mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-20 18:31:15 +00:00
Run common pod E2Es as restricted
This commit is contained in:
Tim Allclair
parent
ccc69b1e9a
commit
702ab97722
@ -184,7 +184,7 @@ func expectNoErrorWithRetries(fn func() error, maxRetries int, explain ...interf
|
||||
|
||||
var _ = SIGDescribe("Pods", func() {
|
||||
f := framework.NewDefaultFramework("pods")
|
||||
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelBaseline
|
||||
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelRestricted
|
||||
var podClient *framework.PodClient
|
||||
var dc dynamic.Interface
|
||||
|
||||
@ -200,7 +200,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
*/
|
||||
framework.ConformanceIt("should get a host IP [NodeConformance]", func() {
|
||||
name := "pod-hostip-" + string(uuid.NewUUID())
|
||||
testHostIP(podClient, &v1.Pod{
|
||||
testHostIP(podClient, e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
},
|
||||
@ -212,7 +212,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
}))
|
||||
})
|
||||
|
||||
/*
|
||||
@ -224,7 +224,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.By("creating the pod")
|
||||
name := "pod-submit-remove-" + string(uuid.NewUUID())
|
||||
value := strconv.Itoa(time.Now().Nanosecond())
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Labels: map[string]string{
|
||||
@ -235,12 +235,12 @@ var _ = SIGDescribe("Pods", func() {
|
||||
Spec: v1.PodSpec{
|
||||
Containers: []v1.Container{
|
||||
{
|
||||
Name: "nginx",
|
||||
Image: imageutils.GetE2EImage(imageutils.Nginx),
|
||||
Name: "pause",
|
||||
Image: imageutils.GetPauseImageName(),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
ginkgo.By("setting up watch")
|
||||
selector := labels.SelectorFromSet(labels.Set(map[string]string{"time": value}))
|
||||
@ -342,7 +342,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.By("creating the pod")
|
||||
name := "pod-update-" + string(uuid.NewUUID())
|
||||
value := strconv.Itoa(time.Now().Nanosecond())
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Labels: map[string]string{
|
||||
@ -353,12 +353,12 @@ var _ = SIGDescribe("Pods", func() {
|
||||
Spec: v1.PodSpec{
|
||||
Containers: []v1.Container{
|
||||
{
|
||||
Name: "nginx",
|
||||
Image: imageutils.GetE2EImage(imageutils.Nginx),
|
||||
Name: "pause",
|
||||
Image: imageutils.GetPauseImageName(),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
ginkgo.By("submitting the pod to kubernetes")
|
||||
pod = podClient.CreateSync(pod)
|
||||
@ -396,7 +396,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.By("creating the pod")
|
||||
name := "pod-update-activedeadlineseconds-" + string(uuid.NewUUID())
|
||||
value := strconv.Itoa(time.Now().Nanosecond())
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Labels: map[string]string{
|
||||
@ -407,18 +407,18 @@ var _ = SIGDescribe("Pods", func() {
|
||||
Spec: v1.PodSpec{
|
||||
Containers: []v1.Container{
|
||||
{
|
||||
Name: "nginx",
|
||||
Image: imageutils.GetE2EImage(imageutils.Nginx),
|
||||
Name: "pause",
|
||||
Image: imageutils.GetPauseImageName(),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
ginkgo.By("submitting the pod to kubernetes")
|
||||
podClient.CreateSync(pod)
|
||||
|
||||
ginkgo.By("verifying the pod is in kubernetes")
|
||||
selector := labels.SelectorFromSet(labels.Set(map[string]string{"time": value}))
|
||||
selector := labels.SelectorFromSet(labels.Set{"time": value})
|
||||
options := metav1.ListOptions{LabelSelector: selector.String()}
|
||||
pods, err := podClient.List(context.TODO(), options)
|
||||
framework.ExpectNoError(err, "failed to query for pods")
|
||||
@ -442,7 +442,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
// Make a pod that will be a service.
|
||||
// This pod serves its hostname via HTTP.
|
||||
serverName := "server-envvars-" + string(uuid.NewUUID())
|
||||
serverPod := &v1.Pod{
|
||||
serverPod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: serverName,
|
||||
Labels: map[string]string{"name": serverName},
|
||||
@ -456,7 +456,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
podClient.CreateSync(serverPod)
|
||||
|
||||
// This service exposes port 8080 of the test pod as a service on port 8765
|
||||
@ -490,7 +490,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
// Make a client pod that verifies that it has the service environment variables.
|
||||
podName := "client-envvars-" + string(uuid.NewUUID())
|
||||
const containerName = "env3cont"
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podName,
|
||||
Labels: map[string]string{"name": podName},
|
||||
@ -505,7 +505,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
RestartPolicy: v1.RestartPolicyNever,
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
// It's possible for the Pod to be created before the Kubelet is updated with the new
|
||||
// service. In that case, we just retry.
