diff --git a/test/e2e/common/node/security_context.go b/test/e2e/common/node/security_context.go index 85400318d27..d3c76b02fca 100644 --- a/test/e2e/common/node/security_context.go +++ b/test/e2e/common/node/security_context.go @@ -88,7 +88,7 @@ var _ = SIGDescribe("Security Context", func() { } } - f.It("must create the user namespace if set to false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("must create the user namespace if set to false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { // with hostUsers=false the pod must use a new user namespace podClient := e2epod.PodClientNS(f, f.Namespace.Name) @@ -127,7 +127,7 @@ var _ = SIGDescribe("Security Context", func() { }) f.It("must create a user namespace and use host network when hostUsers is false and hostNetwork is true [LinuxOnly]", feature.UserNamespacesHostNetworkSupport, framework.WithFeatureGate(features.UserNamespacesHostNetworkSupport), - feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + feature.UserNamespacesSupport, func(ctx context.Context) { // with hostUsers=false the pod must use a new user namespace. // with hostNetwork=true the pod must use the host network namespace. podClient := e2epod.PodClientNS(f, f.Namespace.Name) @@ -201,7 +201,7 @@ var _ = SIGDescribe("Security Context", func() { gomega.Expect(netNs1).To(gomega.Equal(netNs2), "two different pods with hostNetwork=true should be in the same network namespace, but they are not. NetNS1: %s, NetNS2: %s", netNs1, netNs2) }) - f.It("must create the user namespace in the configured hostUID/hostGID range [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("must create the user namespace in the configured hostUID/hostGID range [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { // We need to check with the binary "getsubuids" the mappings for the kubelet. // If something is not present, we skip the test as the node wasn't configured to run this test. id, length, err := kubeletUsernsMappings(getsubuidsBinary) @@ -269,7 +269,7 @@ var _ = SIGDescribe("Security Context", func() { } }) - f.It("must not create the user namespace if set to true [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("must not create the user namespace if set to true [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { // with hostUsers=true the pod must use the host user namespace pod := makePod(true) // When running in the host's user namespace, the /proc/self/uid_map file content looks like: @@ -280,7 +280,7 @@ var _ = SIGDescribe("Security Context", func() { }) }) - f.It("should mount all volumes with proper permissions with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("should mount all volumes with proper permissions with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { // Create configmap. name := "userns-volumes-test-" + string(uuid.NewUUID()) configMap := newConfigMap(f, name) @@ -402,7 +402,7 @@ var _ = SIGDescribe("Security Context", func() { }) }) - f.It("should set FSGroup to user inside the container with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("should set FSGroup to user inside the container with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { // Create configmap. name := "userns-volumes-test-" + string(uuid.NewUUID()) configMap := newConfigMap(f, name) @@ -461,7 +461,7 @@ var _ = SIGDescribe("Security Context", func() { strings.Repeat(fmt.Sprintf("=%v\n", fsGroup), len(configMap.Data)), }) }) - f.It("metrics should report count of started and failed user namespaced pods [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { + f.It("metrics should report count of started and failed user namespaced pods [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) { targetNode, err := findLinuxNode(ctx, f) framework.ExpectNoError(err, "Error finding Linux node") framework.Logf("Using node: %v", targetNode.Name) @@ -976,32 +976,30 @@ var _ = SIGDescribe("User Namespaces for Restricted Pod Security Standards [Linu f := framework.NewDefaultFramework("user-namespaces-pss-test") f.NamespacePodSecurityLevel = admissionapi.LevelRestricted - ginkgo.Context("with UserNamespacesSupport enabled", func() { - f.It("should allow pod", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) { - name := "pod-user-namespaces-pss-" + string(uuid.NewUUID()) - pod := &v1.Pod{ - ObjectMeta: metav1.ObjectMeta{Name: name}, - Spec: v1.PodSpec{ - RestartPolicy: v1.RestartPolicyNever, - HostUsers: ptr.To(false), - SecurityContext: &v1.PodSecurityContext{}, - Containers: []v1.Container{ - { - Name: name, - Image: imageutils.GetE2EImage(imageutils.BusyBox), - Command: []string{"whoami"}, - SecurityContext: &v1.SecurityContext{ - AllowPrivilegeEscalation: ptr.To(false), - Capabilities: &v1.Capabilities{Drop: []v1.Capability{"ALL"}}, - SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}, - }, + f.It("should allow userns pod", feature.UserNamespacesSupport, func(ctx context.Context) { + name := "pod-user-namespaces-pss-" + string(uuid.NewUUID()) + pod := &v1.Pod{ + ObjectMeta: metav1.ObjectMeta{Name: name}, + Spec: v1.PodSpec{ + RestartPolicy: v1.RestartPolicyNever, + HostUsers: