Merge pull request #72389 from mason1kwok/feature_gate_AllowedProcMountTypes

AllowedProcMountTypes - Update DropDisabled[Alpha]Fields behaviour
This commit is contained in:
Kubernetes Prow Robot 2018-12-28 23:14:11 -08:00 committed by GitHub
commit 173846b056
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 86 additions and 30 deletions

View File

@ -38,6 +38,7 @@ go_test(
"//pkg/apis/core:go_default_library",
"//pkg/apis/policy:go_default_library",
"//pkg/features:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/diff:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/util/feature/testing:go_default_library",
],

View File

@ -25,11 +25,8 @@ import (
// DropDisabledFields removes disabled fields from the pod security policy spec.
// This should be called from PrepareForCreate/PrepareForUpdate for all resources containing a od security policy spec.
func DropDisabledFields(pspSpec, oldPSPSpec *policy.PodSecurityPolicySpec) {
if !utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) {
if !utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) && !allowedProcMountTypesInUse(oldPSPSpec) {
pspSpec.AllowedProcMountTypes = nil
if oldPSPSpec != nil {
oldPSPSpec.AllowedProcMountTypes = nil
}
}
if !utilfeature.DefaultFeatureGate.Enabled(features.RunAsGroup) {
pspSpec.RunAsGroup = nil
@ -38,3 +35,16 @@ func DropDisabledFields(pspSpec, oldPSPSpec *policy.PodSecurityPolicySpec) {
}
}
}
func allowedProcMountTypesInUse(oldPSPSpec *policy.PodSecurityPolicySpec) bool {
if oldPSPSpec == nil {
return false
}
if oldPSPSpec.AllowedProcMountTypes != nil {
return true
}
return false
}

View File

@ -17,8 +17,11 @@ limitations under the License.
package podsecuritypolicy
import (
"fmt"
"reflect"
"testing"
"k8s.io/apimachinery/pkg/util/diff"
utilfeature "k8s.io/apiserver/pkg/util/feature"
utilfeaturetesting "k8s.io/apiserver/pkg/util/feature/testing"
api "k8s.io/kubernetes/pkg/apis/core"
@ -26,39 +29,81 @@ import (
"k8s.io/kubernetes/pkg/features"
)
func TestDropAlphaProcMountType(t *testing.T) {
// PodSecurityPolicy with AllowedProcMountTypes set
psp := policy.PodSecurityPolicy{
Spec: policy.PodSecurityPolicySpec{
AllowedProcMountTypes: []api.ProcMountType{api.UnmaskedProcMount},
func TestDropAllowedProcMountTypes(t *testing.T) {
allowedProcMountTypes := []api.ProcMountType{api.UnmaskedProcMount}
scWithoutAllowedProcMountTypes := func() *policy.PodSecurityPolicySpec {
return &policy.PodSecurityPolicySpec{}
}
scWithAllowedProcMountTypes := func() *policy.PodSecurityPolicySpec {
return &policy.PodSecurityPolicySpec{
AllowedProcMountTypes: allowedProcMountTypes,
}
}
scInfo := []struct {
description string
hasAllowedProcMountTypes bool
sc func() *policy.PodSecurityPolicySpec
}{
{
description: "PodSecurityPolicySpec Without AllowedProcMountTypes",
hasAllowedProcMountTypes: false,
sc: scWithoutAllowedProcMountTypes,
},
{
description: "PodSecurityPolicySpec With AllowedProcMountTypes",
hasAllowedProcMountTypes: true,
sc: scWithAllowedProcMountTypes,
},
{
description: "is nil",
hasAllowedProcMountTypes: false,
sc: func() *policy.PodSecurityPolicySpec { return nil },
},
}
// Enable alpha feature ProcMountType
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ProcMountType, true)()
for _, enabled := range []bool{true, false} {
for _, oldPSPSpecInfo := range scInfo {
for _, newPSPSpecInfo := range scInfo {
oldPSPSpecHasAllowedProcMountTypes, oldPSPSpec := oldPSPSpecInfo.hasAllowedProcMountTypes, oldPSPSpecInfo.sc()
newPSPSpecHasAllowedProcMountTypes, newPSPSpec := newPSPSpecInfo.hasAllowedProcMountTypes, newPSPSpecInfo.sc()
if newPSPSpec == nil {
continue
}
// now test dropping the fields - should not be dropped
DropDisabledFields(&psp.Spec, nil)
t.Run(fmt.Sprintf("feature enabled=%v, old PodSecurityPolicySpec %v, new PodSecurityPolicySpec %v", enabled, oldPSPSpecInfo.description, newPSPSpecInfo.description), func(t *testing.T) {
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ProcMountType, enabled)()
// check to make sure AllowedProcMountTypes is still present
// if featureset is set to true
if utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) {
if psp.Spec.AllowedProcMountTypes == nil {
t.Error("AllowedProcMountTypes in pvc.Spec should not have been dropped based on feature-gate")
}
}
DropDisabledFields(newPSPSpec, oldPSPSpec)
// Disable alpha feature ProcMountType
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ProcMountType, false)()
// old PodSecurityPolicySpec should never be changed
if !reflect.DeepEqual(oldPSPSpec, oldPSPSpecInfo.sc()) {
t.Errorf("old PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(oldPSPSpec, oldPSPSpecInfo.sc()))
}
// now test dropping the fields
DropDisabledFields(&psp.Spec, nil)
// check to make sure AllowedProcMountTypes is nil
// if featureset is set to false
if utilfeature.DefaultFeatureGate.Enabled(features.ProcMountType) {
if psp.Spec.AllowedProcMountTypes != nil {
t.Error("DropDisabledFields AllowedProcMountTypes for psp.Spec failed")
switch {
case enabled || oldPSPSpecHasAllowedProcMountTypes:
// new PodSecurityPolicySpec should not be changed if the feature is enabled, or if the old PodSecurityPolicySpec had AllowedProcMountTypes
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
}
case newPSPSpecHasAllowedProcMountTypes:
// new PodSecurityPolicySpec should be changed
if reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec was not changed")
}
// new PodSecurityPolicySpec should not have AllowedProcMountTypes
if !reflect.DeepEqual(newPSPSpec, scWithoutAllowedProcMountTypes()) {
t.Errorf("new PodSecurityPolicySpec had PodSecurityPolicySpecAllowedProcMountTypes: %v", diff.ObjectReflectDiff(newPSPSpec, scWithoutAllowedProcMountTypes()))
}
default:
// new PodSecurityPolicySpec should not need to be changed
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
}
}
})
}
}
}
}