github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 19:01:49 +00:00
Code Issues Projects Releases Wiki Activity

Run common pod E2Es as restricted

Browse Source
This commit is contained in:
Tim Allclair 2022-05-24 16:10:11 -07:00
parent ccc69b1e9a
commit 702ab97722
1 changed files with 49 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
test/e2e/common/node/pods.go
View File

@ -184,7 +184,7 @@ func expectNoErrorWithRetries(fn func() error, maxRetries int, explain ...interf
var _ = SIGDescribe("Pods", func() { var _ = SIGDescribe("Pods", func() {
f := framework.NewDefaultFramework("pods") f := framework.NewDefaultFramework("pods")
f.NamespacePodSecurityEnforceLevel = admissionapi.LevelBaseline f.NamespacePodSecurityEnforceLevel = admissionapi.LevelRestricted
var podClient *framework.PodClient var podClient *framework.PodClient
var dc dynamic.Interface var dc dynamic.Interface
@ -200,7 +200,7 @@ var _ = SIGDescribe("Pods", func() {
*/ */
framework.ConformanceIt("should get a host IP [NodeConformance]", func() { framework.ConformanceIt("should get a host IP [NodeConformance]", func() {
name := "pod-hostip-" + string(uuid.NewUUID()) name := "pod-hostip-" + string(uuid.NewUUID())
testHostIP(podClient, &v1.Pod{ testHostIP(podClient, e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
}, },
@ -212,7 +212,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
}) }))
}) })
/* /*
@ -224,7 +224,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("creating the pod") ginkgo.By("creating the pod")
name := "pod-submit-remove-" + string(uuid.NewUUID()) name := "pod-submit-remove-" + string(uuid.NewUUID())
value := strconv.Itoa(time.Now().Nanosecond()) value := strconv.Itoa(time.Now().Nanosecond())
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Labels: map[string]string{ Labels: map[string]string{
@ -235,12 +235,12 @@ var _ = SIGDescribe("Pods", func() {
Spec: v1.PodSpec{ Spec: v1.PodSpec{
Containers: []v1.Container{ Containers: []v1.Container{
{ {
Name: "nginx", Name: "pause",
Image: imageutils.GetE2EImage(imageutils.Nginx), Image: imageutils.GetPauseImageName(),
}, },
}, },
}, },
} })
ginkgo.By("setting up watch") ginkgo.By("setting up watch")
selector := labels.SelectorFromSet(labels.Set(map[string]string{"time": value})) selector := labels.SelectorFromSet(labels.Set(map[string]string{"time": value}))
@ -342,7 +342,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("creating the pod") ginkgo.By("creating the pod")
name := "pod-update-" + string(uuid.NewUUID()) name := "pod-update-" + string(uuid.NewUUID())
value := strconv.Itoa(time.Now().Nanosecond()) value := strconv.Itoa(time.Now().Nanosecond())
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Labels: map[string]string{ Labels: map[string]string{
@ -353,12 +353,12 @@ var _ = SIGDescribe("Pods", func() {
Spec: v1.PodSpec{ Spec: v1.PodSpec{
Containers: []v1.Container{ Containers: []v1.Container{
{ {
Name: "nginx", Name: "pause",
Image: imageutils.GetE2EImage(imageutils.Nginx), Image: imageutils.GetPauseImageName(),
}, },
}, },
}, },
} })
ginkgo.By("submitting the pod to kubernetes") ginkgo.By("submitting the pod to kubernetes")
pod = podClient.CreateSync(pod) pod = podClient.CreateSync(pod)
@ -396,7 +396,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("creating the pod") ginkgo.By("creating the pod")
name := "pod-update-activedeadlineseconds-" + string(uuid.NewUUID()) name := "pod-update-activedeadlineseconds-" + string(uuid.NewUUID())
value := strconv.Itoa(time.Now().Nanosecond()) value := strconv.Itoa(time.Now().Nanosecond())
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
Labels: map[string]string{ Labels: map[string]string{
@ -407,18 +407,18 @@ var _ = SIGDescribe("Pods", func() {
Spec: v1.PodSpec{ Spec: v1.PodSpec{
Containers: []v1.Container{ Containers: []v1.Container{
{ {
Name: "nginx", Name: "pause",
Image: imageutils.GetE2EImage(imageutils.Nginx), Image: imageutils.GetPauseImageName(),
}, },
}, },
}, },
} })
ginkgo.By("submitting the pod to kubernetes") ginkgo.By("submitting the pod to kubernetes")
podClient.CreateSync(pod) podClient.CreateSync(pod)
ginkgo.By("verifying the pod is in kubernetes") ginkgo.By("verifying the pod is in kubernetes")
selector := labels.SelectorFromSet(labels.Set(map[string]string{"time": value})) selector := labels.SelectorFromSet(labels.Set{"time": value})
options := metav1.ListOptions{LabelSelector: selector.String()} options := metav1.ListOptions{LabelSelector: selector.String()}
pods, err := podClient.List(context.TODO(), options) pods, err := podClient.List(context.TODO(), options)
framework.ExpectNoError(err, "failed to query for pods") framework.ExpectNoError(err, "failed to query for pods")
@ -442,7 +442,7 @@ var _ = SIGDescribe("Pods", func() {
// Make a pod that will be a service. // Make a pod that will be a service.
