From b38ca059d9162b4cc74193818e5b99d4cb1a9496 Mon Sep 17 00:00:00 2001 From: Manuel Huber Date: Tue, 2 Jun 2026 22:16:54 +0000 Subject: [PATCH] tests: pin identity in policy workloads Add explicit securityContext values to static Kubernetes policy workloads whose generated policy now includes image-derived identity data. Refresh existing guest-pull comments to point at the Limitations documentation instead of the old issue link. Signed-off-by: Manuel Huber Assisted-by: OpenAI Codex --- tests/integration/kubernetes/k8s-measured-rootfs.bats | 3 ++- .../kubernetes/runtimeclass_workloads/busybox-pod.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/busybox-template.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/cron-job.yaml | 2 ++ .../runtimeclass_workloads/initContainer-shared-volume.yaml | 2 ++ .../initcontainer-shareprocesspid.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/job-template.yaml | 2 ++ .../integration/kubernetes/runtimeclass_workloads/job.yaml | 2 ++ .../k8s-pod-sc-nobodyupdate-deployment.yaml | 1 + .../runtimeclass_workloads/k8s-policy-deployment.yaml | 1 + .../kubernetes/runtimeclass_workloads/k8s-policy-job.yaml | 2 ++ .../runtimeclass_workloads/k8s-policy-pod-pvc.yaml | 2 ++ .../runtimeclass_workloads/numa-topology-gpu-test.yaml.in | 2 ++ .../runtimeclass_workloads/numa-topology-test.yaml.in | 2 ++ .../nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in | 5 ++--- .../nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in | 5 ++--- .../runtimeclass_workloads/openvpn/openvpn-client-pod.yaml | 5 ++--- .../runtimeclass_workloads/openvpn/openvpn-server-pod.yaml | 5 ++--- .../kubernetes/runtimeclass_workloads/pod-besteffort.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-burstable.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-caps.yaml | 2 ++ .../runtimeclass_workloads/pod-configmap-volume.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-configmap.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-empty-dir.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-env.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-file-volume.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-guaranteed.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-hostname.yaml | 2 ++ .../runtimeclass_workloads/pod-hostpath-kmsg.yaml | 2 ++ .../runtimeclass_workloads/pod-http-liveness.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-liveness.yaml | 2 ++ .../runtimeclass_workloads/pod-nested-configmap-secret.yaml | 2 ++ .../pod-optional-empty-configmap.yaml | 2 ++ .../runtimeclass_workloads/pod-optional-empty-secret.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-privileged.yaml | 2 ++ .../runtimeclass_workloads/pod-quota-deployment.yaml | 2 ++ .../runtimeclass_workloads/pod-sandbox-cgroup.yaml | 2 ++ .../pod-sandbox-vcpus-allocation.yaml | 6 ++++++ .../kubernetes/runtimeclass_workloads/pod-secret-env.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-secret.yaml | 2 ++ .../runtimeclass_workloads/pod-shared-volume.yaml | 2 ++ .../kubernetes/runtimeclass_workloads/pod-sysctl.yaml | 1 + .../kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml | 2 ++ .../runtimeclass_workloads/pod-termination-log-fail.yaml | 2 ++ .../runtimeclass_workloads/pod-termination-log-success.yaml | 2 ++ .../pod-trusted-ephemeral-data-storage.yaml | 5 ++--- .../kubernetes/runtimeclass_workloads/pv-pod.yaml | 2 ++ 48 files changed, 97 insertions(+), 16 deletions(-) diff --git a/tests/integration/kubernetes/k8s-measured-rootfs.bats b/tests/integration/kubernetes/k8s-measured-rootfs.bats index 40436b8d6b..1ebc1aa79c 100644 --- a/tests/integration/kubernetes/k8s-measured-rootfs.bats +++ b/tests/integration/kubernetes/k8s-measured-rootfs.bats @@ -41,7 +41,8 @@ setup() { nginx_digest=$(get_from_kata_deps ".docker_images.nginx.digest") nginx_image="${nginx_registry}@${nginx_digest}" - pod_config="$(new_pod_config "${nginx_image}" "kata-${KATA_HYPERVISOR}")" + pod_config="$(new_pod_config "${nginx_image}" "kata-${KATA_HYPERVISOR}" \ + "" "" "1, 2, 3, 4, 6, 10, 11, 20, 26, 27")" auto_generate_policy "${pod_config_dir}" "${pod_config}" incorrect_hash="1111111111111111111111111111111111111111111111111111111111111111" diff --git a/tests/integration/kubernetes/runtimeclass_workloads/busybox-pod.yaml b/tests/integration/kubernetes/runtimeclass_workloads/busybox-pod.yaml index f2349f9967..8e9e6cf3e0 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/busybox-pod.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/busybox-pod.yaml @@ -10,6 +10,8 @@ metadata: spec: shareProcessNamespace: true runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: first-test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/busybox-template.yaml b/tests/integration/kubernetes/runtimeclass_workloads/busybox-template.yaml index 14aa9650b1..ec5de5d966 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/busybox-template.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/busybox-template.yaml @@ -10,6 +10,8 @@ metadata: spec: runtimeClassName: kata shareProcessNamespace: true + securityContext: + supplementalGroups: [10] containers: - name: CTR_NAME image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/cron-job.yaml b/tests/integration/kubernetes/runtimeclass_workloads/cron-job.yaml index 6e6c056626..69c0a72ad8 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/cron-job.