github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-06 07:57:35 +00:00
Code Issues Projects Releases Wiki Activity

[kubelet][podadmission]: Validate and reject pods with mismatching labels

Browse Source
This commit is contained in:
ravisantoshgudimetla
2021-10-26 10:43:44 -04:00
parent 02c1bac0b6
commit 21c5c2ec5c
2 changed files with 84 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
pkg/kubelet/lifecycle/predicate_test.go
View File

@@ -18,6 +18,7 @@ package lifecycle
import (
"reflect"
goruntime "runtime"
"testing"
v1 "k8s.io/api/core/v1"
@@ -267,3 +268,57 @@ func TestGeneralPredicates(t *testing.T) {
})
}
}
func TestRejectPodAdmissionBasedOnOSSelector(t *testing.T) {
tests := []struct {
name string
pod *v1.Pod
node *v1.Node
expectRejection bool
}{
{
name: "OS label match",
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: goruntime.GOOS}}},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: goruntime.GOOS}}},
expectRejection: false,
},
{
name: "dummyOS label, but the underlying OS matches",
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: goruntime.GOOS}}},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
expectRejection: false,
},
{
name: "dummyOS label, but the underlying OS doesn't match",
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
expectRejection: true,
},
{
name: "dummyOS label, but the underlying OS doesn't match",
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
expectRejection: true,
},
{
name: "OS field mismatch, OS label on node object would be reset to correct value",
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
expectRejection: true,
},
{
name: "No label selector on the pod, should be admitted",
pod: &v1.Pod{},
node: &v1.Node{Spec: v1.NodeSpec{}, ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{v1.LabelOSStable: "dummyOS"}}},
expectRejection: false,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
actualResult := rejectPodAdmissionBasedOnOSSelector(test.pod, test.node)
if test.expectRejection != actualResult {
t.Errorf("unexpected result, expected %v but got %v", test.expectRejection, actualResult)
}
})
}
}