// This pod serves its hostname via HTTP. // This pod serves its hostname via HTTP.
serverName := "server-envvars-" + string(uuid.NewUUID()) serverName := "server-envvars-" + string(uuid.NewUUID())
serverPod := &v1.Pod{ serverPod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: serverName, Name: serverName,
Labels: map[string]string{"name": serverName}, Labels: map[string]string{"name": serverName},
@ -456,7 +456,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
podClient.CreateSync(serverPod) podClient.CreateSync(serverPod)
// This service exposes port 8080 of the test pod as a service on port 8765 // This service exposes port 8080 of the test pod as a service on port 8765
@ -490,7 +490,7 @@ var _ = SIGDescribe("Pods", func() {
// Make a client pod that verifies that it has the service environment variables. // Make a client pod that verifies that it has the service environment variables.
podName := "client-envvars-" + string(uuid.NewUUID()) podName := "client-envvars-" + string(uuid.NewUUID())
const containerName = "env3cont" const containerName = "env3cont"
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: podName, Name: podName,
Labels: map[string]string{"name": podName}, Labels: map[string]string{"name": podName},
@ -505,7 +505,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
RestartPolicy: v1.RestartPolicyNever, RestartPolicy: v1.RestartPolicyNever,
}, },
} })
// It's possible for the Pod to be created before the Kubelet is updated with the new // It's possible for the Pod to be created before the Kubelet is updated with the new
// service. In that case, we just retry. // service. In that case, we just retry.
@ -536,7 +536,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("creating the pod") ginkgo.By("creating the pod")
name := "pod-exec-websocket-" + string(uuid.NewUUID()) name := "pod-exec-websocket-" + string(uuid.NewUUID())
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
}, },
@ -549,7 +549,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
ginkgo.By("submitting the pod to kubernetes") ginkgo.By("submitting the pod to kubernetes")
pod = podClient.CreateSync(pod) pod = podClient.CreateSync(pod)
@ -618,7 +618,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("creating the pod") ginkgo.By("creating the pod")
name := "pod-logs-websocket-" + string(uuid.NewUUID()) name := "pod-logs-websocket-" + string(uuid.NewUUID())
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,
}, },
@ -631,7 +631,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
ginkgo.By("submitting the pod to kubernetes") ginkgo.By("submitting the pod to kubernetes")
podClient.CreateSync(pod) podClient.CreateSync(pod)
@ -673,7 +673,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.It("should have their auto-restart back-off timer reset on image update [Slow][NodeConformance]", func() { ginkgo.It("should have their auto-restart back-off timer reset on image update [Slow][NodeConformance]", func() {
podName := "pod-back-off-image" podName := "pod-back-off-image"
containerName := "back-off" containerName := "back-off"
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: podName, Name: podName,
Labels: map[string]string{"test": "back-off-image"}, Labels: map[string]string{"test": "back-off-image"},
@ -687,7 +687,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
delay1, delay2 := startPodAndGetBackOffs(podClient, pod, buildBackOffDuration) delay1, delay2 := startPodAndGetBackOffs(podClient, pod, buildBackOffDuration)
@ -714,7 +714,7 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.It("should cap back-off at MaxContainerBackOff [Slow][NodeConformance]", func() { ginkgo.It("should cap back-off at MaxContainerBackOff [Slow][NodeConformance]", func() {
podName := "back-off-cap" podName := "back-off-cap"
containerName := "back-off-cap" containerName := "back-off-cap"
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: podName, Name: podName,
