Add option to disable fips mode in pod

umohnani8 · umohnani8 · commit b74bd2bb8b50 · 2019-11-20T20:50:24.000+05:30
If the FIPS_DISABLE=true is set, then the fips secret
is not mounted in the pod.

Signed-off-by: Urvashi Mohnani &lt;umohnani@redhat.com&gt;
diff --git a/server/container_create_linux.go b/server/container_create_linux.go
@@ -820,8 +820,13 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
 			return nil, fmt.Errorf("failed to mount secrets: %v", err)
 		}
 	}
+	// Check for FIPS_DISABLE label in the pod config
+	disableFips := false
+	if value, ok := sandboxConfig.GetLabels()["FIPS_DISABLE"]; ok && value == "true" {
+		disableFips = true
+	}
 	// Add secrets from the default and override mounts.conf files
-	secretMounts = append(secretMounts, secrets.SecretMounts(mountLabel, containerInfo.RunDir, s.config.DefaultMountsFile, rootless.IsRootless())...)
+	secretMounts = append(secretMounts, secrets.SecretMounts(mountLabel, containerInfo.RunDir, s.config.DefaultMountsFile, rootless.IsRootless(), disableFips)...)
 
 	mounts := []rspec.Mount{}
 	mounts = append(mounts, ociMounts...)

Original file line number	Diff line number	Diff line change
`@@ -820,8 +820,13 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai`
`820`	`820`	`return nil, fmt.Errorf("failed to mount secrets: %v", err)`
`821`	`821`	`}`
`822`	`822`	`}`
	`823`	`+ // Check for FIPS_DISABLE label in the pod config`
	`824`	`+ disableFips := false`
	`825`	`+ if value, ok := sandboxConfig.GetLabels()["FIPS_DISABLE"]; ok && value == "true" {`
	`826`	`+ disableFips = true`
	`827`	`+ }`
`823`	`828`	`// Add secrets from the default and override mounts.conf files`
`824`		`- secretMounts = append(secretMounts, secrets.SecretMounts(mountLabel, containerInfo.RunDir, s.config.DefaultMountsFile, rootless.IsRootless())...)`
	`829`	`+ secretMounts = append(secretMounts, secrets.SecretMounts(mountLabel, containerInfo.RunDir, s.config.DefaultMountsFile, rootless.IsRootless(), disableFips)...)`
`825`	`830`
`826`	`831`	`mounts := []rspec.Mount{}`
`827`	`832`	`mounts = append(mounts, ociMounts...)`