mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-09-01 01:08:55 +00:00
Merge pull request #58900 from Random-Liu/fix-psp-test
Automatic merge from submit-queue (batch tested with PRs 58903, 58141, 58900). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix pod security policy capability test. Fixes https://github.com/kubernetes/kubernetes/issues/58901. In our document, we explicitly say: ``` The following fields take a list of capabilities, specified as the capability name in ALL_CAPS without the CAP_ prefix. ``` https://kubernetes.io/docs/concepts/policy/pod-security-policy/ @kubernetes/sig-node-pr-reviews **Release note**: ```release-note none ```
This commit is contained in:
@@ -234,10 +234,10 @@ func testPrivilegedPods(f *framework.Framework, tester func(pod *v1.Pod)) {
|
||||
tester(unconfined)
|
||||
})
|
||||
|
||||
By("Running a CAP_SYS_ADMIN pod", func() {
|
||||
By("Running a SYS_ADMIN pod", func() {
|
||||
sysadmin := restrictedPod(f, "sysadmin")
|
||||
sysadmin.Spec.Containers[0].SecurityContext.Capabilities = &v1.Capabilities{
|
||||
Add: []v1.Capability{"CAP_SYS_ADMIN"},
|
||||
Add: []v1.Capability{"SYS_ADMIN"},
|
||||
}
|
||||
sysadmin.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil
|
||||
tester(sysadmin)
|
||||
|
Reference in New Issue
Block a user