mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-12 10:16:48 +00:00
a762b136de
The logic in the k8s-empty-dirs.bats file missed to add a security policy for the pod-empty-dir-fsgroup.yaml manifest. With this change, we add the policy annotation. Signed-off-by: Manuel Huber <manuelh@nvidia.com>
108 lines
3.2 KiB
Bash
108 lines
3.2 KiB
Bash
#!/usr/bin/env bats
|
|
#
|
|
# Copyright (c) 2019 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
load "${BATS_TEST_DIRNAME}/lib.sh"
|
|
load "${BATS_TEST_DIRNAME}/../../common.bash"
|
|
load "${BATS_TEST_DIRNAME}/tests_common.sh"
|
|
|
|
assert_equal() {
|
|
local expected=$1
|
|
local actual=$2
|
|
if [[ "$expected" != "$actual" ]]; then
|
|
echo "expected: $expected, got: $actual"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
setup() {
|
|
pod_name="sharevol-kata"
|
|
pod_logs_file=""
|
|
setup_common || die "setup_common failed"
|
|
|
|
policy_settings_dir="$(create_tmp_policy_settings_dir "${pod_config_dir}")"
|
|
add_requests_to_policy_settings "${policy_settings_dir}" "ReadStreamRequest"
|
|
}
|
|
|
|
@test "Empty dir volumes" {
|
|
local yaml_file
|
|
local mount_command
|
|
local dd_command
|
|
|
|
yaml_file="${pod_config_dir}/pod-empty-dir.yaml"
|
|
|
|
mount_command=(sh -c "mount | grep cache")
|
|
add_exec_to_policy_settings "${policy_settings_dir}" "${mount_command[@]}"
|
|
|
|
dd_command=(sh -c "dd if=/dev/zero of=/tmp/cache/file1 bs=1M count=50; echo $?")
|
|
add_exec_to_policy_settings "${policy_settings_dir}" "${dd_command[@]}"
|
|
|
|
# Add policy to yaml
|
|
auto_generate_policy "${policy_settings_dir}" "${yaml_file}"
|
|
|
|
# Create the pod
|
|
kubectl create -f "${yaml_file}"
|
|
|
|
# Check pod creation
|
|
kubectl wait --for=condition=Ready --timeout=$timeout pod "$pod_name"
|
|
|
|
# Check volume mounts
|
|
kubectl exec $pod_name -- "${mount_command[@]}" | grep "/tmp/cache type tmpfs"
|
|
|
|
# Check it can write up to the volume limit (50M)
|
|
kubectl exec $pod_name -- "${dd_command[@]}" | tail -1 | grep 0
|
|
}
|
|
|
|
@test "Empty dir volume when FSGroup is specified with non-root container" {
|
|
local agnhost_name
|
|
local agnhost_version
|
|
local gid
|
|
local logs
|
|
local pod_yaml
|
|
local pod_yaml_in
|
|
local uid
|
|
|
|
# This is a reproducer of k8s e2e "[sig-storage] EmptyDir volumes when FSGroup is specified [LinuxOnly] [NodeFeature:FSGroup] new files should be created with FSGroup ownership when container is non-root" test
|
|
pod_yaml_in="${pod_config_dir}/pod-empty-dir-fsgroup.yaml.in"
|
|
pod_yaml="${pod_config_dir}/pod-empty-dir-fsgroup.yaml"
|
|
agnhost_name="${container_images_agnhost_name}"
|
|
agnhost_version="${container_images_agnhost_version}"
|
|
export AGNHOST_IMAGE="${agnhost_name}:${agnhost_version}"
|
|
|
|
envsubst '${AGNHOST_IMAGE}' <"${pod_yaml_in}" >"${pod_yaml}"
|
|
|
|
# Add policy to yaml
|
|
auto_generate_policy "${policy_settings_dir}" "${pod_yaml}"
|
|
|
|
# Try to avoid timeout by prefetching the image.
|
|
kubectl create -f "${pod_yaml}"
|
|
cmd="kubectl get pods ${pod_name} | grep Completed"
|
|
waitForProcess "${wait_time}" "${sleep_time}" "${cmd}"
|
|
|
|
pod_logs_file="$(mktemp)"
|
|
for container in mounttest-container mounttest-container-2; do
|
|
bats_unbuffered_info "Getting logs for $container"
|
|
kubectl logs "$pod_name" "$container" > "$pod_logs_file"
|
|
logs=$(cat $pod_logs_file)
|
|
bats_unbuffered_info "Logs: $logs"
|
|
|
|
# Check owner UID of file
|
|
uid=$(cat $pod_logs_file | grep 'owner UID of' | sed 's/.*:\s//')
|
|
assert_equal "1001" "$uid"
|
|
# Check owner GID of file
|
|
gid=$(cat $pod_logs_file | grep 'owner GID of' | sed 's/.*:\s//')
|
|
assert_equal "123" "$gid"
|
|
done
|
|
}
|
|
|
|
teardown() {
|
|
[ ! -f "$pod_logs_file" ] || rm -f "$pod_logs_file"
|
|
[[ -n "${pod_config_dir:-}" ]] && rm -f "${pod_config_dir}/pod-empty-dir-fsgroup.yaml"
|
|
|
|
delete_tmp_policy_settings_dir "${policy_settings_dir}"
|
|
teardown_common "${node}" "${node_start_time:-}"
|
|
}
|