github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 04:54:54 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #132741 from PatrickLaabs/132086-podsecadmission-test

Browse Source 
chore: depr. pointer pkg replacement for psa tests
This commit is contained in:
Kubernetes Prow Robot
2025-07-05 18:59:31 -07:00
committed by GitHub
parent aeb7a8bc19 dc947510da
commit d9228cae97
6 changed files with 30 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
staging/src/k8s.io/pod-security-admission/test/fixtures.go
View File

@@ -23,7 +23,7 @@ import (
"k8s.io/component-base/featuregate"
"k8s.io/pod-security-admission/api"
"k8s.io/pod-security-admission/policy"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
// minimalValidPods holds minimal valid OS neutral pods per-level per-version.
@@ -70,7 +70,7 @@ func init() {
// 1.0+: baseline + runAsNonRoot=true
restricted_1_0 := tweak(baseline_1_0, func(p *corev1.Pod) {
p.Spec.SecurityContext = &corev1.PodSecurityContext{RunAsNonRoot: pointer.BoolPtr(true)}
p.Spec.SecurityContext = &corev1.PodSecurityContext{RunAsNonRoot: ptr.To(true)}
})
minimalValidPods[api.LevelRestricted][api.MajorMinorVersion(1, 0)] = restricted_1_0
minimalValidLinuxPods[api.LevelRestricted][api.MajorMinorVersion(1, 0)] = addLinux(restricted_1_0)
@@ -78,8 +78,8 @@ func init() {
// 1.8+: allowPrivilegeEscalation=false
restricted_1_8 := tweak(restricted_1_0, func(p *corev1.Pod) {
p.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: pointer.BoolPtr(false)}
p.Spec.InitContainers[0].SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: pointer.BoolPtr(false)}
p.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: ptr.To(false)}
p.Spec.InitContainers[0].SecurityContext = &corev1.SecurityContext{AllowPrivilegeEscalation: ptr.To(false)}
})
minimalValidPods[api.LevelRestricted][api.MajorMinorVersion(1, 8)] = restricted_1_8
minimalValidLinuxPods[api.LevelRestricted][api.MajorMinorVersion(1, 8)] = addLinux(restricted_1_8)

6
staging/src/k8s.io/pod-security-admission/test/fixtures_allowPrivilegeEscalation.go
View File

@@ -19,7 +19,7 @@ package test
import (
corev1 "k8s.io/api/core/v1"
"k8s.io/pod-security-admission/api"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
/*
@@ -44,11 +44,11 @@ func init() {
return []*corev1.Pod{
// explicit true
tweak(p, func(p *corev1.Pod) {
p.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = pointer.BoolPtr(true)
p.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(true)
}),
// ensure initContainers are checked
tweak(p, func(p *corev1.Pod) {
p.Spec.InitContainers[0].SecurityContext.AllowPrivilegeEscalation = pointer.BoolPtr(true)
p.Spec.InitContainers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(true)
}),
// nil AllowPrivilegeEscalation
tweak(p, func(p *corev1.Pod) { p.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil }),

10
staging/src/k8s.io/pod-security-admission/test/fixtures_privileged.go
View File

@@ -19,7 +19,7 @@ package test
import (
corev1 "k8s.io/api/core/v1"
"k8s.io/pod-security-admission/api"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
/*
@@ -38,8 +38,8 @@ func init() {
return []*corev1.Pod{
// privileged explicitly set to false
tweak(p, func(p *corev1.Pod) {
p.Spec.Containers[0].SecurityContext.Privileged = pointer.BoolPtr(false)
p.Spec.InitContainers[0].SecurityContext.Privileged = pointer.BoolPtr(false)
p.Spec.Containers[0].SecurityContext.Privileged = ptr.To(false)
p.Spec.InitContainers[0].SecurityContext.Privileged = ptr.To(false)
}),
}
},
@@ -48,12 +48,12 @@ func init() {
return []*corev1.Pod{
// privileged set to true in container
tweak(p, func(p *corev1.Pod) {
p.Spec.Containers[0].SecurityContext.Privileged = pointer.BoolPtr(true)
p.Spec.Containers[0].SecurityContext.Privileged = ptr.To(true)
p.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil
}),
// privileged set to true in init container
tweak(p, func(p *corev1.Pod) {
p.Spec.InitContainers[0].SecurityContext.Privileged = pointer.BoolPtr(true)
p.Spec.InitContainers[0].SecurityContext.Privileged = ptr.To(true)
p.Spec.InitContainers[0].SecurityContext.AllowPrivilegeEscalation = nil
}),
}

14
staging/src/k8s.io/pod-security-admission/test/fixtures_runAsNonRoot.go
View File

