adbf3b5aa5
This commit introduces the DRAResourceClaimGranularStatusAuthorization feature gate (Beta in 1.36) to enforce fine-grained authorization checks on ResourceClaim status updates. Previously, 'update' permission on 'resourceclaims/status' allowed modifying the entire status. To enforce the principle of least privilege for DRA drivers and the scheduler, this change introduces synthetic subresources and verb prefixes: - 'resourceclaims/binding': Required to update 'status.allocation' and 'status.reservedFor'. - 'resourceclaims/driver': Required to update 'status.devices'. Evaluated on a per-driver basis using 'associated-node:<verb>' (for node-local ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
Overview
The tests in this directory cover dynamic resource allocation support in Kubernetes. They do not test the correct behavior of arbitrary dynamic resource allocation drivers.
If such a driver is needed, then the in-tree test/e2e/dra/test-driver is used, with a slight twist: instead of deploying that driver directly in the cluster, the necessary sockets for interaction with kubelet (registration and dynamic resource allocation) get proxied into the e2e.test binary. This reuses the work done for CSI mock testing. The advantage is that no separate images are needed for the test driver and that the e2e test has full control over all gRPC calls, in case that it needs that for operations like error injection or checking calls.
Cluster setup preparation
The container runtime must support CDI. CRI-O supports CDI starting from release 1.23, Containerd supports CDI starting from release 1.7. To bring up a Kind cluster with Containerd, two things are needed:
NB: Kind switched to use worker-node base image with Containerd 1.7 by default starting from release 0.20, build kind from latest main branch sources or use Kind release binary 0.20 or later.
Build kind node image
After building Kubernetes, in Kubernetes source code tree build new node image:
$ kind build node-image --image dra/node:latest $(pwd)
Bring up a Kind cluster
$ kind create cluster --config test/e2e/dra/kind.yaml --image dra/node:latest
Run tests
- Build ginkgo
$ make ginkgo
- Run e2e tests for the
Dynamic Resource Allocationfeature:
$ KUBECONFIG=~/.kube/config _output/bin/ginkgo -p -v -focus=Feature:DynamicResourceAllocation ./test/e2e