aljaz/kata-containers
1
0
Fork 0
mirror of https://github.com/aljazceru/kata-containers.git synced 2026-01-31 04:04:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

config: Whitelist hypervisor annotations by name

Browse Source 
Add a field "enable_annotations" to the runtime configuration that can
be used to whitelist annotations using a list of regular expressions,
which are used to match any part of the base annotation name, i.e. the
part after "io.katacontainers.config.hypervisor."

For example, the following configuraiton will match "virtio_fs_daemon",
"initrd" and "jailer_path", but not "path" nor "firmware":

  enable_annotations = [ "virtio.*", "initrd", "_path" ]

The default is an empty list of enabled annotations, which disables
annotations entirely.

If an anontation is rejected, the message is something like:

  annotation io.katacontainers.config.hypervisor.virtio_fs_daemon is not enabled

Fixes: #901

Suggested-by: Peng Tao <tao.peng@linux.alibaba.com>
Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
This commit is contained in:
Christophe de Dinechin
2020-05-19 19:19:42 +02:00
parent f047fced0b
commit 7c6aede5d4
12 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/runtime/virtcontainers/pkg/annotations/annotations.go
View File

@@ -28,6 +28,7 @@ const (
//
// Assets
//
KataAnnotationHypervisorPrefix = kataAnnotHypervisorPrefix
// KernelPath is a sandbox annotation for passing a per container path pointing at the kernel needed to boot the container VM.
KernelPath = kataAnnotHypervisorPrefix + "kernel"