From da695e7b784f86b875bac6de15cac2d0263481fe Mon Sep 17 00:00:00 2001 From: Peter Hunt Date: Wed, 17 Dec 2025 13:18:02 -0500 Subject: [PATCH] e2e_node: update proc mount test to correctly handle baseline PSA Signed-off-by: Peter Hunt --- test/e2e_node/proc_mount_test.go | 16 ++++------------ test/e2e_node/quota_lsci_test.go | 3 ++- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/test/e2e_node/proc_mount_test.go b/test/e2e_node/proc_mount_test.go index 5a968b089ac..7131cdea5ad 100644 --- a/test/e2e_node/proc_mount_test.go +++ b/test/e2e_node/proc_mount_test.go @@ -32,10 +32,9 @@ import ( testutils "k8s.io/kubernetes/test/utils" imageutils "k8s.io/kubernetes/test/utils/image" admissionapi "k8s.io/pod-security-admission/api" + "k8s.io/utils/ptr" ) -var falseVar = false - var _ = SIGDescribe("DefaultProcMount [LinuxOnly]", framework.WithNodeConformance(), func() { f := framework.NewDefaultFramework("proc-mount-default-test") f.NamespacePodSecurityLevel = admissionapi.LevelBaseline @@ -47,9 +46,9 @@ var _ = SIGDescribe("DefaultProcMount [LinuxOnly]", framework.WithNodeConformanc var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.UserNamespacesSupport, func() { f := framework.NewDefaultFramework("proc-mount-restricted-test") - f.NamespacePodSecurityLevel = admissionapi.LevelRestricted + f.NamespacePodSecurityLevel = admissionapi.LevelBaseline - f.It("will fail to unmask proc mounts at restricted level", func(ctx context.Context) { + f.It("will fail to unmask proc mounts if not in user namespace", func(ctx context.Context) { if !supportsUserNS(ctx, f) { e2eskipper.Skipf("runtime does not support user namespaces") } @@ -69,18 +68,11 @@ var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.User }, }, }, - HostUsers: &falseVar, + HostUsers: ptr.To(true), }, }, metav1.CreateOptions{}) gomega.Expect(err).To(gomega.HaveOccurred()) }) -}) - -var _ = SIGDescribe("ProcMount [LinuxOnly]", feature.ProcMountType, feature.UserNamespacesSupport, func() { - f := framework.NewDefaultFramework("proc-mount-privileged-test") - - f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged - f.It("will unmask proc mounts if requested", func(ctx context.Context) { if !supportsUserNS(ctx, f) { e2eskipper.Skipf("runtime does not support user namespaces") diff --git a/test/e2e_node/quota_lsci_test.go b/test/e2e_node/quota_lsci_test.go index 922fd12a005..f4bf6cc059d 100644 --- a/test/e2e_node/quota_lsci_test.go +++ b/test/e2e_node/quota_lsci_test.go @@ -34,6 +34,7 @@ import ( imageutils "k8s.io/kubernetes/test/utils/image" "k8s.io/mount-utils" admissionapi "k8s.io/pod-security-admission/api" + "k8s.io/utils/ptr" "github.com/onsi/ginkgo/v2" ) @@ -134,7 +135,7 @@ func diskConcealingPod(name string, diskConsumedMB int, volumeSource *v1.VolumeS return &v1.Pod{ ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("%s-pod", name)}, Spec: v1.PodSpec{ - HostUsers: &falseVar, + HostUsers: ptr.To(false), RestartPolicy: v1.RestartPolicyNever, Containers: []v1.Container{ {