github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-22 19:31:44 +00:00
Code Issues Projects Releases Wiki Activity

test/e2e/framework: add pod security admission configuration

Browse Source
This commit is contained in:
Sergiusz Urbaniak 2022-01-30 13:36:21 +01:00
parent 6c67869ff2
commit e06e6771ef
No known key found for this signature in database
GPG Key ID: 44E6612519E13C39
1 changed files with 25 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
test/e2e/framework/framework.go
View File

@ -47,6 +47,7 @@ import (
"k8s.io/client-go/rest" "k8s.io/client-go/rest"
"k8s.io/client-go/restmapper" "k8s.io/client-go/restmapper"
scaleclient "k8s.io/client-go/scale" scaleclient "k8s.io/client-go/scale"
admissionapi "k8s.io/pod-security-admission/api"
"github.com/onsi/ginkgo" "github.com/onsi/ginkgo"
"github.com/onsi/gomega" "github.com/onsi/gomega"
@ -83,6 +84,7 @@ type Framework struct {
namespacesToDelete []*v1.Namespace // Some tests have more than one. namespacesToDelete []*v1.Namespace // Some tests have more than one.
NamespaceDeletionTimeout time.Duration NamespaceDeletionTimeout time.Duration
SkipPrivilegedPSPBinding bool // Whether to skip creating a binding to the privileged PSP in the test namespace SkipPrivilegedPSPBinding bool // Whether to skip creating a binding to the privileged PSP in the test namespace
NamespacePodSecurityEnforceLevel admissionapi.Level // The pod security enforcement level for namespaces to be applied.
gatherer *ContainerResourceGatherer gatherer *ContainerResourceGatherer
// Constraints that passed to a check which is executed after data is gathered to // Constraints that passed to a check which is executed after data is gathered to
@ -521,6 +523,24 @@ func (f *Framework) CreateNamespace(baseName string, labels map[string]string) (
if createTestingNS == nil { if createTestingNS == nil {
createTestingNS = CreateTestingNS createTestingNS = CreateTestingNS
} }
if labels == nil {
labels = make(map[string]string)
} else {
labelsCopy := make(map[string]string)
for k, v := range labels {
labelsCopy[k] = v
}
labels = labelsCopy
}
// TODO(sur): set to restricted before 1.24 test freeze
enforceLevel := admissionapi.LevelPrivileged
if f.NamespacePodSecurityEnforceLevel != "" {
enforceLevel = f.NamespacePodSecurityEnforceLevel
}
labels[admissionapi.EnforceLevelLabel] = string(enforceLevel)
ns, err := createTestingNS(baseName, f.ClientSet, labels) ns, err := createTestingNS(baseName, f.ClientSet, labels)
// check ns instead of err to see if it's nil as we may // check ns instead of err to see if it's nil as we may
// fail to create serviceAccount in it. // fail to create serviceAccount in it.