@@ -37,6 +37,9 @@ const (
3737 // Allowed neither explicitly disables or enables a behavior.
3838 // eg. allow a client to control behavior with an annotation or allow a new value through validation.
3939 Allowed Flag = "Allowed"
40+ // AllowRootBounded is used by secure-pod-defaults to apply secure defaults without enforcing strict policies;
41+ // sets RunAsNonRoot to true if not already specified
42+ AllowRootBounded Flag = "AllowRootBounded"
4043)
4144
4245// service annotations under features.knative.dev/*
@@ -124,7 +127,7 @@ func NewFeaturesConfigFromMap(data map[string]string) (*Features, error) {
124127 asFlag ("multi-container-probing" , & nc .MultiContainerProbing ),
125128 asFlag ("queueproxy.mount-podinfo" , & nc .QueueProxyMountPodInfo ),
126129 asFlag ("queueproxy.resource-defaults" , & nc .QueueProxyResourceDefaults ),
127- asFlag ("secure-pod-defaults" , & nc .SecurePodDefaults ),
130+ asSecurePodDefaultsFlag ("secure-pod-defaults" , & nc .SecurePodDefaults ),
128131 asFlag ("tag-header-based-routing" , & nc .TagHeaderBasedRouting ),
129132 asFlag (FeatureContainerSpecAddCapabilities , & nc .ContainerSpecAddCapabilities ),
130133 asFlag (FeaturePodSpecAffinity , & nc .PodSpecAffinity ),
@@ -198,6 +201,7 @@ type Features struct {
198201}
199202
200203// asFlag parses the value at key as a Flag into the target, if it exists.
204+ // Only accepts Enabled, Disabled, and Allowed values.
201205func asFlag (key string , target * Flag ) cm.ParseFunc {
202206 return func (data map [string ]string ) error {
203207 if raw , ok := data [key ]; ok {
@@ -211,3 +215,19 @@ func asFlag(key string, target *Flag) cm.ParseFunc {
211215 return nil
212216 }
213217}
218+
219+ // asSecurePodDefaultsFlag parses the value at key as a Flag into the target, if it exists.
220+ // Accepts Enabled, Disabled, Allowed, and SecureDefaultsOverridable values.
221+ func asSecurePodDefaultsFlag (key string , target * Flag ) cm.ParseFunc {
222+ return func (data map [string ]string ) error {
223+ if raw , ok := data [key ]; ok {
224+ for _ , flag := range []Flag {Disabled , AllowRootBounded , Enabled } {
225+ if strings .EqualFold (raw , string (flag )) {
226+ * target = flag
227+ return nil
228+ }
229+ }
230+ }
231+ return nil
232+ }
233+ }
0 commit comments