pkg/util/pointer: Update int pointer functions

* Implement `Int64Ptr` function
* Replace per module functions of `int(32|64)?` --> `*int(32|64)?`
* Update bazel rules
This commit is contained in:
Stephen Augustus 2018-02-20 07:07:50 -05:00
parent 90c09c75d6
commit 09aa0b9c1d
7 changed files with 67 additions and 86 deletions

View File

@ -60,6 +60,7 @@ go_test(
"//pkg/capabilities:go_default_library", "//pkg/capabilities:go_default_library",
"//pkg/features:go_default_library", "//pkg/features:go_default_library",
"//pkg/security/apparmor:go_default_library", "//pkg/security/apparmor:go_default_library",
"//pkg/util/pointer:go_default_library",
"//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library", "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",

View File

@ -39,6 +39,7 @@ import (
"k8s.io/kubernetes/pkg/capabilities" "k8s.io/kubernetes/pkg/capabilities"
"k8s.io/kubernetes/pkg/features" "k8s.io/kubernetes/pkg/features"
"k8s.io/kubernetes/pkg/security/apparmor" "k8s.io/kubernetes/pkg/security/apparmor"
utilpointer "k8s.io/kubernetes/pkg/util/pointer"
) )
const ( const (
@ -1694,7 +1695,7 @@ func TestValidateKeyToPath(t *testing.T) {
ok: true, ok: true,
}, },
{ {
kp: core.KeyToPath{Key: "k", Path: "p", Mode: newInt32(0644)}, kp: core.KeyToPath{Key: "k", Path: "p", Mode: utilpointer.Int32Ptr(0644)},
ok: true, ok: true,
}, },
{ {
@ -1728,12 +1729,12 @@ func TestValidateKeyToPath(t *testing.T) {
errtype: field.ErrorTypeInvalid, errtype: field.ErrorTypeInvalid,
}, },
{ {
kp: core.KeyToPath{Key: "k", Path: "p", Mode: newInt32(01000)}, kp: core.KeyToPath{Key: "k", Path: "p", Mode: utilpointer.Int32Ptr(01000)},
ok: false, ok: false,
errtype: field.ErrorTypeInvalid, errtype: field.ErrorTypeInvalid,
}, },
{ {
kp: core.KeyToPath{Key: "k", Path: "p", Mode: newInt32(-1)}, kp: core.KeyToPath{Key: "k", Path: "p", Mode: utilpointer.Int32Ptr(-1)},
ok: false, ok: false,
errtype: field.ErrorTypeInvalid, errtype: field.ErrorTypeInvalid,
}, },
@ -1970,14 +1971,6 @@ func TestValidateCSIVolumeSource(t *testing.T) {
t.Errorf("Failed to disable feature gate for CSIPersistentVolumes: %v", err) t.Errorf("Failed to disable feature gate for CSIPersistentVolumes: %v", err)
return return
} }
}
// helper
func newInt32(val int) *int32 {
p := new(int32)
*p = int32(val)
return p
} }
// This test is a little too top-to-bottom. Ideally we would test each volume // This test is a little too top-to-bottom. Ideally we would test each volume
@ -2464,7 +2457,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
Secret: &core.SecretVolumeSource{ Secret: &core.SecretVolumeSource{
SecretName: "my-secret", SecretName: "my-secret",
DefaultMode: newInt32(0644), DefaultMode: utilpointer.Int32Ptr(0644),
}, },
}, },
}, },
@ -2479,7 +2472,7 @@ func TestValidateVolumes(t *testing.T) {
Items: []core.KeyToPath{{ Items: []core.KeyToPath{{
Key: "key", Key: "key",
Path: "filename", Path: "filename",
Mode: newInt32(0644), Mode: utilpointer.Int32Ptr(0644),
}}, }},
}, },
}, },
@ -2549,7 +2542,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
Secret: &core.SecretVolumeSource{ Secret: &core.SecretVolumeSource{
SecretName: "s", SecretName: "s",
DefaultMode: newInt32(01000), DefaultMode: utilpointer.Int32Ptr(01000),
}, },
}, },
}, },
@ -2563,7 +2556,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
Secret: &core.SecretVolumeSource{ Secret: &core.SecretVolumeSource{
SecretName: "s", SecretName: "s",
DefaultMode: newInt32(-1), DefaultMode: utilpointer.Int32Ptr(-1),
}, },
}, },
}, },
@ -2593,7 +2586,7 @@ func TestValidateVolumes(t *testing.T) {
LocalObjectReference: core.LocalObjectReference{ LocalObjectReference: core.LocalObjectReference{
