github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

PSA: small cleanups for tests that use RelaxPolicyForUserNamespacePods

Browse Source 
make sure to cleanup after setting RelaxPolicyForUserNamespacePods
setup test variables to be a little more terse and similar between tests
cleanup Allowed checking

Signed-off-by: Peter Hunt <pehunt@redhat.com>
This commit is contained in:
Peter Hunt 2024-07-23 11:59:53 -04:00
parent 17521f04a4
commit 7e750a62a1
2 changed files with 39 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
staging/src/k8s.io/pod-security-admission/policy/check_runAsNonRoot_test.go
View File

@ -25,12 +25,12 @@ import (
func TestRunAsNonRoot(t *testing.T) { func TestRunAsNonRoot(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
pod *corev1.Pod pod *corev1.Pod
expectReason string expectReason string
expectDetail string expectDetail string
allowed bool expectAllowed bool
enableUserNamespacesPodSecurityStandards bool relaxForUserNS bool
}{ }{
{ {
name: "no explicit runAsNonRoot", name: "no explicit runAsNonRoot",
@ -87,8 +87,8 @@ func TestRunAsNonRoot(t *testing.T) {
pod: &corev1.Pod{Spec: corev1.PodSpec{ pod: &corev1.Pod{Spec: corev1.PodSpec{
HostUsers: utilpointer.Bool(false), HostUsers: utilpointer.Bool(false),
}}, }},
allowed: true, expectAllowed: true,
enableUserNamespacesPodSecurityStandards: true, relaxForUserNS: true,
}, },
{ {
name: "UserNamespacesPodSecurityStandards enabled with HostUsers", name: "UserNamespacesPodSecurityStandards enabled with HostUsers",
@ -98,21 +98,24 @@ func TestRunAsNonRoot(t *testing.T) {
}, },
HostUsers: utilpointer.Bool(true), HostUsers: utilpointer.Bool(true),
}}, }},
expectReason: `runAsNonRoot != true`, expectReason: `runAsNonRoot != true`,
expectDetail: `pod or container "a" must set securityContext.runAsNonRoot=true`, expectDetail: `pod or container "a" must set securityContext.runAsNonRoot=true`,
allowed: false, expectAllowed: false,
enableUserNamespacesPodSecurityStandards: true, relaxForUserNS: true,
}, },
} }
for _, tc := range tests { for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
if tc.enableUserNamespacesPodSecurityStandards { if tc.relaxForUserNS {
RelaxPolicyForUserNamespacePods(true) RelaxPolicyForUserNamespacePods(true)
t.Cleanup(func() {
RelaxPolicyForUserNamespacePods(false)
})
} }
result := runAsNonRoot_1_0(&tc.pod.ObjectMeta, &tc.pod.Spec) result := runAsNonRoot_1_0(&tc.pod.ObjectMeta, &tc.pod.Spec)
if result.Allowed && !tc.allowed { if result.Allowed != tc.expectAllowed {
t.Fatal("expected disallowed") t.Fatalf("expected Allowed to be %v was %v", tc.expectAllowed, result.Allowed)
} }
if e, a := tc.expectReason, result.ForbiddenReason; e != a { if e, a := tc.expectReason, result.ForbiddenReason; e != a {
t.Errorf("expected\n%s\ngot\n%s", e, a) t.Errorf("expected\n%s\ngot\n%s", e, a)

45
staging/src/k8s.io/pod-security-admission/policy/check_runAsUser_test.go
View File

@ -25,12 +25,12 @@ import (
func TestRunAsUser(t *testing.T) { func TestRunAsUser(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
pod *corev1.Pod pod *corev1.Pod
expectAllow bool expectAllowed bool
expectReason string expectReason string
expectDetail string expectDetail string
enableUserNamespacesPodSecurityStandards bool relaxForUserNS bool
}{ }{
{ {
name: "pod runAsUser=0", name: "pod runAsUser=0",
@ -51,7 +51,7 @@ func TestRunAsUser(t *testing.T) {
{Name: "a", SecurityContext: nil}, {Name: "a", SecurityContext: nil},
}, },
}}, }},
expectAllow: true, expectAllowed: true,
}, },
{ {
name: "pod runAsUser=nil", name: "pod runAsUser=nil",
@ -61,7 +61,7 @@ func TestRunAsUser(t *testing.T) {
{Name: "a", SecurityContext: nil}, {Name: "a", SecurityContext: nil},
}, },
}}, }},
expectAllow: true, expectAllowed: true,
}, },
{ {
name: "containers runAsUser=0", name: "containers runAsUser=0",
@ -89,15 +89,15 @@ func TestRunAsUser(t *testing.T) {
{Name: "f", SecurityContext: &corev1.SecurityContext{RunAsUser: utilpointer.Int64(4)}}, {Name: "f", SecurityContext: &corev1.SecurityContext{RunAsUser: utilpointer.Int64(4)}},
}, },
}}, }},
expectAllow: true, expectAllowed: true,
}, },
{ {
name: "UserNamespacesPodSecurityStandards enabled without HostUsers", name: "UserNamespacesPodSecurityStandards enabled without HostUsers",
pod: &corev1.Pod{Spec: corev1.PodSpec{ pod: &corev1.Pod{Spec: corev1.PodSpec{
HostUsers: utilpointer.Bool(false), HostUsers: utilpointer.Bool(false),
}}, }},
expectAllow: true, expectAllowed: true,
enableUserNamespacesPodSecurityStandards: true, relaxForUserNS: true,
}, },
{ {
name: "UserNamespacesPodSecurityStandards enabled with HostUsers", name: "UserNamespacesPodSecurityStandards enabled with HostUsers",
@ -108,27 +108,24 @@ func TestRunAsUser(t *testing.T) {
}, },
HostUsers: utilpointer.Bool(true), HostUsers: utilpointer.Bool(true),
}}, }},
expectAllow: false, expectAllowed: false,
expectReason: `runAsUser=0`, expectReason: `runAsUser=0`,
expectDetail: `pod must not set runAsUser=0`, expectDetail: `pod must not set runAsUser=0`,
enableUserNamespacesPodSecurityStandards: true, relaxForUserNS: true,
}, },
} }
for _, tc := range tests { for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
if tc.enableUserNamespacesPodSecurityStandards { if tc.relaxForUserNS {
RelaxPolicyForUserNamespacePods(true) RelaxPolicyForUserNamespacePods(true)
t.Cleanup(func() {
RelaxPolicyForUserNamespacePods(false)
})
} }
result := runAsUser_1_23(&tc.pod.ObjectMeta, &tc.pod.Spec) result := runAsUser_1_23(&tc.pod.ObjectMeta, &tc.pod.Spec)
if tc.expectAllow { if result.Allowed != tc.expectAllowed {
if !result.Allowed { t.Fatalf("expected Allowed to be %v was %v", tc.expectAllowed, result.Allowed)
t.Fatalf("expected to be allowed, disallowed: %s, %s", result.ForbiddenReason, result.ForbiddenDetail)
}
return
}
if result.Allowed {
t.Fatal("expected disallowed")
} }
if e, a := tc.expectReason, result.ForbiddenReason; e != a { if e, a := tc.expectReason, result.ForbiddenReason; e != a {
t.Errorf("expected\n%s\ngot\n%s", e, a) t.Errorf("expected\n%s\ngot\n%s", e, a)