Merge pull request #77534 from WanLinghao/psp_refactor

Refactor and clean up e2e framework utils, this patch handles test/e2e/framework/psp_util.go file

test/e2e/auth/BUILD

@@ -59,6 +59,7 @@ go_library(
         "//test/e2e/framework/log:go_default_library",
         "//test/e2e/framework/node:go_default_library",
         "//test/e2e/framework/pod:go_default_library",
+        "//test/e2e/framework/psp:go_default_library",
         "//test/utils:go_default_library",
         "//test/utils/image:go_default_library",
         "//vendor/github.com/evanphx/json-patch:go_default_library",

test/e2e/auth/pod_security_policy.go

@@ -35,6 +35,7 @@ import (
 	"k8s.io/kubernetes/test/e2e/framework"
 	"k8s.io/kubernetes/test/e2e/framework/auth"
 	e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
+	e2epsp "k8s.io/kubernetes/test/e2e/framework/psp"
 	imageutils "k8s.io/kubernetes/test/utils/image"
 	utilpointer "k8s.io/utils/pointer"
 
@@ -53,7 +54,7 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
 	var c clientset.Interface
 	var ns string // Test namespace, for convenience
 	ginkgo.BeforeEach(func() {
-		if !framework.IsPodSecurityPolicyEnabled(f) {
+		if !e2epsp.IsPodSecurityPolicyEnabled(f.ClientSet) {
 			framework.Skipf("PodSecurityPolicy not enabled")
 		}
 		if !auth.IsRBACEnabled(f.ClientSet.RbacV1()) {

test/e2e/framework/BUILD

@@ -19,7 +19,6 @@ go_library(
         "pods.go",
         "profile_gatherer.go",
         "provider.go",
-        "psp_util.go",
         "pv_util.go",
         "rc_util.go",
         "resource_usage_gatherer.go",
@@ -45,13 +44,11 @@ go_library(
         "//pkg/master/ports:go_default_library",
         "//pkg/scheduler/algorithm/predicates:go_default_library",
         "//pkg/scheduler/nodeinfo:go_default_library",
-        "//pkg/security/podsecuritypolicy/seccomp:go_default_library",
         "//pkg/util/system:go_default_library",
         "//pkg/util/taints:go_default_library",
         "//pkg/volume/util:go_default_library",
         "//staging/src/k8s.io/api/apps/v1:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
-        "//staging/src/k8s.io/api/policy/v1beta1:go_default_library",
         "//staging/src/k8s.io/api/rbac/v1:go_default_library",
         "//staging/src/k8s.io/api/storage/v1:go_default_library",
         "//staging/src/k8s.io/api/storage/v1beta1:go_default_library",
@@ -74,7 +71,6 @@ go_library(
         "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/yaml:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/watch:go_default_library",
-        "//staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
         "//staging/src/k8s.io/client-go/discovery:go_default_library",
         "//staging/src/k8s.io/client-go/discovery/cached/memory:go_default_library",
@@ -91,7 +87,6 @@ go_library(
         "//staging/src/k8s.io/client-go/tools/remotecommand:go_default_library",
         "//staging/src/k8s.io/client-go/tools/watch:go_default_library",
         "//staging/src/k8s.io/component-base/cli/flag:go_default_library",
-        "//test/e2e/framework/auth:go_default_library",
         "//test/e2e/framework/config:go_default_library",
         "//test/e2e/framework/ginkgowrapper:go_default_library",
         "//test/e2e/framework/kubelet:go_default_library",
@@ -99,6 +94,7 @@ go_library(
         "//test/e2e/framework/metrics:go_default_library",
         "//test/e2e/framework/node:go_default_library",
         "//test/e2e/framework/pod:go_default_library",
+        "//test/e2e/framework/psp:go_default_library",
         "//test/e2e/framework/resource:go_default_library",
         "//test/e2e/framework/ssh:go_default_library",
         "//test/e2e/framework/testfiles:go_default_library",
@@ -151,6 +147,7 @@ filegroup(
         "//test/e2e/framework/providers/kubemark:all-srcs",
         "//test/e2e/framework/providers/openstack:all-srcs",
         "//test/e2e/framework/providers/vsphere:all-srcs",
+        "//test/e2e/framework/psp:all-srcs",
         "//test/e2e/framework/replicaset:all-srcs",
         "//test/e2e/framework/resource:all-srcs",
         "//test/e2e/framework/service:all-srcs",

test/e2e/framework/framework.go

@@ -49,6 +49,7 @@ import (
 	e2elog "k8s.io/kubernetes/test/e2e/framework/log"
 	e2emetrics "k8s.io/kubernetes/test/e2e/framework/metrics"
 	e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
+	e2epsp "k8s.io/kubernetes/test/e2e/framework/psp"
 	testutils "k8s.io/kubernetes/test/utils"
 
