github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-31 07:20:13 +00:00
Code Issues Projects Releases Wiki Activity

Move privileged and kubelet_etc_hosts into common directory.

Browse Source
This commit is contained in:
Random-Liu 2016-07-23 22:04:52 -07:00
parent 268f458ea4
commit 749e0d0d72
4 changed files with 16 additions and 297 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
test/e2e/kubelet_etc_hosts.go → test/e2e/common/kubelet_etc_hosts.go
View File

@ -1,5 +1,5 @@
/*
Copyright 2014 The Kubernetes Authors.
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@ -14,16 +14,13 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e
package common
import (
"fmt"
"strings"
. "github.com/onsi/ginkgo"
api "k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/unversioned"
"k8s.io/kubernetes/pkg/apimachinery/registered"
"k8s.io/kubernetes/test/e2e/framework"
)
@ -106,32 +103,13 @@ func assertEtcHostsIsNotKubeletManaged(etcHostsContent string) {
}
func (config *KubeletManagedHostConfig) getEtcHostsContent(podName, containerName string) string {
cmd := framework.KubectlCmd("exec", fmt.Sprintf("--namespace=%v", config.f.Namespace.Name), podName, "-c", containerName, "cat", "/etc/hosts")
stdout, stderr, err := framework.StartCmdAndStreamOutput(cmd)
if err != nil {
framework.Failf("Failed to retrieve /etc/hosts, err: %q", err)
}
defer stdout.Close()
defer stderr.Close()
buf := make([]byte, 1000)
var n int
framework.Logf("reading from `kubectl exec` command's stdout")
if n, err = stdout.Read(buf); err != nil {
framework.Failf("Failed to read from kubectl exec stdout: %v", err)
}
return string(buf[:n])
return config.f.ExecCommandInContainer(podName, containerName, "cat", "/etc/hosts")
}
func (config *KubeletManagedHostConfig) createPodSpec(podName string) *api.Pod {
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: podName,
Namespace: config.f.Namespace.Name,
Name: podName,
},
Spec: api.PodSpec{
Containers: []api.Container{
@ -186,13 +164,8 @@ func (config *KubeletManagedHostConfig) createPodSpec(podName string) *api.Pod {
func (config *KubeletManagedHostConfig) createPodSpecWithHostNetwork(podName string) *api.Pod {
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: podName,
Namespace: config.f.Namespace.Name,
Name: podName,
},
Spec: api.PodSpec{
SecurityContext: &api.PodSecurityContext{

44
test/e2e/privileged.go → test/e2e/common/privileged.go
View File

@ -1,5 +1,5 @@
/*
Copyright 2015 The Kubernetes Authors.
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e
package common
import (
"encoding/json"
@ -24,9 +24,6 @@ import (
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/unversioned"
"k8s.io/kubernetes/pkg/apimachinery/registered"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/test/e2e/framework"
)
@ -54,7 +51,8 @@ var _ = framework.KubeDescribe("PrivilegedPod", func() {
f: f,
}
It("should test privileged pod", func() {
config.hostExecPod = framework.LaunchHostExecPod(config.f.Client, config.f.Namespace.Name, "hostexec")
By("Creating a hostexec pod")
config.createHostExecPod()
By("Creating a privileged pod")
config.createPrivilegedPod()
@ -90,7 +88,7 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con
v.Encode())
By(fmt.Sprintf("Exec-ing into container over http. Running command:%s", cmd))
stdout := framework.RunHostCmdOrDie(config.hostExecPod.Namespace, config.hostExecPod.Name, cmd)
stdout := config.f.ExecShellInPod(config.hostExecPod.Name, cmd)
var output map[string]string
err := json.Unmarshal([]byte(stdout), &output)
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Could not unmarshal curl response: %s", stdout))
@ -102,10 +100,6 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
isPrivileged := true
notPrivileged := false
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: privilegedPodName,
Namespace: config.f.Namespace.Name,
@ -140,28 +134,12 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
return pod
}
func (config *PrivilegedPodTestConfig) createHostExecPod() {
podSpec := framework.NewHostExecPodSpec(config.f.Namespace.Name, "hostexec")
config.hostExecPod = config.f.PodClient().CreateSync(podSpec)
}
func (config *PrivilegedPodTestConfig) createPrivilegedPod() {
podSpec := config.createPrivilegedPodSpec()
config.privilegedPod = config.createPod(podSpec)
}
func (config *PrivilegedPodTestConfig) createPod(pod *api.Pod) *api.Pod {
createdPod, err := config.getPodClient().Create(pod)
if err != nil {
framework.Failf("Failed to create %q pod: %v", pod.Name, err)
}
framework.ExpectNoError(config.f.WaitForPodRunning(pod.Name))
createdPod, err = config.getPodClient().Get(pod.Name)
if err != nil {
framework.Failf("Failed to retrieve %q pod: %v", pod.Name, err)
}
return createdPod
}
func (config *PrivilegedPodTestConfig) getPodClient() client.PodInterface {
return config.f.Client.Pods(config.f.Namespace.Name)
}
func (config *PrivilegedPodTestConfig) getNamespaceClient() client.NamespaceInterface {
return config.f.Client.Namespaces()
config.privilegedPod = config.f.PodClient().CreateSync(podSpec)
}