Name: "my-cfgmap", Name: "my-cfgmap",
}, },
DefaultMode: newInt32(0644), DefaultMode: utilpointer.Int32Ptr(0644),
}, },
}, },
}, },
@ -2609,7 +2602,7 @@ func TestValidateVolumes(t *testing.T) {
Items: []core.KeyToPath{{ Items: []core.KeyToPath{{
Key: "key", Key: "key",
Path: "filename", Path: "filename",
Mode: newInt32(0644), Mode: utilpointer.Int32Ptr(0644),
}}, }},
}, },
}, },
@ -2680,7 +2673,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
ConfigMap: &core.ConfigMapVolumeSource{ ConfigMap: &core.ConfigMapVolumeSource{
LocalObjectReference: core.LocalObjectReference{Name: "c"}, LocalObjectReference: core.LocalObjectReference{Name: "c"},
DefaultMode: newInt32(01000), DefaultMode: utilpointer.Int32Ptr(01000),
}, },
}, },
}, },
@ -2694,7 +2687,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
ConfigMap: &core.ConfigMapVolumeSource{ ConfigMap: &core.ConfigMapVolumeSource{
LocalObjectReference: core.LocalObjectReference{Name: "c"}, LocalObjectReference: core.LocalObjectReference{Name: "c"},
DefaultMode: newInt32(-1), DefaultMode: utilpointer.Int32Ptr(-1),
}, },
}, },
}, },
@ -3023,7 +3016,7 @@ func TestValidateVolumes(t *testing.T) {
Name: "downapi", Name: "downapi",
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
DefaultMode: newInt32(0644), DefaultMode: utilpointer.Int32Ptr(0644),
}, },
}, },
}, },
@ -3035,7 +3028,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
Items: []core.DownwardAPIVolumeFile{{ Items: []core.DownwardAPIVolumeFile{{
Mode: newInt32(0644), Mode: utilpointer.Int32Ptr(0644),
Path: "path", Path: "path",
FieldRef: &core.ObjectFieldSelector{ FieldRef: &core.ObjectFieldSelector{
APIVersion: "v1", APIVersion: "v1",
@ -3053,7 +3046,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
Items: []core.DownwardAPIVolumeFile{{ Items: []core.DownwardAPIVolumeFile{{
Mode: newInt32(01000), Mode: utilpointer.Int32Ptr(01000),
Path: "path", Path: "path",
FieldRef: &core.ObjectFieldSelector{ FieldRef: &core.ObjectFieldSelector{
APIVersion: "v1", APIVersion: "v1",
@ -3073,7 +3066,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
Items: []core.DownwardAPIVolumeFile{{ Items: []core.DownwardAPIVolumeFile{{
Mode: newInt32(-1), Mode: utilpointer.Int32Ptr(-1),
Path: "path", Path: "path",
FieldRef: &core.ObjectFieldSelector{ FieldRef: &core.ObjectFieldSelector{
APIVersion: "v1", APIVersion: "v1",
@ -3214,7 +3207,7 @@ func TestValidateVolumes(t *testing.T) {
Name: "downapi", Name: "downapi",
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
DefaultMode: newInt32(01000), DefaultMode: utilpointer.Int32Ptr(01000),
}, },
}, },
}, },
@ -3227,7 +3220,7 @@ func TestValidateVolumes(t *testing.T) {
Name: "downapi", Name: "downapi",
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
DownwardAPI: &core.DownwardAPIVolumeSource{ DownwardAPI: &core.DownwardAPIVolumeSource{
DefaultMode: newInt32(-1), DefaultMode: utilpointer.Int32Ptr(-1),
}, },
}, },
}, },
@ -3242,7 +3235,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
FC: &core.FCVolumeSource{ FC: &core.FCVolumeSource{
TargetWWNs: []string{"some_wwn"}, TargetWWNs: []string{"some_wwn"},
Lun: newInt32(1), Lun: utilpointer.Int32Ptr(1),
FSType: "ext4", FSType: "ext4",
ReadOnly: false, ReadOnly: false,
}, },
@ -3269,7 +3262,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
FC: &core.FCVolumeSource{ FC: &core.FCVolumeSource{
TargetWWNs: []string{}, TargetWWNs: []string{},
Lun: newInt32(1), Lun: utilpointer.Int32Ptr(1),
WWIDs: []string{}, WWIDs: []string{},
FSType: "ext4", FSType: "ext4",
ReadOnly: false, ReadOnly: false,
@ -3287,7 +3280,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
FC: &core.FCVolumeSource{ FC: &core.FCVolumeSource{