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/cron-job.yaml @@ -9,6 +9,8 @@ spec: template: spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: pi image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/initContainer-shared-volume.yaml b/tests/integration/kubernetes/runtimeclass_workloads/initContainer-shared-volume.yaml index ab51c65459..bb8518e76f 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/initContainer-shared-volume.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/initContainer-shared-volume.yaml @@ -9,6 +9,8 @@ metadata: name: initcontainer-shared-volume spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] initContainers: - name: first image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/initcontainer-shareprocesspid.yaml b/tests/integration/kubernetes/runtimeclass_workloads/initcontainer-shareprocesspid.yaml index 782497cdca..7380d5a00d 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/initcontainer-shareprocesspid.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/initcontainer-shareprocesspid.yaml @@ -10,6 +10,8 @@ metadata: spec: shareProcessNamespace: true runtimeClassName: kata + securityContext: + supplementalGroups: [10] initContainers: - name: first image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/job-template.yaml b/tests/integration/kubernetes/runtimeclass_workloads/job-template.yaml index ad42dee422..2cfc104b18 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/job-template.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/job-template.yaml @@ -17,6 +17,8 @@ spec: jobgroup: jobtest spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/job.yaml b/tests/integration/kubernetes/runtimeclass_workloads/job.yaml index 7b86835419..da14b38e12 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/job.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/job.yaml @@ -11,6 +11,8 @@ spec: template: spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: pi image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/k8s-pod-sc-nobodyupdate-deployment.yaml b/tests/integration/kubernetes/runtimeclass_workloads/k8s-pod-sc-nobodyupdate-deployment.yaml index 12f99015e8..84393c922e 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/k8s-pod-sc-nobodyupdate-deployment.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/k8s-pod-sc-nobodyupdate-deployment.yaml @@ -26,6 +26,7 @@ spec: runtimeClassName: kata securityContext: runAsUser: 65534 + runAsGroup: 65534 containers: - name: master image: quay.io/kata-containers/test-images/opstree/redis:sha256-2642c7b07713df6897fa88cbe6db85170690cf3650018ceb2ab16cfa0b4f8d48 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-deployment.yaml b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-deployment.yaml index 739bf74eec..82235a6e20 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-deployment.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-deployment.yaml @@ -26,6 +26,7 @@ spec: runtimeClassName: kata securityContext: runAsUser: 1000 + runAsGroup: 1000 containers: - name: master image: quay.io/kata-containers/test-images/opstree/redis:sha256-2642c7b07713df6897fa88cbe6db85170690cf3650018ceb2ab16cfa0b4f8d48 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-job.yaml b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-job.yaml index 45bb497567..1f95a91feb 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-job.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-job.yaml @@ -11,6 +11,8 @@ spec: template: spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: hello image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod-pvc.yaml b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod-pvc.yaml index 5c4a60deb5..f2a138dbbe 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod-pvc.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod-pvc.yaml @@ -9,6 +9,8 @@ metadata: name: policy-pod-pvc spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: busybox image: "quay.io/prometheus/busybox:latest" diff --git a/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-gpu-test.yaml.in b/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-gpu-test.yaml.in index cc0dcdcfed..21236b019d 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-gpu-test.yaml.in +++ b/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-gpu-test.yaml.in @@ -11,6 +11,8 @@ metadata: app: ${POD_NAME_NUMA} spec: runtimeClassName: kata + securityContext: + supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27] containers: - name: numa-check image: "quay.io/kata-containers/numa:2026-05-15@sha256:a863fcf95fcbbf63352b0555a61a62537f74399dc4bca826a2e42d001e26accb" diff --git a/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-test.yaml.in b/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-test.yaml.in index 0251c536b6..a7d3851630 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-test.yaml.in +++ b/tests/integration/kubernetes/runtimeclass_workloads/numa-topology-test.yaml.in @@ -11,6 +11,8 @@ metadata: app: ${POD_NAME_NUMA} spec: runtimeClassName: kata + securityContext: + supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27] containers: - name: numa-check image: "quay.io/kata-containers/numa:2026-05-15@sha256:a863fcf95fcbbf63352b0555a61a62537f74399dc4bca826a2e42d001e26accb" diff --git