github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

Run GCE unit tests as non-root

Browse Source
This commit is contained in:
Maciej Szulik 2021-03-18 12:14:02 +01:00
parent 0c6d922812
commit a3a26171d1
No known key found for this signature in database
GPG Key ID: F15E55D276FA84C4
4 changed files with 29 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cluster/gce/gci/apiserver_etcd_test.go
View File

@ -17,12 +17,15 @@ limitations under the License.
package gci
import (
"os"
"strconv"
"strings"
"testing"
)
type kubeAPIServeETCDEnv struct {
KubeHome string
KubeAPIServerRunAsUser string
ETCDServers string
ETCDServersOverride string
CAKey string
@ -68,6 +71,7 @@ func TestServerOverride(t *testing.T) {
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
defer c.tearDown()
tc.env.KubeHome = c.kubeHome
tc.env.KubeAPIServerRunAsUser = strconv.Itoa(os.Getuid())
c.mustInvokeFunc(
tc.env,
@ -124,6 +128,7 @@ func TestStorageOptions(t *testing.T) {
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
defer c.tearDown()
tc.env.KubeHome = c.kubeHome
tc.env.KubeAPIServerRunAsUser = strconv.Itoa(os.Getuid())
c.mustInvokeFunc(
tc.env,
@ -188,6 +193,7 @@ func TestTLSFlags(t *testing.T) {
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
defer c.tearDown()
tc.env.KubeHome = c.kubeHome
tc.env.KubeAPIServerRunAsUser = strconv.Itoa(os.Getuid())
c.mustInvokeFunc(
tc.env,

5
cluster/gce/gci/apiserver_kms_test.go
View File

@ -24,6 +24,7 @@ import (
"os"
"path/filepath"
"reflect"
"strconv"
"strings"
"testing"
@ -38,6 +39,7 @@ const (
type kubeAPIServerEnv struct {
KubeHome string
KubeAPIServerRunAsUser string
EncryptionProviderConfigPath string
EncryptionProviderConfig string
CloudKMSIntegration bool
@ -72,6 +74,7 @@ func TestEncryptionProviderFlag(t *testing.T) {
e := kubeAPIServerEnv{
KubeHome: c.kubeHome,
KubeAPIServerRunAsUser: strconv.Itoa(os.Getuid()),
EncryptionProviderConfigPath: filepath.Join(c.kubeHome, "encryption-provider-config.yaml"),
EncryptionProviderConfig: tc.encryptionProviderConfig,
}
@ -107,6 +110,7 @@ func TestEncryptionProviderConfig(t *testing.T) {
p := filepath.Join(c.kubeHome, "encryption-provider-config.yaml")
e := kubeAPIServerEnv{
KubeHome: c.kubeHome,
KubeAPIServerRunAsUser: strconv.Itoa(os.Getuid()),
EncryptionProviderConfigPath: p,
EncryptionProviderConfig: base64.StdEncoding.EncodeToString([]byte("foo")),
}
@ -177,6 +181,7 @@ func TestKMSIntegration(t *testing.T) {
var e = kubeAPIServerEnv{
KubeHome: c.kubeHome,
KubeAPIServerRunAsUser: strconv.Itoa(os.Getuid()),
EncryptionProviderConfigPath: filepath.Join(c.kubeHome, "encryption-provider-config.yaml"),
EncryptionProviderConfig: base64.StdEncoding.EncodeToString([]byte("foo")),
CloudKMSIntegration: tc.cloudKMSIntegration,

1
cluster/gce/gci/testdata/kube-apiserver/etcd.template vendored
View File

@ -13,3 +13,4 @@ readonly ETCD_SERVERS_OVERRIDES={{.ETCDServersOverride}}
readonly STORAGE_BACKEND={{.StorageBackend}}
readonly STORAGE_MEDIA_TYPE={{.StorageMediaType}}
readonly ETCD_COMPACTION_INTERVAL_SEC={{.CompactionInterval}}
readonly KUBE_API_SERVER_RUNASUSER={{.KubeAPIServerRunAsUser}}

1
cluster/gce/gci/testdata/kube-apiserver/kms.template vendored
View File

@ -6,3 +6,4 @@ ENCRYPTION_PROVIDER_CONFIG_PATH={{.EncryptionProviderConfigPath}}
{{if .CloudKMSIntegration}}
readonly CLOUD_KMS_INTEGRATION=true
{{end}}
readonly KUBE_API_SERVER_RUNASUSER={{.KubeAPIServerRunAsUser}}