TargetWWNs: []string{"some_wwn"}, TargetWWNs: []string{"some_wwn"},
Lun: newInt32(1), Lun: utilpointer.Int32Ptr(1),
WWIDs: []string{"some_wwid"}, WWIDs: []string{"some_wwid"},
FSType: "ext4", FSType: "ext4",
ReadOnly: false, ReadOnly: false,
@ -3322,7 +3315,7 @@ func TestValidateVolumes(t *testing.T) {
VolumeSource: core.VolumeSource{ VolumeSource: core.VolumeSource{
FC: &core.FCVolumeSource{ FC: &core.FCVolumeSource{
TargetWWNs: []string{"wwn"}, TargetWWNs: []string{"wwn"},
Lun: newInt32(256), Lun: utilpointer.Int32Ptr(256),
FSType: "ext4", FSType: "ext4",
ReadOnly: false, ReadOnly: false,
}, },
@ -8826,7 +8819,7 @@ func TestValidateService(t *testing.T) {
s.Spec.SessionAffinity = core.ServiceAffinityClientIP s.Spec.SessionAffinity = core.ServiceAffinityClientIP
s.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{ s.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(-1), TimeoutSeconds: utilpointer.Int32Ptr(-1),
}, },
} }
}, },
@ -8839,7 +8832,7 @@ func TestValidateService(t *testing.T) {
s.Spec.SessionAffinity = core.ServiceAffinityNone s.Spec.SessionAffinity = core.ServiceAffinityNone
s.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{ s.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(90), TimeoutSeconds: utilpointer.Int32Ptr(90),
}, },
} }
}, },
@ -10334,7 +10327,7 @@ func TestValidateServiceUpdate(t *testing.T) {
newSvc.Spec.SessionAffinity = "ClientIP" newSvc.Spec.SessionAffinity = "ClientIP"
newSvc.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{ newSvc.Spec.SessionAffinityConfig = &core.SessionAffinityConfig{
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(90), TimeoutSeconds: utilpointer.Int32Ptr(90),
}, },
} }
}, },
@ -12628,17 +12621,17 @@ func TestValidateOrSetClientIPAffinityConfig(t *testing.T) {
successCases := map[string]*core.SessionAffinityConfig{ successCases := map[string]*core.SessionAffinityConfig{
"non-empty config, valid timeout: 1": { "non-empty config, valid timeout: 1": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(1), TimeoutSeconds: utilpointer.Int32Ptr(1),
}, },
}, },
"non-empty config, valid timeout: core.MaxClientIPServiceAffinitySeconds-1": { "non-empty config, valid timeout: core.MaxClientIPServiceAffinitySeconds-1": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(int(core.MaxClientIPServiceAffinitySeconds - 1)), TimeoutSeconds: utilpointer.Int32Ptr(core.MaxClientIPServiceAffinitySeconds - 1),
}, },
}, },
"non-empty config, valid timeout: core.MaxClientIPServiceAffinitySeconds": { "non-empty config, valid timeout: core.MaxClientIPServiceAffinitySeconds": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(int(core.MaxClientIPServiceAffinitySeconds)), TimeoutSeconds: utilpointer.Int32Ptr(core.MaxClientIPServiceAffinitySeconds),
}, },
}, },
} }
@ -12661,17 +12654,17 @@ func TestValidateOrSetClientIPAffinityConfig(t *testing.T) {
}, },
"non-empty config, invalid timeout: core.MaxClientIPServiceAffinitySeconds+1": { "non-empty config, invalid timeout: core.MaxClientIPServiceAffinitySeconds+1": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(int(core.MaxClientIPServiceAffinitySeconds + 1)), TimeoutSeconds: utilpointer.Int32Ptr(core.MaxClientIPServiceAffinitySeconds + 1),
}, },
}, },
"non-empty config, invalid timeout: -1": { "non-empty config, invalid timeout: -1": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(-1), TimeoutSeconds: utilpointer.Int32Ptr(-1),
}, },
}, },
"non-empty config, invalid timeout: 0": { "non-empty config, invalid timeout: 0": {
ClientIP: &core.ClientIPConfig{ ClientIP: &core.ClientIPConfig{
TimeoutSeconds: newInt32(0), TimeoutSeconds: utilpointer.Int32Ptr(0),
}, },
}, },
} }

