kuberuntime: set privileged for sandboxes

pkg/kubelet/container/helpers.go

@@ -261,3 +261,15 @@ func GetContainerSpec(pod *v1.Pod, containerName string) *v1.Container {
 	}
 	return nil
 }
+
+// HasPrivilegedContainer returns true if any of the containers in the pod are privileged.
+func HasPrivilegedContainer(pod *v1.Pod) bool {
+	for _, c := range pod.Spec.Containers {
+		if c.SecurityContext != nil &&
+			c.SecurityContext.Privileged != nil &&
+			*c.SecurityContext.Privileged {
+			return true
+		}
+	}
+	return false
+}

pkg/kubelet/container/helpers_test.go

@@ -211,3 +211,44 @@ func TestShouldContainerBeRestarted(t *testing.T) {
 		}
 	}
 }
+
+func TestHasPrivilegedContainer(t *testing.T) {
+	newBoolPtr := func(b bool) *bool {
+		return &b
+	}
+	tests := map[string]struct {
+		securityContext *v1.SecurityContext
+		expected        bool
+	}{
+		"nil security context": {
+			securityContext: nil,
+			expected:        false,
+		},
+		"nil privileged": {
+			securityContext: &v1.SecurityContext{},
+			expected:        false,
+		},
+		"false privileged": {
+			securityContext: &v1.SecurityContext{Privileged: newBoolPtr(false)},
+			expected:        false,
+		},
+		"true privileged": {
+			securityContext: &v1.SecurityContext{Privileged: newBoolPtr(true)},
+			expected:        true,
+		},
+	}
+
+	for k, v := range tests {
+		pod := &v1.Pod{
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{SecurityContext: v.securityContext},
+				},
+			},
+		}
+		actual := HasPrivilegedContainer(pod)
+		if actual != v.expected {
+			t.Errorf("%s expected %t but got %t", k, v.expected, actual)
+		}
+	}
+}