcp-lb-controller
    version: v1.1.1

--- a/cluster/gce/manifests/kube-addon-manager.yaml
+++ b/cluster/gce/manifests/kube-addon-manager.yaml
@@ -5,6 +5,7 @@ metadata:
  namespace: kube-system
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ''
+    seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
  labels:
    component: kube-addon-manager
 spec:

--- a/cluster/gce/manifests/kube-apiserver.manifest
+++ b/cluster/gce/manifests/kube-apiserver.manifest
@@ -5,7 +5,8 @@
  "name":"kube-apiserver",
  "namespace": "kube-system",
  "annotations": {
-    "scheduler.alpha.kubernetes.io/critical-pod": ""
+    "scheduler.alpha.kubernetes.io/critical-pod": "",
+    "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
  },
  "labels": {
    "tier": "control-plane",

--- a/cluster/gce/manifests/kube-controller-manager.manifest
+++ b/cluster/gce/manifests/kube-controller-manager.manifest
@@ -5,7 +5,8 @@
  "name":"kube-controller-manager",
  "namespace": "kube-system",
  "annotations": {
-    "scheduler.alpha.kubernetes.io/critical-pod": ""
+    "scheduler.alpha.kubernetes.io/critical-pod": "",
+    "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
  },
  "labels": {
    "tier": "control-plane",

--- a/cluster/gce/manifests/kube-scheduler.manifest
+++ b/cluster/gce/manifests/kube-scheduler.manifest
@@ -5,7 +5,8 @@
  "name":"kube-scheduler",
  "namespace": "kube-system",
  "annotations": {
-    "scheduler.alpha.kubernetes.io/critical-pod": ""
+    "scheduler.alpha.kubernetes.io/critical-pod": "",
+    "seccomp.security.alpha.kubernetes.io/pod": "docker/default"
  },
  "labels": {
    "tier": "control-plane",