a/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in b/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in index d32e51fe6b..527ba75c54 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in +++ b/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in @@ -16,9 +16,8 @@ metadata: # cc_init_data annotation will be added by genpolicy with CDH configuration # from the custom default-initdata.toml created by create_nim_initdata_file() spec: - # Explicit user/group/supplementary groups to support nydus guest-pull. - # See issue https://github.com/kata-containers/kata-containers/issues/11162 and - # other references to this issue in the genpolicy source folder. + # Explicit user/group IDs keep guest-pull requests aligned with policy. + # See docs/Limitations.md#guest-pulled-container-images. securityContext: runAsUser: 1000 runAsGroup: 1000 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in b/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in index 9f770b1ca8..9ef900a401 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in +++ b/tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in @@ -16,9 +16,8 @@ metadata: # cc_init_data annotation will be added by genpolicy with CDH configuration # from the custom default-initdata.toml created by create_nim_initdata_file() spec: - # Explicit user/group/supplementary groups to support nydus guest-pull. - # See issue https://github.com/kata-containers/kata-containers/issues/11162 and - # other references to this issue in the genpolicy source folder. + # Explicit user/group IDs keep guest-pull requests aligned with policy. + # See docs/Limitations.md#guest-pulled-container-images. securityContext: runAsUser: 1000 runAsGroup: 1000 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-client-pod.yaml b/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-client-pod.yaml index ad497d461b..5e630c18e2 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-client-pod.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-client-pod.yaml @@ -11,9 +11,8 @@ metadata: labels: app: openvpn-client spec: - # Explicit user/group/supplementary groups to support nydus guest-pull. - # See issue https://github.com/kata-containers/kata-containers/issues/11162 and - # other references to this issue in the genpolicy source folder. + # Explicit security context values keep guest-pull requests aligned with policy. + # See docs/Limitations.md#guest-pulled-container-images. securityContext: runAsUser: 0 runAsGroup: 0 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-server-pod.yaml b/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-server-pod.yaml index 6c16353b08..a18b0561d4 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-server-pod.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-server-pod.yaml @@ -11,9 +11,8 @@ metadata: labels: app: openvpn-server spec: - # Explicit user/group/supplementary groups to support nydus guest-pull. - # See issue https://github.com/kata-containers/kata-containers/issues/11162 and - # other references to this issue in the genpolicy source folder. + # Explicit security context values keep guest-pull requests aligned with policy. + # See docs/Limitations.md#guest-pulled-container-images. securityContext: runAsUser: 0 runAsGroup: 0 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-besteffort.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-besteffort.yaml index 10995a6a32..259789a655 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-besteffort.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-besteffort.yaml @@ -9,6 +9,8 @@ metadata: name: besteffort-test spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: qos-besteffort image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-burstable.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-burstable.yaml index 231fb338c9..85e2a775bf 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-burstable.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-burstable.yaml @@ -9,6 +9,8 @@ metadata: name: burstable-test spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: qos-burstable image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-caps.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-caps.yaml index cdf30e3484..453cafacc1 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-caps.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-caps.yaml @@ -9,6 +9,8 @@ metadata: name: pod-caps spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap-volume.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap-volume.yaml index a0b14bbee2..01202080e0 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap-volume.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap-volume.yaml @@ -10,6 +10,8 @@ metadata: spec: terminationGracePeriodSeconds: 0 runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap.yaml index 2c61e06655..a320360b15 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-configmap.yaml @@ -9,6 +9,8 @@ metadata: name: config-env-test-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml index ee227af14c..f8d8fe6ea3 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml @@ -9,6 +9,8 @@ metadata: name: default-cpu-test spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: default-cpu-demo-ctr image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-empty-dir.