ptr.To(false), + SecurityContext: &v1.PodSecurityContext{}, + Containers: []v1.Container{ + { + Name: name, + Image: imageutils.GetE2EImage(imageutils.BusyBox), + Command: []string{"whoami"}, + SecurityContext: &v1.SecurityContext{ + AllowPrivilegeEscalation: ptr.To(false), + Capabilities: &v1.Capabilities{Drop: []v1.Capability{"ALL"}}, + SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}, }, }, }, - } + }, + } - e2epodoutput.TestContainerOutput(ctx, f, "RunAsUser-RunAsNonRoot", pod, 0, []string{"root"}) - }) + e2epodoutput.TestContainerOutput(ctx, f, "RunAsUser-RunAsNonRoot", pod, 0, []string{"root"}) }) }) diff --git a/test/e2e_node/user_namespaces_test.go b/test/e2e_node/user_namespaces_test.go index 9a81d634713..52710d9da36 100644 --- a/test/e2e_node/user_namespaces_test.go +++ b/test/e2e_node/user_namespaces_test.go @@ -27,18 +27,14 @@ import ( "os/user" "strconv" "strings" - "time" "github.com/onsi/ginkgo/v2" - "github.com/onsi/gomega" v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/uuid" - kubefeatures "k8s.io/kubernetes/pkg/features" kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config" "k8s.io/kubernetes/test/e2e/feature" "k8s.io/kubernetes/test/e2e/framework" - e2epod "k8s.io/kubernetes/test/e2e/framework/pod" e2eoutput "k8s.io/kubernetes/test/e2e/framework/pod/output" e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper" imageutils "k8s.io/kubernetes/test/utils/image" @@ -52,59 +48,7 @@ var ( getsubuidsBinary = "getsubids" ) -var _ = SIGDescribe("UserNamespaces", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithSerial(), func() { - f := framework.NewDefaultFramework("user-namespace-off-test") - f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged - f.Context("when UserNamespacesSupport=false in the kubelet", func() { - // Turn off UserNamespacesSupport for this test - // TODO: once the UserNamespacesSupport feature is removed, this test should be removed too - tempSetCurrentKubeletConfig(f, func(ctx context.Context, initialConfig *kubeletconfig.KubeletConfiguration) { - if initialConfig.FeatureGates == nil { - initialConfig.FeatureGates = make(map[string]bool) - } - initialConfig.FeatureGates[string(kubefeatures.UserNamespacesSupport)] = false - initialConfig.FeatureGates[string(kubefeatures.ProcMountType)] = false - }) - f.It("will fail to create a hostUsers=false pod", func(ctx context.Context) { - if on, ok := serviceFeatureGates[string(kubefeatures.UserNamespacesSupport)]; !ok || !on { - e2eskipper.Skipf("services do not have user namespaces on") - } - falseVar := false - podClient := e2epod.NewPodClient(f) - pod, err := podClient.PodInterface.Create(ctx, &v1.Pod{ - ObjectMeta: metav1.ObjectMeta{Name: "userns-pod"}, - Spec: v1.PodSpec{ - Containers: []v1.Container{ - { - Name: "test-container-1", - Image: imageutils.GetE2EImage(imageutils.BusyBox), - Command: []string{"/bin/sleep"}, - Args: []string{"10000"}, - }, - }, - HostUsers: &falseVar, - }, - }, metav1.CreateOptions{}) - framework.ExpectNoError(err) - - // Pod should stay in pending - // Events would be a better way to tell this, as we could actually read the event, - // but history proves events aren't reliable enough to base a test on. - gomega.Consistently(ctx, func() error { - p, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Get(ctx, pod.Name, metav1.GetOptions{}) - if err != nil { - return err - } - if p.Status.Phase != v1.PodPending { - return fmt.Errorf("Pod phase isn't pending") - } - return nil - }, 30*time.Second, 5*time.Second).ShouldNot(gomega.HaveOccurred()) - }) - }) -}) - -var _ = SIGDescribe("user namespaces kubeconfig tests", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(kubefeatures.UserNamespacesSupport), framework.WithSerial(), func() { +var _ = SIGDescribe("user namespaces kubeconfig tests", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithSerial(), func() { f := framework.NewDefaultFramework("userns-kubeconfig") f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged f.Context("test config using userNamespaces.idsPerPod", func() { diff --git a/test/integration/auth/podsecurity_test.go b/test/integration/auth/podsecurity_test.go index 384788ecd7f..2cabcfc1bac 100644 --- a/test/integration/auth/podsecurity_test.go +++ b/test/integration/auth/podsecurity_test.go @@ -53,8 +53,7 @@ import ( func TestPodSecurity(t *testing.T) { // Enable all feature gates needed to allow all fields to be exercised featuregatetesting.SetFeatureGatesDuringTest(t, utilfeature.DefaultFeatureGate, featuregatetesting.FeatureOverrides{ - features.ProcMountType: true, - features.UserNamespacesSupport: true, + features.ProcMountType: true, }) // Start server server := startPodSecurityServer(t) @@ -101,8 +100,7 @@ func TestPodSecurityGAOnly(t *testing.T) { func TestPodSecurityWebhook(t *testing.T) { // Enable all feature gates needed to allow all fields to be exercised featuregatetesting.SetFeatureGatesDuringTest(t, utilfeature.DefaultFeatureGate, featuregatetesting.FeatureOverrides{ - features.ProcMountType: true, - features.UserNamespacesSupport: true, + features.ProcMountType: true, }) // Start test API server.