github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

PodSecurity: Make check-specific passing fixtures optional

Browse Source
This commit is contained in:
Jordan Liggitt 2021-07-06 12:43:29 -04:00
parent 2423842549
commit ea54b1b152
5 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
staging/src/k8s.io/pod-security-admission/test/fixtures.go
View File

@ -170,8 +170,8 @@ func getFixtures(key fixtureKey) (fixtureData, error) {
if len(data.expectErrorSubstring) == 0 { if len(data.expectErrorSubstring) == 0 {
data.expectErrorSubstring = key.check data.expectErrorSubstring = key.check
} }
if len(data.pass) == 0 || len(data.fail) == 0 { if len(data.fail) == 0 {
return fixtureData{}, fmt.Errorf("generatePass/generateFail for %#v must return at least one pod each", key) return fixtureData{}, fmt.Errorf("generateFail for %#v must return at least one pod", key)
} }
return data, nil return data, nil
} }

6
staging/src/k8s.io/pod-security-admission/test/fixtures_allowPrivilegeEscalation.go
View File

@ -34,10 +34,8 @@ containerFields: []string{
func init() { func init() {
fixtureData_1_8 := fixtureGenerator{ fixtureData_1_8 := fixtureGenerator{
generatePass: func(p *corev1.Pod) []*corev1.Pod { generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{ // minimal valid pod already captures all valid combinations
// only valid pod is to explicitly set allowPrivilegeEscalation to false in all containers return nil
p,
}
}, },
generateFail: func(p *corev1.Pod) []*corev1.Pod { generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{ return []*corev1.Pod{

3
staging/src/k8s.io/pod-security-admission/test/fixtures_hostNamespaces.go
View File

@ -30,7 +30,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{ fixtureData_1_0 := fixtureGenerator{
expectErrorSubstring: "host namespaces", expectErrorSubstring: "host namespaces",
generatePass: func(p *corev1.Pod) []*corev1.Pod { generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p} // minimal valid pod // minimal valid pod already captures all valid combinations
return nil
}, },
generateFail: func(p *corev1.Pod) []*corev1.Pod { generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{ return []*corev1.Pod{

3
staging/src/k8s.io/pod-security-admission/test/fixtures_hostPath.go
View File

@ -30,7 +30,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{ fixtureData_1_0 := fixtureGenerator{
expectErrorSubstring: "hostPath volumes", expectErrorSubstring: "hostPath volumes",
generatePass: func(p *corev1.Pod) []*corev1.Pod { generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p} // minimal valid pod // minimal valid pod already captures all valid combinations
return nil
}, },
generateFail: func(p *corev1.Pod) []*corev1.Pod { generateFail: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{ return []*corev1.Pod{

3
staging/src/k8s.io/pod-security-admission/test/fixtures_hostProcess.go
View File

@ -39,7 +39,8 @@ func init() {
fixtureData_1_0 := fixtureGenerator{ fixtureData_1_0 := fixtureGenerator{
generatePass: func(p *corev1.Pod) []*corev1.Pod { generatePass: func(p *corev1.Pod) []*corev1.Pod {
return []*corev1.Pod{p} // minimal valid pod already captures all valid combinations
return nil
}, },
failRequiresFeatures: []featuregate.Feature{"WindowsHostProcessContainers"}, failRequiresFeatures: []featuregate.Feature{"WindowsHostProcessContainers"},
generateFail: func(p *corev1.Pod) []*corev1.Pod { generateFail: func(p *corev1.Pod) []*corev1.Pod {