From 46a83c28835d1f79bbcb6da1f65120845dd39a51 Mon Sep 17 00:00:00 2001 From: Filipe Brandenburger Date: Mon, 22 Jan 2018 14:44:36 -0800 Subject: [PATCH] Use ipc-utils container in HostIPC tests. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This ensures the `ipcs` command from util-linux will be used, which succeeds when Docker is running with SELinux enabled (while the one from busybox fails.) Tested: On a host with Docker running with SELinux enabled: $ make test-e2e-node REMOTE=true FOCUS="host IPC" • [SLOW TEST:17.272 seconds] (passed) [k8s.io] Security Context when creating a pod in the host IPC namespace should show the shared memory ID in the host IPC containers • [SLOW TEST:20.419 seconds] (passed) [k8s.io] Security Context when creating a pod in the host IPC namespace should not show the shared memory ID in the non-hostIPC containers Ran 2 of 257 Specs in 43.934 seconds SUCCESS! -- 2 Passed | 0 Failed | 0 Pending | 255 Skipped --- test/e2e/common/util.go | 1 + test/e2e_node/security_context_test.go | 22 +++++++++++----------- test/utils/image/manifest.go | 1 + 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/test/e2e/common/util.go b/test/e2e/common/util.go index 2edfd8de7e5..2743207f028 100644 --- a/test/e2e/common/util.go +++ b/test/e2e/common/util.go @@ -53,6 +53,7 @@ var CurrentSuite Suite var CommonImageWhiteList = sets.NewString( "busybox", imageutils.GetE2EImage(imageutils.EntrypointTester), + imageutils.GetE2EImage(imageutils.IpcUtils), imageutils.GetE2EImage(imageutils.Liveness), imageutils.GetE2EImage(imageutils.Mounttest), imageutils.GetE2EImage(imageutils.MounttestUser), diff --git a/test/e2e_node/security_context_test.go b/test/e2e_node/security_context_test.go index e6f19a1147e..90d325a1663 100644 --- a/test/e2e_node/security_context_test.go +++ b/test/e2e_node/security_context_test.go @@ -140,7 +140,7 @@ var _ = framework.KubeDescribe("Security Context", func() { } createAndWaitHostIPCPod := func(podName string, hostNetwork bool) { podClient.Create(makeHostIPCPod(podName, - busyboxImage, + imageutils.GetE2EImage(imageutils.IpcUtils), []string{"sh", "-c", "ipcs -m | awk '{print $2}'"}, hostNetwork, )) @@ -159,30 +159,30 @@ var _ = framework.KubeDescribe("Security Context", func() { }) It("should show the shared memory ID in the host IPC containers", func() { - busyboxPodName := "busybox-hostipc-" + string(uuid.NewUUID()) - createAndWaitHostIPCPod(busyboxPodName, true) - logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) + ipcutilsPodName := "ipcutils-hostipc-" + string(uuid.NewUUID()) + createAndWaitHostIPCPod(ipcutilsPodName, true) + logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, ipcutilsPodName, ipcutilsPodName) if err != nil { - framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) + framework.Failf("GetPodLogs for pod %q failed: %v", ipcutilsPodName, err) } podSharedMemoryIDs := strings.TrimSpace(logs) - framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, busyboxPodName) + framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, ipcutilsPodName) if !strings.Contains(podSharedMemoryIDs, hostSharedMemoryID) { framework.Failf("hostIPC container should show shared memory IDs on host") } }) It("should not show the shared memory ID in the non-hostIPC containers", func() { - busyboxPodName := "busybox-non-hostipc-" + string(uuid.NewUUID()) - createAndWaitHostIPCPod(busyboxPodName, false) - logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) + ipcutilsPodName := "ipcutils-non-hostipc-" + string(uuid.NewUUID()) + createAndWaitHostIPCPod(ipcutilsPodName, false) + logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, ipcutilsPodName, ipcutilsPodName) if err != nil { - framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) + framework.Failf("GetPodLogs for pod %q failed: %v", ipcutilsPodName, err) } podSharedMemoryIDs := strings.TrimSpace(logs) - framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, busyboxPodName) + framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, ipcutilsPodName) if strings.Contains(podSharedMemoryIDs, hostSharedMemoryID) { framework.Failf("non-hostIPC container should not show shared memory IDs on host") } diff --git a/test/utils/image/manifest.go b/test/utils/image/manifest.go index bac17165482..3e9ebdadd9b 100644 --- a/test/utils/image/manifest.go +++ b/test/utils/image/manifest.go @@ -65,6 +65,7 @@ var ( GBRedisSlave = ImageConfig{sampleRegistry, "gb-redisslave", "v2", true} Goproxy = ImageConfig{e2eRegistry, "goproxy", "1.0", true} Hostexec = ImageConfig{e2eRegistry, "hostexec", "1.0", true} + IpcUtils = ImageConfig{e2eRegistry, "ipc-utils", "1.0", true} Iperf = ImageConfig{e2eRegistry, "iperf", "1.0", true} JessieDnsutils = ImageConfig{e2eRegistry, "jessie-dnsutils", "1.0", true} Kitten = ImageConfig{e2eRegistry, "kitten", "1.0", true}