mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 03:41:45 +00:00
add unit test for RunAsGroup in both pod and podsecuritypolicy
This commit is contained in:
parent
d4c85e977f
commit
020e54cce7
@ -911,3 +911,140 @@ func TestDropEmptyDirSizeLimit(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestDropRunAsGroup(t *testing.T) {
|
||||||
|
group := func() *int64 {
|
||||||
|
testGroup := int64(1000)
|
||||||
|
return &testGroup
|
||||||
|
}
|
||||||
|
defaultProcMount := api.DefaultProcMount
|
||||||
|
defaultSecurityContext := func() *api.SecurityContext {
|
||||||
|
return &api.SecurityContext{ProcMount: &defaultProcMount}
|
||||||
|
}
|
||||||
|
securityContextWithRunAsGroup := func() *api.SecurityContext {
|
||||||
|
return &api.SecurityContext{ProcMount: &defaultProcMount, RunAsGroup: group()}
|
||||||
|
}
|
||||||
|
podWithoutRunAsGroup := func() *api.Pod {
|
||||||
|
return &api.Pod{
|
||||||
|
Spec: api.PodSpec{
|
||||||
|
RestartPolicy: api.RestartPolicyNever,
|
||||||
|
SecurityContext: &api.PodSecurityContext{},
|
||||||
|
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
podWithRunAsGroupInPod := func() *api.Pod {
|
||||||
|
return &api.Pod{
|
||||||
|
Spec: api.PodSpec{
|
||||||
|
RestartPolicy: api.RestartPolicyNever,
|
||||||
|
SecurityContext: &api.PodSecurityContext{RunAsGroup: group()},
|
||||||
|
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
podWithRunAsGroupInContainers := func() *api.Pod {
|
||||||
|
return &api.Pod{
|
||||||
|
Spec: api.PodSpec{
|
||||||
|
RestartPolicy: api.RestartPolicyNever,
|
||||||
|
SecurityContext: &api.PodSecurityContext{},
|
||||||
|
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: securityContextWithRunAsGroup()}},
|
||||||
|
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
podWithRunAsGroupInInitContainers := func() *api.Pod {
|
||||||
|
return &api.Pod{
|
||||||
|
Spec: api.PodSpec{
|
||||||
|
RestartPolicy: api.RestartPolicyNever,
|
||||||
|
SecurityContext: &api.PodSecurityContext{},
|
||||||
|
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
|
||||||
|
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: securityContextWithRunAsGroup()}},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
podInfo := []struct {
|
||||||
|
description string
|
||||||
|
hasRunAsGroup bool
|
||||||
|
pod func() *api.Pod
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
description: "have RunAsGroup in Pod",
|
||||||
|
hasRunAsGroup: true,
|
||||||
|
pod: podWithRunAsGroupInPod,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "have RunAsGroup in Container",
|
||||||
|
hasRunAsGroup: true,
|
||||||
|
pod: podWithRunAsGroupInContainers,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "have RunAsGroup in InitContainer",
|
||||||
|
hasRunAsGroup: true,
|
||||||
|
pod: podWithRunAsGroupInInitContainers,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "does not have RunAsGroup",
|
||||||
|
hasRunAsGroup: false,
|
||||||
|
pod: podWithoutRunAsGroup,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "is nil",
|
||||||
|
hasRunAsGroup: false,
|
||||||
|
pod: func() *api.Pod { return nil },
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, enabled := range []bool{true, false} {
|
||||||
|
for _, oldPodInfo := range podInfo {
|
||||||
|
for _, newPodInfo := range podInfo {
|
||||||
|
oldPodHasRunAsGroup, oldPod := oldPodInfo.hasRunAsGroup, oldPodInfo.pod()
|
||||||
|
newPodHasRunAsGroup, newPod := newPodInfo.hasRunAsGroup, newPodInfo.pod()
|
||||||
|
if newPod == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Run(fmt.Sprintf("feature enabled=%v, old pod %v, new pod %v", enabled, oldPodInfo.description, newPodInfo.description), func(t *testing.T) {
|
||||||
|
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RunAsGroup, enabled)()
|
||||||
|
|
||||||
|
var oldPodSpec *api.PodSpec
|
||||||
|
if oldPod != nil {
|
||||||
|
oldPodSpec = &oldPod.Spec
|
||||||
|
}
|
||||||
|
DropDisabledFields(&newPod.Spec, oldPodSpec)
|
||||||
|
|
||||||
|
// old pod should never be changed
|
||||||
|
if !reflect.DeepEqual(oldPod, oldPodInfo.pod()) {
|
||||||
|
t.Errorf("old pod changed: %v", diff.ObjectReflectDiff(oldPod, oldPodInfo.pod()))
|
||||||
|
}
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case enabled || oldPodHasRunAsGroup:
|
||||||
|
// new pod should not be changed if the feature is enabled, or if the old pod had RunAsGroup
|
||||||
|
