Change:
Fully described in , and will visit these fields for all containers, regardless of whether they're hidden behind a feature gate (e.g. ). This is usually correct, these methods are often used to drop fields and in this case should visit all containers that are persisted regardless of whether they're disabled, but the callers of these methods should signal that explicitly rather than relying on the implicit behavior. /cc /priority important-longterm /kind bug /sig node
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : Fully described in , and will visit these fields for all containers, regardless of whether they're hidden behind a feature gate (e.g. ). /priority important/long-term /kind bug /sig node Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
are you interested in taking this one, too?
VisitPodSecretNames and VisitPodConfigmapNames already specify AllContainers for VisitContainers Can you let me know what else needs to be done?
Callers should specify whether they want to visit all containers or not. There are valid reasons for each, so we shouldn't assume the desired behavior, even if 100% of the current users want to visit all containers. Jordan's original comment in has some examples of current uses. I don't think this needs to be as configurable as , so my naive first attempt to implement this would probably just be a new to and

Discussion:
// referenced by the pod spec. If visitor returns false, visiting is short-circuited. // Transitive references (e.g. pod -> pvc -> pv -> secret) are not visited. // Returns true if visiting completed, false if visiting was short-circuited. <del> func VisitPodSecretNames(pod *api.Pod, visitor Visitor) bool { </del> <ins> func VisitPodSecretNames(pod *api.Pod, visitor Visitor, containerType ContainerType) bool { </ins> for _, reference := range pod.Spec.ImagePullSecrets { if !visitor(reference.Name) { return false } } <del> VisitContainers(&pod.Spec, AllContainers, func(c *api.Container, containerType ContainerType) bool { </del> <ins> VisitContainers(&pod.Spec, containerType, func(c *api.Container, containerType ContainerType) bool { </ins> return visitContainerSecretNames(c, visitor) }) var source *api.VolumeSource

// referenced by the pod spec. If visitor returns false, visiting is short-circuited. // Transitive references (e.g. pod -> pvc -> pv -> secret) are not visited. // Returns true if visiting completed, false if visiting was short-circuited. <del> func VisitPodConfigmapNames(pod *api.Pod, visitor Visitor) bool { VisitContainers(&pod.Spec, AllContainers, func(c *api.Container, containerType ContainerType) bool { </del> <ins> func VisitPodConfigmapNames(pod *api.Pod, visitor Visitor, containerType ContainerType) bool { VisitContainers(&pod.Spec, containerType, func(c *api.Container, containerType ContainerType) bool { </ins> return visitContainerConfigmapNames(c, visitor) }) var source *api.VolumeSource

VisitPodSecretNames(pod, func(name string) bool { extractedNames.Insert(name) return true <del> }) </del> <ins> }, AllContainers) </ins> // excludedSecretPaths holds struct paths to fields with "secret" in the name that are not actually references to secret API objects excludedSecretPaths := sets.NewString(

VisitPodConfigmapNames(pod, func(name string) bool { extractedNames.Insert(name) return true <del> }) </del> <ins> }, AllContainers) </ins> // expectedPaths holds struct paths to fields with "ConfigMap" in the name that are references to ConfigMap API objects. // every path here should be represented as an example in the Pod stub above, with the ConfigMap name set to the path.

return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference a service account", nodeName)) } hasSecrets := false <del> podutil.VisitPodSecretNames(pod, func(name string) (shouldContinue bool) { hasSecrets = true; return false }) </del> <ins> podutil.VisitPodSecretNames(pod, func(name string) (shouldContinue bool) { hasSecrets = true; return false }, podutil.AllContainers) </ins> if hasSecrets { return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference secrets", nodeName)) } hasConfigMaps := false <del> podutil.VisitPodConfigmapNames(pod, func(name string) (shouldContinue bool) { hasConfigMaps = true; return false }) </del> <ins> podutil.VisitPodConfigmapNames(pod, func(name string) (shouldContinue bool) { hasConfigMaps = true; return false }, podutil.AllContainers) </ins> if hasConfigMaps { return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference configmaps", nodeName)) }

podutil.VisitPodSecretNames(pod, func(name string) bool { hasSecrets = true return false <del> }) </del> <ins> }, podutil.AllContainers) </ins> if hasSecrets { return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference secrets")) }