View File

@ -22,6 +22,7 @@ import (
autoscalingv1 "k8s.io/api/autoscaling/v1" autoscalingv1 "k8s.io/api/autoscaling/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
utilpointer "k8s.io/kubernetes/pkg/util/pointer"
) )
func TestHPAGenerate(t *testing.T) { func TestHPAGenerate(t *testing.T) {
@ -51,14 +52,14 @@ func TestHPAGenerate(t *testing.T) {
Name: "foo", Name: "foo",
}, },
Spec: autoscalingv1.HorizontalPodAutoscalerSpec{ Spec: autoscalingv1.HorizontalPodAutoscalerSpec{
TargetCPUUtilizationPercentage: newInt32(80), TargetCPUUtilizationPercentage: utilpointer.Int32Ptr(80),
ScaleTargetRef: autoscalingv1.CrossVersionObjectReference{ ScaleTargetRef: autoscalingv1.CrossVersionObjectReference{
Kind: "kind", Kind: "kind",
Name: "name", Name: "name",
APIVersion: "apiVersion", APIVersion: "apiVersion",
}, },
MaxReplicas: int32(10), MaxReplicas: int32(10),
MinReplicas: newInt32(1), MinReplicas: utilpointer.Int32Ptr(1),
}, },
}, },
expectErr: false, expectErr: false,
@ -125,8 +126,3 @@ func TestHPAGenerate(t *testing.T) {
} }
} }
} }
func newInt32(value int) *int32 {
v := int32(value)
return &v
}

View File

@ -48,8 +48,12 @@ func AllPtrFieldsNil(obj interface{}) bool {
// Int32Ptr returns a pointer to an int32 // Int32Ptr returns a pointer to an int32
func Int32Ptr(i int32) *int32 { func Int32Ptr(i int32) *int32 {
o := i return &i
return &o }
// Int64Ptr returns a pointer to an int64
func Int64Ptr(i int64) *int64 {
return &i
} }
// Int32PtrDerefOr dereference the int32 ptr and returns it i not nil, // Int32PtrDerefOr dereference the int32 ptr and returns it i not nil,
@ -63,6 +67,5 @@ func Int32PtrDerefOr(ptr *int32, def int32) int32 {
// BoolPtr returns a pointer to a bool // BoolPtr returns a pointer to a bool
func BoolPtr(b bool) *bool { func BoolPtr(b bool) *bool {
o := b return &b
return &o
} }

View File

@ -48,6 +48,7 @@ go_test(
"//pkg/security/podsecuritypolicy:go_default_library", "//pkg/security/podsecuritypolicy:go_default_library",
"//pkg/security/podsecuritypolicy/seccomp:go_default_library", "//pkg/security/podsecuritypolicy/seccomp:go_default_library",
"//pkg/security/podsecuritypolicy/util:go_default_library", "//pkg/security/podsecuritypolicy/util:go_default_library",
"//pkg/util/pointer:go_default_library",
"//vendor/github.com/stretchr/testify/assert:go_default_library", "//vendor/github.com/stretchr/testify/assert:go_default_library",
"//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library", "//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library",