 	"github.com/onsi/ginkgo"
@@ -406,7 +407,7 @@ func (f *Framework) CreateNamespace(baseName string, labels map[string]string) (
 	f.AddNamespacesToDelete(ns)
 
 	if err == nil && !f.SkipPrivilegedPSPBinding {
-		createPrivilegedPSPBinding(f, ns.Name)
+		e2epsp.CreatePrivilegedPSPBinding(f.ClientSet, ns.Name)
 	}
 
 	return ns, err

test/e2e/framework/psp/BUILD

@@ -0,0 +1,37 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["psp.go"],
+    importpath = "k8s.io/kubernetes/test/e2e/framework/psp",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/security/podsecuritypolicy/seccomp:go_default_library",
+        "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/api/policy/v1beta1:go_default_library",
+        "//staging/src/k8s.io/api/rbac/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes:go_default_library",
+        "//test/e2e/framework/auth:go_default_library",
+        "//test/e2e/framework/log:go_default_library",
+        "//vendor/github.com/onsi/ginkgo:go_default_library",
+        "//vendor/github.com/onsi/gomega:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

test/e2e/framework/psp/psp.go

@@ -27,11 +27,13 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/authentication/serviceaccount"
+	clientset "k8s.io/client-go/kubernetes"
 	"k8s.io/kubernetes/pkg/security/podsecuritypolicy/seccomp"
 	"k8s.io/kubernetes/test/e2e/framework/auth"
 	e2elog "k8s.io/kubernetes/test/e2e/framework/log"
 
 	"github.com/onsi/ginkgo"
+	"github.com/onsi/gomega"
 )
 
 const (
@@ -79,9 +81,9 @@ func privilegedPSP(name string) *policyv1beta1.PodSecurityPolicy {
 }
 
 // IsPodSecurityPolicyEnabled returns true if PodSecurityPolicy is enabled. Otherwise false.
-func IsPodSecurityPolicyEnabled(f *Framework) bool {
+func IsPodSecurityPolicyEnabled(kubeClient clientset.Interface) bool {
 	isPSPEnabledOnce.Do(func() {
-		psps, err := f.ClientSet.PolicyV1beta1().PodSecurityPolicies().List(metav1.ListOptions{})
+		psps, err := kubeClient.PolicyV1beta1().PodSecurityPolicies().List(metav1.ListOptions{})
 		if err != nil {
 			e2elog.Logf("Error listing PodSecurityPolicies; assuming PodSecurityPolicy is disabled: %v", err)
 			isPSPEnabled = false
@@ -100,13 +102,14 @@ var (
 	privilegedPSPOnce sync.Once
 )
 
-func createPrivilegedPSPBinding(f *Framework, namespace string) {
+// CreatePrivilegedPSPBinding creates the privileged PSP & role
-	if !IsPodSecurityPolicyEnabled(f) {
+func CreatePrivilegedPSPBinding(kubeClient clientset.Interface, namespace string) {
+	if !IsPodSecurityPolicyEnabled(kubeClient) {
 		return
 	}
 	// Create the privileged PSP & role
 	privilegedPSPOnce.Do(func() {
-		_, err := f.ClientSet.PolicyV1beta1().PodSecurityPolicies().Get(
+		_, err := kubeClient.PolicyV1beta1().PodSecurityPolicies().Get(
 			podSecurityPolicyPrivileged, metav1.GetOptions{})
 		if !apierrs.IsNotFound(err) {
 			// Privileged PSP was already created.
@@ -115,14 +118,14 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) {
 		}
 
 		psp := privilegedPSP(podSecurityPolicyPrivileged)
-		psp, err = f.ClientSet.PolicyV1beta1().PodSecurityPolicies().Create(psp)
+		psp, err = kubeClient.PolicyV1beta1().PodSecurityPolicies().Create(psp)
 		if !apierrs.IsAlreadyExists(err) {
 			ExpectNoError(err, "Failed to create PSP %s", podSecurityPolicyPrivileged)
 		}
 
-		if auth.IsRBACEnabled(f.ClientSet.RbacV1()) {
+		if auth.IsRBACEnabled(kubeClient.RbacV1()) {
 			// Create the Role to bind it to the namespace.
-			_, err = f.ClientSet.RbacV1().ClusterRoles().Create(&rbacv1.ClusterRole{
+			_, err = kubeClient.RbacV1().ClusterRoles().Create(&rbacv1.ClusterRole{
 				ObjectMeta: metav1.ObjectMeta{Name: podSecurityPolicyPrivileged},
 				Rules: []rbacv1.PolicyRule{{
 					APIGroups:     []string{"extensions"},
@@ -137,10 +140,10 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) {
 		}
 	})
 
-	if auth.IsRBACEnabled(f.ClientSet.RbacV1()) {
+	if auth.IsRBACEnabled(kubeClient.RbacV1()) {
 		ginkgo.By(fmt.Sprintf("Binding the %s PodSecurityPolicy to the default service account in %s",
 			podSecurityPolicyPrivileged, namespace))
-		err := auth.BindClusterRoleInNamespace(f.ClientSet.RbacV1(),
+		err := auth.BindClusterRoleInNamespace(kubeClient.RbacV1(),
 			podSecurityPolicyPrivileged,
 			namespace,
 			rbacv1.Subject{
@@ -149,8 +152,16 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) {
 				Name:      "default",
 			})
 		ExpectNoError(err)
-		ExpectNoError(auth.WaitForNamedAuthorizationUpdate(f.ClientSet.AuthorizationV1(),
+		ExpectNoError(auth.WaitForNamedAuthorizationUpdate(kubeClient.AuthorizationV1(),
 			serviceaccount.MakeUsername(namespace, "default"), namespace, "use", podSecurityPolicyPrivileged,
 			schema.GroupResource{Group: "extensions", Resource: "podsecuritypolicies"}, true))
 	}
 }
+
+// ExpectNoError is a copy from the same name function in file test/e2e/framework.go
+func ExpectNoError(err error, explain ...interface{}) {
+	if err != nil {
+		e2elog.Logf("Unexpected error occurred: %v", err)
+	}
+	gomega.ExpectWithOffset(2, err).NotTo(gomega.HaveOccurred(), explain...)
+}