Add non-root end-to-end test cases to credentials test suite #327
Conversation
unexge
force-pushed
the
unexge/credential-tests-non-root
branch
from
540618a to
1c0014d
Compare
|
|
||
| return pod, sa | ||
| } | ||
|
|
||
| It("should use pod's service account's read-only role", func(ctx context.Context) { | ||
| pod, _ := createPodWithServiceAccountAndPolicy(ctx, iamPolicyS3ReadOnlyAccess, false) | ||
| pod, _ := createPodWithServiceAccountAndPolicy(ctx, iamPolicyS3ReadOnlyAccess, false, false) |
There was a problem hiding this comment.
Is there a way to pass in keyword arguments here? Right now I can't understand what these boolean arguments are for.
There was a problem hiding this comment.
Go doesn't support named arguments, usually structs are used if such a thing is desired, but I think it'd make this more verbose. Since this is a local helper function and not used outside this test-case, I think I'd prefer current one.
| } | ||
| // We need to set this false at Pod-level as `chmod-cache-dir` needs to run as `root` and this | ||
| // would prevent container creation if its true. | ||
| pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(false) |
There was a problem hiding this comment.
Why are we always changing this even if the test explicitly set the security context?
There was a problem hiding this comment.
If you instantiate Kubernetes testing framework with LevelRestricted, it sets this to true, meaning all containers in the Pod must run as non-root (i.e., not 0).
Since this is a generic helper function and gets called from different security levels, we're just making sure to set it to false, so we can spawn our privileged container needed to create cache directory. The other containers created for this Pod would probably have their RunAsUser set to non-root (due to security level), so we just need to remove this restriction at Pod-level for our container.
This whole ensureCacheDirExistsInNode is very hacky due to fact Mountpoint running in the host and hopefully this will go away with running Mountpoint inside container.
unexge
force-pushed
the
unexge/credential-tests-non-root
branch
from
1c0014d to
a105393
Compare
Signed-off-by: Burak Varlı <[email protected]>
Signed-off-by: Burak Varlı <[email protected]>
Signed-off-by: Burak Varlı <[email protected]>
unexge
force-pushed
the
unexge/credential-tests-non-root
branch
from
a105393 to
12d1737
Compare
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.