PodSecurity: Make check-specific passing fixtures optional

This commit is contained in:
Jordan Liggitt 2021-07-06 12:43:29 -04:00
parent 2423842549
commit ea54b1b152
5 changed files with 10 additions and 9 deletions

View File

@ -170,8 +170,8 @@ func getFixtures(key fixtureKey) (fixtureData, error) {
if len(data.expectErrorSubstring) == 0 {
data.expectErrorSubstring = key.check
}
if len(data.pass) == 0 || len(data.fail) == 0 {
return fixtureData{}, fmt.Errorf("generatePass/generateFail for %#v must return at least one pod each", key)
if len(data.fail) == 0 {
return fixtureData{}, fmt.Errorf("generateFail for %#v must return at least one pod", key)
}
return data, nil
}

View File

@ -34,10 +34,8 @@ containerFields: []string{
func init() {
fixtureData_1_8 := fixtureGenerator{
generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{
// only valid pod is to explicitly set allowPrivilegeEscalation to false in all containers
p,
}
// minimal valid pod already captures all valid combinations
return nil
},
generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{

View File

@ -30,7 +30,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{
expectErrorSubstring: "host namespaces",
generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p} // minimal valid pod
// minimal valid pod already captures all valid combinations
return nil
},
generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{

View File

@ -30,7 +30,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{
expectErrorSubstring: "hostPath volumes",
generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p} // minimal valid pod
// minimal valid pod already captures all valid combinations
return nil
},
generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{

View File

@ -39,7 +39,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{
generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p}
// minimal valid pod already captures all valid combinations
return nil
},
failRequiresFeatures: []featuregate.Feature{"WindowsHostProcessContainers"},
generateFail: func(p *corev1.Pod) []*corev1.Pod {