70
test/e2e_node/exec_util.go
View File

@ -1,70 +0,0 @@
/*
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e_node
import (
"bytes"
"io"
"net/url"
"strings"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/client/restclient"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/pkg/client/unversioned/remotecommand"
remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand"
)
func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error {
exec, err := remotecommand.NewExecutor(config, method, url)
if err != nil {
return err
}
return exec.Stream(remotecommand.StreamOptions{
SupportedProtocols: remotecommandserver.SupportedStreamingProtocols,
Stdin: stdin,
Stdout: stdout,
Stderr: stderr,
Tty: tty,
})
}
func execCommandInContainer(config *restclient.Config, c *client.Client, ns, podName, containerName string, cmd []string) (string, error) {
var stdout, stderr bytes.Buffer
var stdin io.Reader
tty := false
req := c.RESTClient.Post().
Resource("pods").
Name(podName).
Namespace(ns).
SubResource("exec").
Param("container", containerName)
req.VersionedParams(&api.PodExecOptions{
Container: containerName,
Command: cmd,
Stdin: false,
Stdout: true,
Stderr: true,
TTY: tty,
}, api.ParameterCodec)
err := execute("POST", req.URL(), config, stdin, &stdout, &stderr, tty)
if err != nil {
return "", err
}
return strings.TrimSpace(stdout.String()), nil
}

162
test/e2e_node/privileged_test.go
View File

@ -1,162 +0,0 @@
/*
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e_node
import (
"encoding/json"
"fmt"
"net/url"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/client/restclient"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/test/e2e/framework"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
)
// TODO: This test was ported from test/e2e/privileged.go. We should
// re-evaluate the need of testing the feature in both suites.
const (
privilegedPodName = "privileged-pod"
privilegedContainerName = "privileged-container"
privilegedHttpPort = 8080
privilegedUdpPort = 8081
notPrivilegedHttpPort = 9090
notPrivilegedUdpPort = 9091
notPrivilegedContainerName = "not-privileged-container"
privilegedCommand = "ip link add dummy1 type dummy"
)
type PrivilegedPodTestConfig struct {
config *restclient.Config
client *client.Client
namespace string
hostExecPod *api.Pod
privilegedPod *api.Pod
}
// TODO(random-liu): Change the test to use framework and framework pod client.
var _ = Describe("PrivilegedPod", func() {
f := framework.NewDefaultFramework("privileged-pod")
It("should test privileged pod", func() {
config := &PrivilegedPodTestConfig{
client: f.Client,
config: &restclient.Config{Host: framework.TestContext.Host},
namespace: f.Namespace.Name,
}
By("Creating a host exec pod")
config.hostExecPod = f.PodClient().CreateSync(newHostExecPodSpec("hostexec"))
By("Creating a privileged pod")
config.privilegedPod = f.PodClient().CreateSync(config.createPrivilegedPodSpec())
By("Executing privileged command on privileged container")
config.runPrivilegedCommandOnPrivilegedContainer()
By("Executing privileged command on non-privileged container")
config.runPrivilegedCommandOnNonPrivilegedContainer()
})
})
func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
isPrivileged := true
notPrivileged := false
pod := &api.Pod{
ObjectMeta: api.ObjectMeta{
Name: privilegedPodName,
},
Spec: api.PodSpec{
Containers: []api.Container{
{
Name: privilegedContainerName,
Image: ImageRegistry[netExecImage],
ImagePullPolicy: api.PullIfNotPresent,
SecurityContext: &api.SecurityContext{Privileged: &isPrivileged},
Command: []string{
"/netexec",
fmt.Sprintf("--http-port=%d", privilegedHttpPort),
fmt.Sprintf("--udp-port=%d", privilegedUdpPort),
},
},
{
Name: notPrivilegedContainerName,
Image: ImageRegistry[netExecImage],
ImagePullPolicy: api.PullIfNotPresent,
SecurityContext: &api.SecurityContext{Privileged: &notPrivileged},
Command: []string{
"/netexec",
fmt.Sprintf("--http-port=%d", notPrivilegedHttpPort),
fmt.Sprintf("--udp-port=%d", notPrivilegedUdpPort),
},
},
},
},
}
return pod
}
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnPrivilegedContainer() {
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, privilegedHttpPort)
Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap))
}
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnNonPrivilegedContainer() {
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, notPrivilegedHttpPort)
Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap))
}
func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, containerHttpPort int) map[string]string {
v := url.Values{}
v.Set("shellCommand", "ip link add dummy1 type dummy")
cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'",
containerIP,
containerHttpPort,
v.Encode())
By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd))
stdout, err := execCommandInContainer(config.config, config.client, config.namespace, config.hostExecPod.Name, config.hostExecPod.Spec.Containers[0].Name,
[]string{"/bin/sh", "-c", cmd})
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err))
var output map[string]string
err = json.Unmarshal([]byte(stdout), &output)
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Could not unmarshal curl response: %s", stdout))
return output
}
// newHostExecPodSpec returns the pod spec of hostexec pod
func newHostExecPodSpec(name string) *api.Pod {
return &api.Pod{
ObjectMeta: api.ObjectMeta{
Name: name,
},
Spec: api.PodSpec{
Containers: []api.Container{
{
Name: "hostexec",
Image: ImageRegistry[hostExecImage],
ImagePullPolicy: api.PullIfNotPresent,
},
},
SecurityContext: &api.PodSecurityContext{
HostNetwork: true,
},
},
}
}