Labels: map[string]string{"test": "liveness"}, Labels: map[string]string{"test": "liveness"},
@ -728,7 +728,7 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
podClient.CreateSync(pod) podClient.CreateSync(pod)
time.Sleep(2 * kubelet.MaxContainerBackOff) // it takes slightly more than 2*x to get to a back-off of x time.Sleep(2 * kubelet.MaxContainerBackOff) // it takes slightly more than 2*x to get to a back-off of x
@ -770,7 +770,7 @@ var _ = SIGDescribe("Pods", func() {
readinessGate1 := "k8s.io/test-condition1" readinessGate1 := "k8s.io/test-condition1"
readinessGate2 := "k8s.io/test-condition2" readinessGate2 := "k8s.io/test-condition2"
patchStatusFmt := `{"status":{"conditions":[{"type":%q, "status":%q}]}}` patchStatusFmt := `{"status":{"conditions":[{"type":%q, "status":%q}]}}`
pod := &v1.Pod{ pod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: podName, Name: podName,
Labels: map[string]string{"test": "pod-readiness-gate"}, Labels: map[string]string{"test": "pod-readiness-gate"},
@ -788,7 +788,7 @@ var _ = SIGDescribe("Pods", func() {
{ConditionType: v1.PodConditionType(readinessGate2)}, {ConditionType: v1.PodConditionType(readinessGate2)},
}, },
}, },
} })
validatePodReadiness := func(expectReady bool) { validatePodReadiness := func(expectReady bool) {
err := wait.Poll(time.Second, time.Minute, func() (bool, error) { err := wait.Poll(time.Second, time.Minute, func() (bool, error) {
@ -843,11 +843,13 @@ var _ = SIGDescribe("Pods", func() {
ginkgo.By("Create set of pods") ginkgo.By("Create set of pods")
// create a set of pods in test namespace // create a set of pods in test namespace
for _, podTestName := range podTestNames { for _, podTestName := range podTestNames {
_, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(context.TODO(), &v1.Pod{ _, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(context.TODO(),
e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: podTestName, Name: podTestName,
Labels: map[string]string{ Labels: map[string]string{
"type": "Testing"}, "type": "Testing",
},
}, },
Spec: v1.PodSpec{ Spec: v1.PodSpec{
TerminationGracePeriodSeconds: &one, TerminationGracePeriodSeconds: &one,
@ -856,7 +858,7 @@ var _ = SIGDescribe("Pods", func() {
Name: "token-test", Name: "token-test",
}}, }},
RestartPolicy: v1.RestartPolicyNever, RestartPolicy: v1.RestartPolicyNever,
}}, metav1.CreateOptions{}) }}), metav1.CreateOptions{})
framework.ExpectNoError(err, "failed to create pod") framework.ExpectNoError(err, "failed to create pod")
framework.Logf("created %v", podTestName) framework.Logf("created %v", podTestName)
} }
@ -903,7 +905,7 @@ var _ = SIGDescribe("Pods", func() {
podsList, err := f.ClientSet.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{LabelSelector: testPodLabelsFlat}) podsList, err := f.ClientSet.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{LabelSelector: testPodLabelsFlat})
framework.ExpectNoError(err, "failed to list Pods") framework.ExpectNoError(err, "failed to list Pods")
testPod := v1.Pod{ testPod := e2epod.MustMixinRestrictedPodSecurity(&v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: testPodName, Name: testPodName,
Labels: testPodLabels, Labels: testPodLabels,
@ -917,9 +919,9 @@ var _ = SIGDescribe("Pods", func() {
}, },
}, },
}, },
} })
ginkgo.By("creating a Pod with a static label") ginkgo.By("creating a Pod with a static label")
_, err = f.ClientSet.CoreV1().Pods(testNamespaceName).Create(context.TODO(), &testPod, metav1.CreateOptions{}) _, err = f.ClientSet.CoreV1().Pods(testNamespaceName).Create(context.TODO(), testPod, metav1.CreateOptions{})
framework.ExpectNoError(err, "failed to create Pod %v in namespace %v", testPod.ObjectMeta.Name, testNamespaceName) framework.ExpectNoError(err, "failed to create Pod %v in namespace %v", testPod.ObjectMeta.Name, testNamespaceName)
ginkgo.By("watching for Pod to be ready") ginkgo.By("watching for Pod to be ready")