View File

@ -44,6 +44,7 @@ import (
kpsp "k8s.io/kubernetes/pkg/security/podsecuritypolicy" kpsp "k8s.io/kubernetes/pkg/security/podsecuritypolicy"
"k8s.io/kubernetes/pkg/security/podsecuritypolicy/seccomp" "k8s.io/kubernetes/pkg/security/podsecuritypolicy/seccomp"
psputil "k8s.io/kubernetes/pkg/security/podsecuritypolicy/util" psputil "k8s.io/kubernetes/pkg/security/podsecuritypolicy/util"
utilpointer "k8s.io/kubernetes/pkg/util/pointer"
) )
const defaultContainerName = "test-c" const defaultContainerName = "test-c"
@ -1223,39 +1224,39 @@ func TestAdmitRunAsUser(t *testing.T) {
expectedPSP: runAsAny.Name, expectedPSP: runAsAny.Name,
}, },
"runAsAny pod request": { "runAsAny pod request": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(1)), nil), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(1)), nil),
psps: []*extensions.PodSecurityPolicy{runAsAny}, psps: []*extensions.PodSecurityPolicy{runAsAny},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedPodSC: podSC(userIDPtr(1)), expectedPodSC: podSC(utilpointer.Int64Ptr(1)),
expectedContainerSC: nil, expectedContainerSC: nil,
expectedPSP: runAsAny.Name, expectedPSP: runAsAny.Name,
}, },
"runAsAny container request": { "runAsAny container request": {
pod: createPodWithSecurityContexts(nil, containerSC(userIDPtr(1))), pod: createPodWithSecurityContexts(nil, containerSC(utilpointer.Int64Ptr(1))),
psps: []*extensions.PodSecurityPolicy{runAsAny}, psps: []*extensions.PodSecurityPolicy{runAsAny},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedPodSC: nil, expectedPodSC: nil,
expectedContainerSC: containerSC(userIDPtr(1)), expectedContainerSC: containerSC(utilpointer.Int64Ptr(1)),
expectedPSP: runAsAny.Name, expectedPSP: runAsAny.Name,
}, },
"mustRunAs pod request out of range": { "mustRunAs pod request out of range": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(1)), nil), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(1)), nil),
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: false, shouldPassAdmit: false,
shouldPassValidate: false, shouldPassValidate: false,
}, },
"mustRunAs container request out of range": { "mustRunAs container request out of range": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(999)), containerSC(userIDPtr(1))), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(999)), containerSC(utilpointer.Int64Ptr(1))),
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: false, shouldPassAdmit: false,
shouldPassValidate: false, shouldPassValidate: false,
}, },
"mustRunAs pod request in range": { "mustRunAs pod request in range": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(999)), nil), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(999)), nil),
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
@ -1264,7 +1265,7 @@ func TestAdmitRunAsUser(t *testing.T) {
expectedPSP: mustRunAs.Name, expectedPSP: mustRunAs.Name,
}, },
"mustRunAs container request in range": { "mustRunAs container request in range": {
pod: createPodWithSecurityContexts(nil, containerSC(userIDPtr(999))), pod: createPodWithSecurityContexts(nil, containerSC(utilpointer.Int64Ptr(999))),
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
@ -1273,12 +1274,12 @@ func TestAdmitRunAsUser(t *testing.T) {
expectedPSP: mustRunAs.Name, expectedPSP: mustRunAs.Name,
}, },
"mustRunAs pod and container request in range": { "mustRunAs pod and container request in range": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(999)), containerSC(userIDPtr(1000))), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(999)), containerSC(utilpointer.Int64Ptr(1000))),
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedPodSC: podSC(userIDPtr(999)), expectedPodSC: podSC(utilpointer.Int64Ptr(999)),
expectedContainerSC: containerSC(userIDPtr(1000)), expectedContainerSC: containerSC(utilpointer.Int64Ptr(1000)),
expectedPSP: mustRunAs.Name, expectedPSP: mustRunAs.Name,
}, },
"mustRunAs no request": { "mustRunAs no request": {
@ -1301,32 +1302,32 @@ func TestAdmitRunAsUser(t *testing.T) {
expectedPSP: runAsNonRoot.Name, expectedPSP: runAsNonRoot.Name,
}, },
"runAsNonRoot pod request root": { "runAsNonRoot pod request root": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(0)), nil), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(0)), nil),