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-empty-dir.yaml index 89ba2223bf..8e903ccd06 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-empty-dir.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-empty-dir.yaml @@ -9,6 +9,8 @@ metadata: name: sharevol-kata spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-env.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-env.yaml index cd1d8e8f86..40d718bb9b 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-env.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-env.yaml @@ -9,6 +9,8 @@ metadata: name: test-env spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-file-volume.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-file-volume.yaml index cb976d1ff6..8cf78dbcf6 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-file-volume.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-file-volume.yaml @@ -9,6 +9,8 @@ metadata: name: test-file-volume spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never nodeName: NODE volumes: diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-guaranteed.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-guaranteed.yaml index 374521fb22..5dbb607253 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-guaranteed.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-guaranteed.yaml @@ -9,6 +9,8 @@ metadata: name: qos-test spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: qos-guaranteed image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-hostname.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-hostname.yaml index 312a357299..92141a86ab 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-hostname.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-hostname.yaml @@ -10,6 +10,8 @@ metadata: name: test-pod-hostname spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never containers: - image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-hostpath-kmsg.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-hostpath-kmsg.yaml index 27d3270e40..68d1e7578a 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-hostpath-kmsg.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-hostpath-kmsg.yaml @@ -10,6 +10,8 @@ metadata: name: hostpath-kmsg spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never volumes: - name: dev-kmsg diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-http-liveness.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-http-liveness.yaml index 83817d2cb4..2074d03e7d 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-http-liveness.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-http-liveness.yaml @@ -11,6 +11,8 @@ metadata: name: liveness-http spec: runtimeClassName: kata + securityContext: + supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27] containers: - name: liveness image: ${agnhost_image} diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-liveness.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-liveness.yaml index 086f08ebf3..c6836fb7df 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-liveness.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-liveness.yaml @@ -11,6 +11,8 @@ metadata: name: liveness-exec spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: liveness image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-nested-configmap-secret.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-nested-configmap-secret.yaml index 2a228b3144..061cb5199c 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-nested-configmap-secret.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-nested-configmap-secret.yaml @@ -24,6 +24,8 @@ metadata: name: nested-configmap-secret-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-configmap.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-configmap.yaml index 7f525beb75..642d43b5a4 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-configmap.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-configmap.yaml @@ -9,6 +9,8 @@ metadata: name: optional-empty-config-test-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-secret.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-secret.yaml index d3d024011c..b4d4f1b020 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-secret.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-secret.yaml @@ -9,6 +9,8 @@ metadata: name: optional-empty-secret-test-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-privileged.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-privileged.yaml index 0cc9ee70e1..c5f324a160 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-privileged.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-privileged.yaml @@ -10,6 +10,8 @@ metadata: name: privileged spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never containers: - image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-quota-deployment.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-quota-deployment.yaml index 44c8dbce0b..14bc380bac 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-quota-deployment.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-quota-deployment.yaml @@ -18,6 +18,8 @@ spec: purpose: quota-demo spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: pod-quota-demo image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-cgroup.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-cgroup.yaml index b0690a723e..4668c8ecc9 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-cgroup.