@@ -19,7 +19,7 @@ package test
import (
corev1 "k8s.io/api/core/v1"
"k8s.io/pod-security-admission/api"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
/*
@@ -42,15 +42,15 @@ func init() {
return []*corev1.Pod{
// set at pod level
tweak(p, func(p *corev1.Pod) {
p.Spec.SecurityContext.RunAsNonRoot = pointer.BoolPtr(true)
p.Spec.SecurityContext.RunAsNonRoot = ptr.To(true)
p.Spec.Containers[0].SecurityContext.RunAsNonRoot = nil
p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = nil
}),
// set on all containers
tweak(p, func(p *corev1.Pod) {
p.Spec.SecurityContext.RunAsNonRoot = nil
p.Spec.Containers[0].SecurityContext.RunAsNonRoot = pointer.BoolPtr(true)
p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = pointer.BoolPtr(true)
p.Spec.Containers[0].SecurityContext.RunAsNonRoot = ptr.To(true)
p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = ptr.To(true)
}),
}
},
@@ -64,10 +64,10 @@ func init() {
p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = nil
}),
// explicit false on pod
tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.RunAsNonRoot = pointer.BoolPtr(false) }),
tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.RunAsNonRoot = ptr.To(false) }),
// explicit false on containers
tweak(p, func(p *corev1.Pod) { p.Spec.Containers[0].SecurityContext.RunAsNonRoot = pointer.BoolPtr(false) }),
tweak(p, func(p *corev1.Pod) { p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = pointer.BoolPtr(false) }),
tweak(p, func(p *corev1.Pod) { p.Spec.Containers[0].SecurityContext.RunAsNonRoot = ptr.To(false) }),
tweak(p, func(p *corev1.Pod) { p.Spec.InitContainers[0].SecurityContext.RunAsNonRoot = ptr.To(false) }),
}
},
}

14
staging/src/k8s.io/pod-security-admission/test/fixtures_runAsUser.go
View File

@@ -19,7 +19,7 @@ package test
import (
corev1 "k8s.io/api/core/v1"
"k8s.io/pod-security-admission/api"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
/*
@@ -41,9 +41,9 @@ func init() {
p = ensureSecurityContext(p)
return []*corev1.Pod{
tweak(p, func(p *corev1.Pod) {
p.Spec.SecurityContext.RunAsUser = pointer.Int64Ptr(1000)
p.Spec.Containers[0].SecurityContext.RunAsUser = pointer.Int64Ptr(1000)
p.Spec.InitContainers[0].SecurityContext.RunAsUser = pointer.Int64Ptr(1000)
p.Spec.SecurityContext.RunAsUser = ptr.To[int64](1000)
p.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To[int64](1000)
p.Spec.InitContainers[0].SecurityContext.RunAsUser = ptr.To[int64](1000)
}),
}
},
@@ -51,10 +51,10 @@ func init() {
p = ensureSecurityContext(p)
return []*corev1.Pod{
// explicit 0 on pod
tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.RunAsUser = pointer.Int64Ptr(0) }),
tweak(p, func(p *corev1.Pod) { p.Spec.SecurityContext.RunAsUser = ptr.To[int64](0) }),
// explicit 0 on containers
tweak(p, func(p *corev1.Pod) { p.Spec.Containers[0].SecurityContext.RunAsUser = pointer.Int64Ptr(0) }),
tweak(p, func(p *corev1.Pod) { p.Spec.InitContainers[0].SecurityContext.RunAsUser = pointer.Int64Ptr(0) }),
tweak(p, func(p *corev1.Pod) { p.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To[int64](0) }),
tweak(p, func(p *corev1.Pod) { p.Spec.InitContainers[0].SecurityContext.RunAsUser = ptr.To[int64](0) }),
}
},
}

8
staging/src/k8s.io/pod-security-admission/test/fixtures_windowsHostProcess.go
View File

@@ -19,7 +19,7 @@ package test
import (
corev1 "k8s.io/api/core/v1"
"k8s.io/pod-security-admission/api"
"k8s.io/utils/pointer"
"k8s.io/utils/ptr"
)
/*
@@ -59,15 +59,15 @@ func init() {
// HostNetwork is required to be true for HostProcess pods.
// Set to true here so we pass API validation and get to admission checks.
p.Spec.HostNetwork = true
p.Spec.SecurityContext.WindowsOptions.HostProcess = pointer.BoolPtr(true)
p.Spec.SecurityContext.WindowsOptions.HostProcess = ptr.To(true)
}),
// true for containers
tweak(p, func(p *corev1.Pod) {
// HostNetwork is required to be true for HostProcess pods.
// Set to true here so we pass API validation and get to admission checks.
p.Spec.HostNetwork = true
p.Spec.Containers[0].SecurityContext.WindowsOptions.HostProcess = pointer.BoolPtr(true)
p.Spec.InitContainers[0].SecurityContext.WindowsOptions.HostProcess = pointer.BoolPtr(true)
p.Spec.Containers[0].SecurityContext.WindowsOptions.HostProcess = ptr.To(true)
p.Spec.InitContainers[0].SecurityContext.WindowsOptions.HostProcess = ptr.To(true)
}),
}
},