github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 04:54:54 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #135189 from haircommander/proc-e2e-node

Browse Source 
e2e_node: update proc mount test to correctly handle baseline PSA
This commit is contained in:
Kubernetes Prow Robot
2026-01-08 04:57:37 +05:30
committed by GitHub
parent 7e7267a6df da695e7b78
commit 3619b0c8aa
2 changed files with 6 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
test/e2e_node/proc_mount_test.go
View File

@@ -32,10 +32,9 @@ import (
testutils "k8s.io/kubernetes/test/utils"
imageutils "k8s.io/kubernetes/test/utils/image"
admissionapi "k8s.io/pod-security-admission/api"
"k8s.io/utils/ptr"
)
var falseVar = false
var _ = SIGDescribe("DefaultProcMount [LinuxOnly]", framework.WithNodeConformance(), func() {
f := framework.NewDefaultFramework("proc-mount-default-test")
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
@@ -47,9 +46,9 @@ var _ = SIGDescribe("DefaultProcMount [LinuxOnly]", framework.WithNodeConformanc
var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.UserNamespacesSupport, func() {
f := framework.NewDefaultFramework("proc-mount-restricted-test")
f.NamespacePodSecurityLevel = admissionapi.LevelRestricted
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
f.It("will fail to unmask proc mounts at restricted level", func(ctx context.Context) {
f.It("will fail to unmask proc mounts if not in user namespace", func(ctx context.Context) {
if !supportsUserNS(ctx, f) {
e2eskipper.Skipf("runtime does not support user namespaces")
}
@@ -69,18 +68,11 @@ var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.User
},
},
},
HostUsers: &falseVar,
HostUsers: ptr.To(true),
},
}, metav1.CreateOptions{})
gomega.Expect(err).To(gomega.HaveOccurred())
})
})
var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.UserNamespacesSupport, func() {
f := framework.NewDefaultFramework("proc-mount-privileged-test")
f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
f.It("will unmask proc mounts if requested", func(ctx context.Context) {
if !supportsUserNS(ctx, f) {
e2eskipper.Skipf("runtime does not support user namespaces")

3
test/e2e_node/quota_lsci_test.go
View File

@@ -34,6 +34,7 @@ import (
imageutils "k8s.io/kubernetes/test/utils/image"
"k8s.io/mount-utils"
admissionapi "k8s.io/pod-security-admission/api"
"k8s.io/utils/ptr"
"github.com/onsi/ginkgo/v2"
)
@@ -134,7 +135,7 @@ func diskConcealingPod(name string, diskConsumedMB int, volumeSource *v1.VolumeS
return &v1.Pod{
ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("%s-pod", name)},
Spec: v1.PodSpec{
HostUsers: &falseVar,
HostUsers: ptr.To(false),
RestartPolicy: v1.RestartPolicyNever,
Containers: []v1.Container{
{