From 3bef0e40a6596ee4ab372d3912284dcd59181f63 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Tue, 26 May 2020 10:32:50 +0200 Subject: [PATCH] Update seccomp e2e test for GA We now execute the seccomp tests with `[LinuxOnly]` as described in the appropriate KEP test plan: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.md#test-plan The tests have been changed to used the new seccomp field within the security context in replacement for the annotations. Signed-off-by: Sascha Grunert --- test/e2e/node/security_context.go | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/test/e2e/node/security_context.go b/test/e2e/node/security_context.go index dec5ce23585..978c02e14e3 100644 --- a/test/e2e/node/security_context.go +++ b/test/e2e/node/security_context.go @@ -146,33 +146,29 @@ var _ = SIGDescribe("Security Context", func() { testPodSELinuxLabeling(f, false, true) }) - ginkgo.It("should support seccomp alpha unconfined annotation on the container [Feature:Seccomp] [LinuxOnly]", func() { - // TODO: port to SecurityContext as soon as seccomp is out of alpha + ginkgo.It("should support seccomp unconfined on the container [LinuxOnly]", func() { pod := scTestPod(false, false) - pod.Annotations[v1.SeccompContainerAnnotationKeyPrefix+"test-container"] = "unconfined" - pod.Annotations[v1.SeccompPodAnnotationKey] = v1.SeccompProfileRuntimeDefault + pod.Spec.Containers[0].SecurityContext = &v1.SecurityContext{SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}} + pod.Spec.SecurityContext = &v1.PodSecurityContext{SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}} pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"0"}) // seccomp disabled }) - ginkgo.It("should support seccomp alpha unconfined annotation on the pod [Feature:Seccomp] [LinuxOnly]", func() { - // TODO: port to SecurityContext as soon as seccomp is out of alpha + ginkgo.It("should support seccomp unconfined on the pod [LinuxOnly]", func() { pod := scTestPod(false, false) - pod.Annotations[v1.SeccompPodAnnotationKey] = "unconfined" + pod.Spec.SecurityContext = &v1.PodSecurityContext{SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}} pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"0"}) // seccomp disabled }) - ginkgo.It("should support seccomp alpha runtime/default annotation [Feature:Seccomp] [LinuxOnly]", func() { - // TODO: port to SecurityContext as soon as seccomp is out of alpha + ginkgo.It("should support seccomp runtime/default [LinuxOnly]", func() { pod := scTestPod(false, false) - pod.Annotations[v1.SeccompContainerAnnotationKeyPrefix+"test-container"] = v1.SeccompProfileRuntimeDefault + pod.Spec.Containers[0].SecurityContext = &v1.SecurityContext{SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}} pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"2"}) // seccomp filtered }) - ginkgo.It("should support seccomp default which is unconfined [Feature:Seccomp] [LinuxOnly]", func() { - // TODO: port to SecurityContext as soon as seccomp is out of alpha + ginkgo.It("should support seccomp default which is unconfined [LinuxOnly]", func() { pod := scTestPod(false, false) pod.Spec.Containers[0].Command = []string{"grep", "ecc", "/proc/self/status"} f.TestContainerOutput(v1.SeccompPodAnnotationKey, pod, 0, []string{"0"}) // seccomp disabled