github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 12:43:23 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #48858 from feiskyer/readonlyrootfs-test

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 46913, 48910, 48858, 47160)

Add e2e test for readOnlyRootFilesystem containers

**What this PR does / why we need it**:

This PR adds node e2e test for readOnlyRootFilesystem containers.

**Which issue this PR fixes**

Part of #44118.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
This commit is contained in:
Kubernetes Submit Queue 2017-07-25 23:00:33 -07:00 committed by GitHub
commit a5e1eac1f8
1 changed files with 60 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
test/e2e_node/security_context_test.go
View File

@ -313,6 +313,66 @@ var _ = framework.KubeDescribe("Security Context", func() {
It("should run the container with uid 0", func() { It("should run the container with uid 0", func() {
createAndWaitUserPod(0) createAndWaitUserPod(0)
}) })
})
Context("When creating a pod with readOnlyRootFilesystem", func() {
makeUserPod := func(podName, image string, command []string, readOnlyRootFilesystem bool) *v1.Pod {
return &v1.Pod{
ObjectMeta: metav1.ObjectMeta{
Name: podName,
},
Spec: v1.PodSpec{
RestartPolicy: v1.RestartPolicyNever,
Containers: []v1.Container{
{
Image: image,
Name: podName,
Command: command,
SecurityContext: &v1.SecurityContext{
ReadOnlyRootFilesystem: &readOnlyRootFilesystem,
},
},
},
},
}
}
createAndWaitUserPod := func(readOnlyRootFilesystem bool) string {
podName := fmt.Sprintf("busybox-readonly-%v-%s", readOnlyRootFilesystem, uuid.NewUUID())
podClient.Create(makeUserPod(podName,
"gcr.io/google_containers/busybox:1.24",
[]string{"sh", "-c", "touch checkfile && [ -f checkfile ] && echo Found || true"},
readOnlyRootFilesystem,
))
podClient.WaitForSuccess(podName, framework.PodStartTimeout)
return podName
}
It("should run the container with readonly rootfs when readOnlyRootFilesystem=true", func() {
podName := createAndWaitUserPod(true)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, podName, podName)
if err != nil {
framework.Failf("GetPodLogs for pod %q failed: %v", podName, err)
}
framework.Logf("Got logs for pod %q: %q", podName, logs)
if strings.Contains(logs, "Found") {
framework.Failf("readonly-rootfs container shouldn't be able to write files")
}
})
It("should run the container with writable rootfs when readOnlyRootFilesystem=false", func() {
podName := createAndWaitUserPod(false)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, podName, podName)
if err != nil {
framework.Failf("GetPodLogs for pod %q failed: %v", podName, err)
}
framework.Logf("Got logs for pod %q: %q", podName, logs)
if !strings.Contains(logs, "Found") {
framework.Failf("non-readonly-rootfs container should be able to write files")
}
})
}) })
}) })