psps: []*extensions.PodSecurityPolicy{runAsNonRoot}, psps: []*extensions.PodSecurityPolicy{runAsNonRoot},
shouldPassAdmit: false, shouldPassAdmit: false,
shouldPassValidate: false, shouldPassValidate: false,
}, },
"runAsNonRoot pod request non-root": { "runAsNonRoot pod request non-root": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(1)), nil), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(1)), nil),
psps: []*extensions.PodSecurityPolicy{runAsNonRoot}, psps: []*extensions.PodSecurityPolicy{runAsNonRoot},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedPodSC: podSC(userIDPtr(1)), expectedPodSC: podSC(utilpointer.Int64Ptr(1)),
expectedPSP: runAsNonRoot.Name, expectedPSP: runAsNonRoot.Name,
}, },
"runAsNonRoot container request root": { "runAsNonRoot container request root": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(1)), containerSC(userIDPtr(0))), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(1)), containerSC(utilpointer.Int64Ptr(0))),
psps: []*extensions.PodSecurityPolicy{runAsNonRoot}, psps: []*extensions.PodSecurityPolicy{runAsNonRoot},
shouldPassAdmit: false, shouldPassAdmit: false,
shouldPassValidate: false, shouldPassValidate: false,
}, },
"runAsNonRoot container request non-root": { "runAsNonRoot container request non-root": {
pod: createPodWithSecurityContexts(podSC(userIDPtr(1)), containerSC(userIDPtr(2))), pod: createPodWithSecurityContexts(podSC(utilpointer.Int64Ptr(1)), containerSC(utilpointer.Int64Ptr(2))),
psps: []*extensions.PodSecurityPolicy{runAsNonRoot}, psps: []*extensions.PodSecurityPolicy{runAsNonRoot},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedPodSC: podSC(userIDPtr(1)), expectedPodSC: podSC(utilpointer.Int64Ptr(1)),
expectedContainerSC: containerSC(userIDPtr(2)), expectedContainerSC: containerSC(utilpointer.Int64Ptr(2)),
expectedPSP: runAsNonRoot.Name, expectedPSP: runAsNonRoot.Name,
}, },
} }
@ -1435,12 +1436,12 @@ func TestAdmitSupplementalGroups(t *testing.T) {
} }
func TestAdmitFSGroup(t *testing.T) { func TestAdmitFSGroup(t *testing.T) {
createPodWithFSGroup := func(group int) *kapi.Pod { createPodWithFSGroup := func(group int64) *kapi.Pod {
pod := goodPod() pod := goodPod()
// doesn't matter if we set it here or on the container, the // doesn't matter if we set it here or on the container, the
// admission controller uses DetermineEffectiveSC to get the defaulting // admission controller uses DetermineEffectiveSC to get the defaulting
// behavior so it can validate what will be applied at runtime // behavior so it can validate what will be applied at runtime
pod.Spec.SecurityContext.FSGroup = groupIDPtr(group) pod.Spec.SecurityContext.FSGroup = utilpointer.Int64Ptr(group)
return pod return pod
} }
@ -1472,7 +1473,7 @@ func TestAdmitFSGroup(t *testing.T) {
psps: []*extensions.PodSecurityPolicy{runAsAny}, psps: []*extensions.PodSecurityPolicy{runAsAny},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedFSGroup: groupIDPtr(1), expectedFSGroup: utilpointer.Int64Ptr(1),
expectedPSP: runAsAny.Name, expectedPSP: runAsAny.Name,
}, },
"mustRunAs no pod request": { "mustRunAs no pod request": {
@ -1494,7 +1495,7 @@ func TestAdmitFSGroup(t *testing.T) {
psps: []*extensions.PodSecurityPolicy{mustRunAs}, psps: []*extensions.PodSecurityPolicy{mustRunAs},
shouldPassAdmit: true, shouldPassAdmit: true,
shouldPassValidate: true, shouldPassValidate: true,
expectedFSGroup: groupIDPtr(999), expectedFSGroup: utilpointer.Int64Ptr(999),
expectedPSP: mustRunAs.Name, expectedPSP: mustRunAs.Name,
}, },
} }
@ -2432,13 +2433,3 @@ func goodPod() *kapi.Pod {
}, },
} }
} }
func userIDPtr(i int) *int64 {
userID := int64(i)
return &userID
}
func groupIDPtr(i int) *int64 {
groupID := int64(i)
return &groupID
}

View File

@ -325,7 +325,7 @@ func restrictedPod(f *framework.Framework, name string) *v1.Pod {
Image: framework.GetPauseImageName(f.ClientSet), Image: framework.GetPauseImageName(f.ClientSet),
SecurityContext: &v1.SecurityContext{ SecurityContext: &v1.SecurityContext{
AllowPrivilegeEscalation: boolPtr(false), AllowPrivilegeEscalation: boolPtr(false),
RunAsUser: intPtr(65534), RunAsUser: utilpointer.Int64Ptr(65534),
}, },
}}, }},
}, },
@ -480,7 +480,3 @@ func restrictedPSP(name string) *extensionsv1beta1.PodSecurityPolicy {
func boolPtr(b bool) *bool { func boolPtr(b bool) *bool {
return &b return &b
} }
func intPtr(i int64) *int64 {
return &i
}