github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 04:33:26 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #107448 from saschagrunert/apparmor-e2e

Browse Source 
Fix AppArmor unloaded profile e2e test
This commit is contained in:
Kubernetes Prow Robot 2022-01-11 12:23:15 -08:00 committed by GitHub
commit f8bb35d76e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
test/e2e_node/apparmor_test.go
View File

@ -38,6 +38,7 @@ import (
"k8s.io/client-go/tools/cache"
watchtools "k8s.io/client-go/tools/watch"
"k8s.io/klog/v2"
"k8s.io/kubernetes/pkg/kubelet/kuberuntime"
"k8s.io/kubernetes/test/e2e/framework"
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
@ -57,7 +58,7 @@ var _ = SIGDescribe("AppArmor [Feature:AppArmor][NodeFeature:AppArmor]", func()
ginkgo.It("should reject an unloaded profile", func() {
status := runAppArmorTest(f, false, v1.AppArmorBetaProfileNamePrefix+"non-existent-profile")
expectSoftRejection(status)
gomega.Expect(status.ContainerStatuses[0].State.Waiting.Message).To(gomega.ContainSubstring("apparmor"))
})
ginkgo.It("should enforce a profile blocking writes", func() {
status := runAppArmorTest(f, true, v1.AppArmorBetaProfileNamePrefix+apparmorProfilePrefix+"deny-write")
@ -190,6 +191,10 @@ func runAppArmorTest(f *framework.Framework, shouldRun bool, profile string) v1.
if t.Status.Reason == "AppArmor" {
return true, nil
}
// Loading a profile not available on disk should return a container creation error
if len(t.Status.ContainerStatuses) > 0 && t.Status.ContainerStatuses[0].State.Waiting.Reason == kuberuntime.ErrCreateContainer.Error() {
return true, nil
}
}
return false, nil
})