github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-03 09:22:44 +00:00
Code Issues Projects Releases Wiki Activity

Fix kubelet_authz_test.go

Browse Source
This commit is contained in:
Vinayak Goyal 2025-01-29 21:29:39 +00:00
parent f05b5dddb8
commit ce7d2130ad
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
test/e2e_node/kubelet_authz_test.go
View File

@ -60,6 +60,9 @@ func runKubeletAuthzTest(ctx context.Context, f *framework.Framework, endpoint,
crName := authzSubresource crName := authzSubresource
verb := "get" verb := "get"
resource := "nodes" resource := "nodes"
ginkgo.By(fmt.Sprintf("Creating Service Account:%s/%s", ns, saName))
_, err := f.ClientSet.CoreV1().ServiceAccounts(ns).Create(ctx, &v1.ServiceAccount{ _, err := f.ClientSet.CoreV1().ServiceAccounts(ns).Create(ctx, &v1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: saName, Name: saName,
@ -68,12 +71,15 @@ func runKubeletAuthzTest(ctx context.Context, f *framework.Framework, endpoint,
}, metav1.CreateOptions{}) }, metav1.CreateOptions{})
framework.ExpectNoError(err) framework.ExpectNoError(err)
ginkgo.By(fmt.Sprintf("Creating ClusterRole %s with for %s/%s", crName, resource, authzSubresource))
_, err = f.ClientSet.RbacV1().ClusterRoles().Create(ctx, &rbacv1.ClusterRole{ _, err = f.ClientSet.RbacV1().ClusterRoles().Create(ctx, &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: crName, Name: crName,
}, },
Rules: []rbacv1.PolicyRule{ Rules: []rbacv1.PolicyRule{
{ {
APIGroups: []string{""},
Verbs: []string{verb}, Verbs: []string{verb},
Resources: []string{resource + "/" + authzSubresource}, Resources: []string{resource + "/" + authzSubresource},
}, },
@ -87,9 +93,13 @@ func runKubeletAuthzTest(ctx context.Context, f *framework.Framework, endpoint,
Name: saName, Name: saName,
} }
ginkgo.By(fmt.Sprintf("Creating ClusterRoleBinding with ClusterRole %s with subject %s/%s", crName, ns, saName))
err = e2eauth.BindClusterRole(ctx, f.ClientSet.RbacV1(), crName, ns, subject) err = e2eauth.BindClusterRole(ctx, f.ClientSet.RbacV1(), crName, ns, subject)
framework.ExpectNoError(err) framework.ExpectNoError(err)
ginkgo.By("Waiting for Authorization Update.")
err = e2eauth.WaitForAuthzUpdate(ctx, f.ClientSet.AuthorizationV1(), err = e2eauth.WaitForAuthzUpdate(ctx, f.ClientSet.AuthorizationV1(),
serviceaccount.MakeUsername(ns, saName), serviceaccount.MakeUsername(ns, saName),
&authorizationv1.ResourceAttributes{ &authorizationv1.ResourceAttributes{
@ -102,6 +112,8 @@ func runKubeletAuthzTest(ctx context.Context, f *framework.Framework, endpoint,
) )
framework.ExpectNoError(err) framework.ExpectNoError(err)
ginkgo.By(fmt.Sprintf("Getting token for ServiceAccount %s/%s.", ns, saName))
tr, err := f.ClientSet.CoreV1().ServiceAccounts(ns).CreateToken(ctx, saName, &authenticationv1.TokenRequest{}, metav1.CreateOptions{}) tr, err := f.ClientSet.CoreV1().ServiceAccounts(ns).CreateToken(ctx, saName, &authenticationv1.TokenRequest{}, metav1.CreateOptions{})
framework.ExpectNoError(err) framework.ExpectNoError(err)