if !reflect.DeepEqual(newPod, newPodInfo.pod()) {
|
||||||
|
t.Errorf("new pod changed: %v", diff.ObjectReflectDiff(newPod, newPodInfo.pod()))
|
||||||
|
}
|
||||||
|
case newPodHasRunAsGroup:
|
||||||
|
// new pod should be changed
|
||||||
|
if reflect.DeepEqual(newPod, newPodInfo.pod()) {
|
||||||
|
t.Errorf("%v", oldPod)
|
||||||
|
t.Errorf("%v", newPod)
|
||||||
|
t.Errorf("new pod was not changed")
|
||||||
|
}
|
||||||
|
// new pod should not have RunAsGroup
|
||||||
|
if !reflect.DeepEqual(newPod, podWithoutRunAsGroup()) {
|
||||||
|
t.Errorf("new pod had RunAsGroup: %v", diff.ObjectReflectDiff(newPod, podWithoutRunAsGroup()))
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
// new pod should not need to be changed
|
||||||
|
if !reflect.DeepEqual(newPod, newPodInfo.pod()) {
|
||||||
|
t.Errorf("new pod changed: %v", diff.ObjectReflectDiff(newPod, newPodInfo.pod()))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@ -107,3 +107,83 @@ func TestDropAllowedProcMountTypes(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestDropRunAsGroup(t *testing.T) {
|
||||||
|
group := func() *policy.RunAsGroupStrategyOptions {
|
||||||
|
return &policy.RunAsGroupStrategyOptions{}
|
||||||
|
}
|
||||||
|
scWithoutRunAsGroup := func() *policy.PodSecurityPolicySpec {
|
||||||
|
return &policy.PodSecurityPolicySpec{}
|
||||||
|
}
|
||||||
|
scWithRunAsGroup := func() *policy.PodSecurityPolicySpec {
|
||||||
|
return &policy.PodSecurityPolicySpec{
|
||||||
|
RunAsGroup: group(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
scInfo := []struct {
|
||||||
|
description string
|
||||||
|
hasRunAsGroup bool
|
||||||
|
sc func() *policy.PodSecurityPolicySpec
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
description: "PodSecurityPolicySpec Without RunAsGroup",
|
||||||
|
hasRunAsGroup: false,
|
||||||
|
sc: scWithoutRunAsGroup,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "PodSecurityPolicySpec With RunAsGroup",
|
||||||
|
hasRunAsGroup: true,
|
||||||
|
sc: scWithRunAsGroup,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
description: "is nil",
|
||||||
|
hasRunAsGroup: false,
|
||||||
|
sc: func() *policy.PodSecurityPolicySpec { return nil },
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, enabled := range []bool{true, false} {
|
||||||
|
for _, oldPSPSpecInfo := range scInfo {
|
||||||
|
for _, newPSPSpecInfo := range scInfo {
|
||||||
|
oldPSPSpecHasRunAsGroup, oldPSPSpec := oldPSPSpecInfo.hasRunAsGroup, oldPSPSpecInfo.sc()
|
||||||
|
newPSPSpecHasRunAsGroup, newPSPSpec := newPSPSpecInfo.hasRunAsGroup, newPSPSpecInfo.sc()
|
||||||
|
if newPSPSpec == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Run(fmt.Sprintf("feature enabled=%v, old PodSecurityPolicySpec %v, new PodSecurityPolicySpec %v", enabled, oldPSPSpecInfo.description, newPSPSpecInfo.description), func(t *testing.T) {
|
||||||
|
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RunAsGroup, enabled)()
|
||||||
|
|
||||||
|
DropDisabledFields(newPSPSpec, oldPSPSpec)
|
||||||
|
|
||||||
|
// old PodSecurityPolicySpec should never be changed
|
||||||
|
if !reflect.DeepEqual(oldPSPSpec, oldPSPSpecInfo.sc()) {
|
||||||
|
t.Errorf("old PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(oldPSPSpec, oldPSPSpecInfo.sc()))
|
||||||
|
}
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case enabled || oldPSPSpecHasRunAsGroup:
|
||||||
|
// new PodSecurityPolicySpec should not be changed if the feature is enabled, or if the old PodSecurityPolicySpec had RunAsGroup
|
||||||
|
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
|
||||||
|
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
|
||||||
|
}
|
||||||
|
case newPSPSpecHasRunAsGroup:
|
||||||
|
// new PodSecurityPolicySpec should be changed
|
||||||
|
if reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
|
||||||
|
t.Errorf("new PodSecurityPolicySpec was not changed")
|
||||||
|
}
|
||||||
|
// new PodSecurityPolicySpec should not have RunAsGroup
|
||||||
|
if !reflect.DeepEqual(newPSPSpec, scWithoutRunAsGroup()) {
|
||||||
|
t.Errorf("new PodSecurityPolicySpec had RunAsGroup: %v", diff.ObjectReflectDiff(newPSPSpec, scWithoutRunAsGroup()))
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
// new PodSecurityPolicySpec should not need to be changed
|
||||||
|
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
|
||||||
|
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user