github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-21 18:11:22 +00:00
Code Issues Projects Releases Wiki Activity

test/e2e/*: default existing tests to privileged pod security policy

Browse Source 
This is to ensure that all existing tests don't break when defaulting
the pod security policy to restricted in the e2e test framework.
This commit is contained in:
Sergiusz Urbaniak
2022-04-04 14:00:06 +02:00
parent f578b9a40d
commit 1495c9f2cd
168 changed files with 351 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/e2e/windows/cpu_limits.go
View File

@@ -26,6 +26,7 @@ import (
"k8s.io/kubernetes/test/e2e/framework"
e2ekubelet "k8s.io/kubernetes/test/e2e/framework/kubelet"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"time"
"github.com/onsi/ginkgo"
@@ -33,6 +34,7 @@ import (
var _ = SIGDescribe("[Feature:Windows] Cpu Resources [Serial]", func() {
f := framework.NewDefaultFramework("cpu-resources-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
// The Windows 'BusyBox' image is PowerShell plus a collection of scripts and utilities to mimic common busybox commands
powershellImage := imageutils.GetConfig(imageutils.BusyBox)

2
test/e2e/windows/density.go
View File

@@ -34,6 +34,7 @@ import (
e2emetrics "k8s.io/kubernetes/test/e2e/framework/metrics"
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
"github.com/onsi/gomega"
@@ -41,6 +42,7 @@ import (
var _ = SIGDescribe("[Feature:Windows] Density [Serial] [Slow]", func() {
f := framework.NewDefaultFramework("density-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.Context("create a batch of pods", func() {
// TODO(coufon): the values are generous, set more precise limits with benchmark data

2
test/e2e/windows/device_plugin.go
View File

@@ -29,6 +29,7 @@ import (
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
)
@@ -39,6 +40,7 @@ const (
var _ = SIGDescribe("[Feature:GPUDevicePlugin] Device Plugin", func() {
f := framework.NewDefaultFramework("device-plugin")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
var cs clientset.Interface

2
test/e2e/windows/dns.go
View File

@@ -25,6 +25,7 @@ import (
"k8s.io/kubernetes/test/e2e/framework"
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
)
@@ -36,6 +37,7 @@ var _ = SIGDescribe("[Feature:Windows] DNS", func() {
})
f := framework.NewDefaultFramework("dns")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.It("should support configurable pod DNS servers", func() {
ginkgo.By("Getting the IP address of the internal Kubernetes service")

2
test/e2e/windows/gmsa_full.go
View File

@@ -60,6 +60,7 @@ import (
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
)
const (
@@ -90,6 +91,7 @@ const (
var _ = SIGDescribe("[Feature:Windows] GMSA Full [Serial] [Slow]", func() {
f := framework.NewDefaultFramework("gmsa-full-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.Describe("GMSA support", func() {
ginkgo.It("works end to end", func() {

2
test/e2e/windows/gmsa_kubelet.go
View File

@@ -30,6 +30,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/kubernetes/test/e2e/framework"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
"github.com/onsi/gomega"
@@ -37,6 +38,7 @@ import (
var _ = SIGDescribe("[Feature:Windows] GMSA Kubelet [Slow]", func() {
f := framework.NewDefaultFramework("gmsa-kubelet-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.Describe("kubelet GMSA support", func() {
ginkgo.Context("when creating a pod with correct GMSA credential specs", func() {

2
test/e2e/windows/host_process.go
View File

@@ -32,6 +32,7 @@ import (
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
)
const (
@@ -82,6 +83,7 @@ var _ = SIGDescribe("[Feature:WindowsHostProcessContainers] [MinimumKubeletVersi
})
f := framework.NewDefaultFramework("host-process-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.It("should run as a process on the host/node", func() {

2
test/e2e/windows/hybrid_network.go
View File

@@ -24,6 +24,7 @@ import (
"k8s.io/apimachinery/pkg/util/uuid"
"k8s.io/kubernetes/test/e2e/framework"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
admissionapi "k8s.io/pod-security-admission/api"
imageutils "k8s.io/kubernetes/test/utils/image"
@@ -43,6 +44,7 @@ var (
var _ = SIGDescribe("Hybrid cluster network", func() {
f := framework.NewDefaultFramework("hybrid-network")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.BeforeEach(func() {
e2eskipper.SkipUnlessNodeOSDistroIs("windows")

3
test/e2e/windows/kubelet_stats.go
View File

@@ -31,12 +31,14 @@ import (
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
)
var _ = SIGDescribe("[Feature:Windows] Kubelet-Stats [Serial]", func() {
f := framework.NewDefaultFramework("kubelet-stats-test-windows-serial")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.Describe("Kubelet stats collection for Windows nodes", func() {
@@ -112,6 +114,7 @@ var _ = SIGDescribe("[Feature:Windows] Kubelet-Stats [Serial]", func() {
})
var _ = SIGDescribe("[Feature:Windows] Kubelet-Stats", func() {
f := framework.NewDefaultFramework("kubelet-stats-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.Describe("Kubelet stats collection for Windows nodes", func() {

2
test/e2e/windows/memory_limits.go
View File

@@ -34,6 +34,7 @@ import (
"k8s.io/kubernetes/test/e2e/framework"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
"github.com/onsi/gomega"
@@ -42,6 +43,7 @@ import (
var _ = SIGDescribe("[Feature:Windows] Memory Limits [Serial] [Slow]", func() {
f := framework.NewDefaultFramework("memory-limit-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.BeforeEach(func() {
// NOTE(vyta): these tests are Windows specific

2
test/e2e/windows/reboot_node.go
View File

@@ -29,6 +29,7 @@ import (
"k8s.io/kubernetes/test/e2e/framework"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
)
var _ = SIGDescribe("[Feature:Windows] [Excluded:WindowsDocker] [MinimumKubeletVersion:1.22] RebootHost containers [Serial] [Disruptive] [Slow]", func() {
@@ -37,6 +38,7 @@ var _ = SIGDescribe("[Feature:Windows] [Excluded:WindowsDocker] [MinimumKubeletV
})
f := framework.NewDefaultFramework("reboot-host-test-windows")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.It("should run as a reboot process on the host/node", func() {

2
test/e2e/windows/security_context.go
View File

@@ -34,12 +34,14 @@ import (
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
testutils "k8s.io/kubernetes/test/utils"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
)
const runAsUserNameContainerName = "run-as-username-container"
var _ = SIGDescribe("[Feature:Windows] SecurityContext", func() {
f := framework.NewDefaultFramework("windows-run-as-username")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
ginkgo.It("should be able create pods and run containers with a given username", func() {
ginkgo.By("Creating 2 pods: 1 with the default user, and one with a custom one.")

2
test/e2e/windows/service.go
View File

@@ -25,12 +25,14 @@ import (
e2enode "k8s.io/kubernetes/test/e2e/framework/node"
e2eservice "k8s.io/kubernetes/test/e2e/framework/service"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
)
var _ = SIGDescribe("Services", func() {
f := framework.NewDefaultFramework("services")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
var cs clientset.Interface

2
test/e2e/windows/volumes.go
View File

@@ -25,6 +25,7 @@ import (
"k8s.io/kubernetes/test/e2e/framework"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo"
)
@@ -42,6 +43,7 @@ var (
var _ = SIGDescribe("[Feature:Windows] Windows volume mounts ", func() {
f := framework.NewDefaultFramework("windows-volumes")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
var (
emptyDirSource = v1.VolumeSource{
EmptyDir: &v1.EmptyDirVolumeSource{