UPSTREAM: 1234: Fix user namespace validation for runAsGroup, fsGroup, and supplementalGroups_3

Author: Rohit Patil

pkg/apis/core/validation/validation.go

@@ -5411,7 +5411,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("fsGroup"), *(securityContext.FSGroup), msg))
 			}
 			// When user namespaces are enabled (hostUsers=false), GIDs must be in range 0-65535
-			if !hostUsers && *securityContext.FSGroup > 65535 {
+			if !hostUsers && *securityContext.FSGroup > 65534 {
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("fsGroup"), *securityContext.FSGroup, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 			}
 		}
@@ -5420,7 +5420,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *(securityContext.RunAsUser), msg))
 			}
 			// When user namespaces are enabled (hostUsers=false), UIDs must be in range 0-65535
-			if !hostUsers && *securityContext.RunAsUser > 65535 {
+			if !hostUsers && *securityContext.RunAsUser > 65534 {
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *securityContext.RunAsUser, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 			}
 		}
@@ -5429,7 +5429,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *(securityContext.RunAsGroup), msg))
 			}
 			// When user namespaces are enabled (hostUsers=false), GIDs must be in range 0-65535
-			if !hostUsers && *securityContext.RunAsGroup > 65535 {
+			if !hostUsers && *securityContext.RunAsGroup > 65534 {
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *securityContext.RunAsGroup, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 			}
 		}
@@ -5438,7 +5438,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("supplementalGroups").Index(g), gid, msg))
 			}
 			// When user namespaces are enabled (hostUsers=false), GIDs must be in range 0-65535
-			if !hostUsers && gid > 65535 {
+			if !hostUsers && gid > 65534 {
 				allErrs = append(allErrs, field.Invalid(fldPath.Child("supplementalGroups").Index(g), gid, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 			}
 		}
@@ -8089,7 +8089,7 @@ func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path, host
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, msg))
 		}
 		// When user namespaces are enabled (hostUsers=false), UIDs must be in range 0-65535
-		if !hostUsers && *sc.RunAsUser > 65535 {
+		if !hostUsers && *sc.RunAsUser > 65534 {
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 		}
 	}
@@ -8099,7 +8099,7 @@ func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path, host
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *sc.RunAsGroup, msg))
 		}
 		// When user namespaces are enabled (hostUsers=false), GIDs must be in range 0-65535
-		if !hostUsers && *sc.RunAsGroup > 65535 {
+		if !hostUsers && *sc.RunAsGroup > 65534 {
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *sc.RunAsGroup, "must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)"))
 		}
 	}

pkg/apis/core/validation/validation_test.go

@@ -23195,25 +23195,25 @@ func TestValidateSecurityContext(t *testing.T) {
 		"runAsUser exceeds user namespace boundary": {
 			sc:          invalidUserNsUserBoundary,
 			errorType:   "FieldValueInvalid",
-			errorDetail: "must be between 0 and 65534 when user namespaces are enabled",
+			errorDetail: "must be between 0 and 65535 when user namespaces are enabled",
 			hostUsers:   false,
 		},
 		"runAsUser exceeds user namespace limit": {
 			sc:          invalidUserNsUserHigh,
 			errorType:   "FieldValueInvalid",
-			errorDetail: "must be between 0 and 65534 when user namespaces are enabled",
+			errorDetail: "must be between 0 and 65535 when user namespaces are enabled",
 			hostUsers:   false,
 		},
 		"runAsGroup exceeds user namespace boundary": {
 			sc:          invalidUserNsGroupBoundary,
 			errorType:   "FieldValueInvalid",
-			errorDetail: "must be between 0 and 65534 when user namespaces are enabled",
+			errorDetail: "must be between 0 and 65535 when user namespaces are enabled",
 			hostUsers:   false,
 		},
 		"runAsGroup exceeds user namespace limit": {
 			sc:          invalidUserNsGroupHigh,
 			errorType:   "FieldValueInvalid",
-			errorDetail: "must be between 0 and 65534 when user namespaces are enabled",
+			errorDetail: "must be between 0 and 65535 when user namespaces are enabled",
 			hostUsers:   false,
 		},
 	}
@@ -23307,47 +23307,47 @@ func TestValidatePodSecurityContextUserNamespaceLimits(t *testing.T) {
 				FSGroup: &invalidGID,
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 		{
 			name: "runAsUser exceeds limit with hostUsers false",
 			sc: &core.PodSecurityContext{
 				RunAsUser: &invalidUID,
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 		{
 			name: "runAsGroup exceeds limit with hostUsers false",
 			sc: &core.PodSecurityContext{
 				RunAsGroup: &invalidGID,
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 		{
 			name: "supplementalGroups exceeds limit with hostUsers false",
 			sc: &core.PodSecurityContext{
 				SupplementalGroups: []int64{1000, invalidGID, 2000},
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 		{
 			name: "very high fsGroup with hostUsers false",
 			sc: &core.PodSecurityContext{
 				FSGroup: &veryHighGID,
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 		{
 			name: "very high runAsUser with hostUsers false",
 			sc: &core.PodSecurityContext{
 				RunAsUser: &veryHighUID,
 			},
 			hostUsers:   false,
-			expectedErr: "must be between 0 and 65534 when user namespaces are enabled",
+			expectedErr: "must be between 0 and 65535 when user namespaces are enabled",
 		},
 	}