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-cgroup.yaml @@ -12,6 +12,8 @@ metadata: io.katacontainers.config.runtime.sandbox_cgroup_only: "false" spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never containers: - image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-vcpus-allocation.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-vcpus-allocation.yaml index 1ceb19973d..ee07c224a8 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-vcpus-allocation.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-vcpus-allocation.yaml @@ -12,6 +12,8 @@ metadata: io.katacontainers.config.hypervisor.default_vcpus: "0" spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: vcpus-less-than-one-with-no-limits image: quay.io/prometheus/busybox:latest @@ -29,6 +31,8 @@ metadata: io.katacontainers.config.hypervisor.default_vcpus: "0.75" spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: vcpus-less-than-one-with-limits image: quay.io/prometheus/busybox:latest @@ -47,6 +51,8 @@ metadata: io.katacontainers.config.hypervisor.default_vcpus: "0.75" spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: vcpus-more-than-one-with-limits image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml index d5aa9952e7..1bb513ec92 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml @@ -9,6 +9,8 @@ metadata: name: secret-envars-test-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: envars-test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-secret.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-secret.yaml index 318e306c42..5da665b21d 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-secret.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-secret.yaml @@ -9,6 +9,8 @@ metadata: name: secret-test-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: test-container image: quay.io/prometheus/busybox:latest diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-shared-volume.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-shared-volume.yaml index b4e685b7ce..b3890da98d 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-shared-volume.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-shared-volume.yaml @@ -9,6 +9,8 @@ metadata: name: test-shared-volume spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never volumes: - name: shared-data diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-sysctl.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-sysctl.yaml index 5abea15c0e..e0a0d01192 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-sysctl.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-sysctl.yaml @@ -10,6 +10,7 @@ metadata: spec: runtimeClassName: kata securityContext: + supplementalGroups: [10] sysctls: - name: kernel.shm_rmid_forced value: "0" diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml index 49ad07c79e..c87746aef8 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml @@ -11,6 +11,8 @@ metadata: app: tcp-liveness spec: runtimeClassName: kata + securityContext: + supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27] containers: - name: tcp-liveness image: ${agnhost_image} diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-fail.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-fail.yaml index 667161a7a8..6ac81887d7 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-fail.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-fail.yaml @@ -10,6 +10,8 @@ metadata: name: pod-termination-log-fail spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never containers: - name: termination-log-test diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-success.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-success.yaml index 50828cdbaa..2c9a6ba90e 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-success.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-success.yaml @@ -10,6 +10,8 @@ metadata: name: pod-termination-log-success spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] restartPolicy: Never containers: - name: termination-log-test diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-trusted-ephemeral-data-storage.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-trusted-ephemeral-data-storage.yaml index 4c775f25dd..6f50c4f300 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-trusted-ephemeral-data-storage.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-trusted-ephemeral-data-storage.yaml @@ -4,9 +4,8 @@ apiVersion: v1 metadata: name: trusted-ephemeral-data-storage spec: - # Explicit user/group/supplementary groups to support nydus guest-pull. - # See issue https://github.com/kata-containers/kata-containers/issues/11162 and - # other references to this issue in the genpolicy source folder. + # Explicit security context values keep guest-pull requests aligned with policy. + # See docs/Limitations.md#guest-pulled-container-images. securityContext: runAsUser: 0 runAsGroup: 0 diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pv-pod.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pv-pod.yaml index 72a0557afe..018fb2568f 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pv-pod.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pv-pod.yaml @@ -9,6 +9,8 @@ metadata: name: pv-pod spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] nodeName: NODE volumes: - name: pv-storage