|
||||
@ -536,7 +536,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
|
||||
ginkgo.By("creating the pod")
|
||||
name := "pod-exec-websocket-" + string(uuid.NewUUID())
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
},
|
||||
@ -549,7 +549,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
ginkgo.By("submitting the pod to kubernetes")
|
||||
pod = podClient.CreateSync(pod)
|
||||
@ -618,7 +618,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
|
||||
ginkgo.By("creating the pod")
|
||||
name := "pod-logs-websocket-" + string(uuid.NewUUID())
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
},
|
||||
@ -631,7 +631,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
ginkgo.By("submitting the pod to kubernetes")
|
||||
podClient.CreateSync(pod)
|
||||
@ -673,7 +673,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.It("should have their auto-restart back-off timer reset on image update [Slow][NodeConformance]", func() {
|
||||
podName := "pod-back-off-image"
|
||||
containerName := "back-off"
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podName,
|
||||
Labels: map[string]string{"test": "back-off-image"},
|
||||
@ -687,7 +687,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
delay1, delay2 := startPodAndGetBackOffs(podClient, pod, buildBackOffDuration)
|
||||
|
||||
@ -714,7 +714,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.It("should cap back-off at MaxContainerBackOff [Slow][NodeConformance]", func() {
|
||||
podName := "back-off-cap"
|
||||
containerName := "back-off-cap"
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podName,
|
||||
Labels: map[string]string{"test": "liveness"},
|
||||
@ -728,7 +728,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
podClient.CreateSync(pod)
|
||||
time.Sleep(2 * kubelet.MaxContainerBackOff) // it takes slightly more than 2*x to get to a back-off of x
|
||||
@ -770,7 +770,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
readinessGate1 := "k8s.io/test-condition1"
|
||||
readinessGate2 := "k8s.io/test-condition2"
|
||||
patchStatusFmt := `{"status":{"conditions":[{"type":%q, "status":%q}]}}`
|
||||
pod := &v1.Pod{
|
||||
pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podName,
|
||||
Labels: map[string]string{"test": "pod-readiness-gate"},
|
||||
@ -788,7 +788,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
{ConditionType: v1.PodConditionType(readinessGate2)},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
|
||||
validatePodReadiness := func(expectReady bool) {
|
||||
err := wait.Poll(time.Second, time.Minute, func() (bool, error) {
|
||||
@ -843,20 +843,22 @@ var _ = SIGDescribe("Pods", func() {
|
||||
ginkgo.By("Create set of pods")
|
||||
// create a set of pods in test namespace
|
||||
for _, podTestName := range podTestNames {
|
||||
_, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(context.TODO(), &v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podTestName,
|
||||
Labels: map[string]string{
|
||||
"type": "Testing"},
|
||||
},
|
||||
Spec: v1.PodSpec{
|
||||
TerminationGracePeriodSeconds: &one,
|
||||
Containers: []v1.Container{{
|
||||
Image: imageutils.GetE2EImage(imageutils.Agnhost),
|
||||
Name: "token-test",
|
||||
}},
|
||||
RestartPolicy: v1.RestartPolicyNever,
|
||||
}}, metav1.CreateOptions{})
|
||||
_, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(context.TODO(),
|
||||
e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: podTestName,
|
||||
Labels: map[string]string{
|
||||
"type": "Testing",
|
||||
},
|
||||
},
|
||||
Spec: v1.PodSpec{
|
||||
TerminationGracePeriodSeconds: &one,
|
||||
Containers: []v1.Container{{
|
||||
Image: imageutils.GetE2EImage(imageutils.Agnhost),
|
||||
Name: "token-test",
|
||||
}},
|
||||
RestartPolicy: v1.RestartPolicyNever,
|
||||
}}), metav1.CreateOptions{})
|
||||
framework.ExpectNoError(err, "failed to create pod")
|
||||
framework.Logf("created %v", podTestName)
|
||||
}
|
||||
@ -903,7 +905,7 @@ var _ = SIGDescribe("Pods", func() {
|
||||
podsList, err := f.ClientSet.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{LabelSelector: testPodLabelsFlat})
|
||||
framework.ExpectNoError(err, "failed to list Pods")
|
||||
|
||||
testPod := v1.Pod{
|
||||
testPod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: testPodName,
|
||||
Labels: testPodLabels,
|
||||
@ -917,9 +919,9 @@ var _ = SIGDescribe("Pods", func() {
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
})
|
||||
ginkgo.By("creating a Pod with a static label")
|
||||
_, err = f.ClientSet.CoreV1().Pods(testNamespaceName).Create(context.TODO(), &testPod, metav1.CreateOptions{})
|
||||
_, err = f.ClientSet.CoreV1().Pods(testNamespaceName).Create(context.TODO(), testPod, metav1.CreateOptions{})
|
||||
framework.ExpectNoError(err, "failed to create Pod %v in namespace %v", testPod.ObjectMeta.Name, testNamespaceName)
|
||||
|
||||
ginkgo.By("watching for Pod to be ready")
|
||||
|
||||
Loading…
Reference in New Issue
Block a user