Use t.Run for /pkg/cri tests
A majority of the tests in /pkg/cri are testing/validating multiple things per test (generally spec or options validations). This flow lends itself well to using *testing.T's Run method to run each thing as a subtest so `go test` output can actually display which subtest failed/passed. Some of the tests in the packages in pkg/cri already did this, but a bunch simply logged what sub-testcase was currently running without invoking t.Run. Signed-off-by: Daniel Canter <dcanter@microsoft.com>
This commit is contained in:
		| @@ -238,34 +238,35 @@ func TestContainerCapabilities(t *testing.T) { | ||||
| 			excludes: util.SubtractStringSlice(allCaps, "CAP_SYS_ADMIN"), | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData() | ||||
| 		ociRuntime := config.Runtime{} | ||||
| 		c := newTestCRIService() | ||||
| 		c.allCaps = allCaps | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData() | ||||
| 			ociRuntime := config.Runtime{} | ||||
| 			c := newTestCRIService() | ||||
| 			c.allCaps = allCaps | ||||
|  | ||||
| 		containerConfig.Linux.SecurityContext.Capabilities = test.capability | ||||
| 		spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		require.NoError(t, err) | ||||
| 			containerConfig.Linux.SecurityContext.Capabilities = test.capability | ||||
| 			spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			require.NoError(t, err) | ||||
|  | ||||
| 		if selinux.GetEnabled() { | ||||
| 			assert.NotEqual(t, "", spec.Process.SelinuxLabel) | ||||
| 			assert.NotEqual(t, "", spec.Linux.MountLabel) | ||||
| 		} | ||||
| 			if selinux.GetEnabled() { | ||||
| 				assert.NotEqual(t, "", spec.Process.SelinuxLabel) | ||||
| 				assert.NotEqual(t, "", spec.Linux.MountLabel) | ||||
| 			} | ||||
|  | ||||
| 		specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 		for _, include := range test.includes { | ||||
| 			assert.Contains(t, spec.Process.Capabilities.Bounding, include) | ||||
| 			assert.Contains(t, spec.Process.Capabilities.Effective, include) | ||||
| 			assert.Contains(t, spec.Process.Capabilities.Permitted, include) | ||||
| 		} | ||||
| 		for _, exclude := range test.excludes { | ||||
| 			assert.NotContains(t, spec.Process.Capabilities.Bounding, exclude) | ||||
| 			assert.NotContains(t, spec.Process.Capabilities.Effective, exclude) | ||||
| 			assert.NotContains(t, spec.Process.Capabilities.Permitted, exclude) | ||||
| 		} | ||||
| 		assert.Empty(t, spec.Process.Capabilities.Inheritable) | ||||
| 		assert.Empty(t, spec.Process.Capabilities.Ambient) | ||||
| 			specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 			for _, include := range test.includes { | ||||
| 				assert.Contains(t, spec.Process.Capabilities.Bounding, include) | ||||
| 				assert.Contains(t, spec.Process.Capabilities.Effective, include) | ||||
| 				assert.Contains(t, spec.Process.Capabilities.Permitted, include) | ||||
| 			} | ||||
| 			for _, exclude := range test.excludes { | ||||
| 				assert.NotContains(t, spec.Process.Capabilities.Bounding, exclude) | ||||
| 				assert.NotContains(t, spec.Process.Capabilities.Effective, exclude) | ||||
| 				assert.NotContains(t, spec.Process.Capabilities.Permitted, exclude) | ||||
| 			} | ||||
| 			assert.Empty(t, spec.Process.Capabilities.Inheritable) | ||||
| 			assert.Empty(t, spec.Process.Capabilities.Ambient) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -425,17 +426,18 @@ func TestContainerAndSandboxPrivileged(t *testing.T) { | ||||
| 			expectError:         false, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		containerConfig.Linux.SecurityContext.Privileged = test.containerPrivileged | ||||
| 		sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 			Privileged: test.sandboxPrivileged, | ||||
| 		} | ||||
| 		_, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		if test.expectError { | ||||
| 			assert.Error(t, err) | ||||
| 		} else { | ||||
| 			assert.NoError(t, err) | ||||
| 		} | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			containerConfig.Linux.SecurityContext.Privileged = test.containerPrivileged | ||||
| 			sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 				Privileged: test.sandboxPrivileged, | ||||
| 			} | ||||
| 			_, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			if test.expectError { | ||||
| 				assert.Error(t, err) | ||||
| 			} else { | ||||
| 				assert.NoError(t, err) | ||||
| 			} | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -587,20 +589,22 @@ func TestContainerMounts(t *testing.T) { | ||||
| 			}, | ||||
| 		}, | ||||
| 	} { | ||||
| 		config := &runtime.ContainerConfig{ | ||||
| 			Metadata: &runtime.ContainerMetadata{ | ||||
| 				Name:    "test-name", | ||||
| 				Attempt: 1, | ||||
| 			}, | ||||
| 			Mounts: test.criMounts, | ||||
| 			Linux: &runtime.LinuxContainerConfig{ | ||||
| 				SecurityContext: test.securityContext, | ||||
| 			}, | ||||
| 		} | ||||
| 		c := newTestCRIService() | ||||
| 		c.os.(*ostesting.FakeOS).StatFn = test.statFn | ||||
| 		mounts := c.containerMounts(testSandboxID, config) | ||||
| 		assert.Equal(t, test.expectedMounts, mounts, desc) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			config := &runtime.ContainerConfig{ | ||||
| 				Metadata: &runtime.ContainerMetadata{ | ||||
| 					Name:    "test-name", | ||||
| 					Attempt: 1, | ||||
| 				}, | ||||
| 				Mounts: test.criMounts, | ||||
| 				Linux: &runtime.LinuxContainerConfig{ | ||||
| 					SecurityContext: test.securityContext, | ||||
| 				}, | ||||
| 			} | ||||
| 			c := newTestCRIService() | ||||
| 			c.os.(*ostesting.FakeOS).StatFn = test.statFn | ||||
| 			mounts := c.containerMounts(testSandboxID, config) | ||||
| 			assert.Equal(t, test.expectedMounts, mounts, desc) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -627,24 +631,24 @@ func TestPrivilegedBindMount(t *testing.T) { | ||||
| 			expectedCgroupFSRO: false, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 			sandboxConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
|  | ||||
| 		containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 		sandboxConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 			spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
|  | ||||
| 		spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
|  | ||||
| 		assert.NoError(t, err) | ||||
| 		if test.expectedSysFSRO { | ||||
| 			checkMount(t, spec.Mounts, "sysfs", "/sys", "sysfs", []string{"ro"}, []string{"rw"}) | ||||
| 		} else { | ||||
| 			checkMount(t, spec.Mounts, "sysfs", "/sys", "sysfs", []string{"rw"}, []string{"ro"}) | ||||
| 		} | ||||
| 		if test.expectedCgroupFSRO { | ||||
| 			checkMount(t, spec.Mounts, "cgroup", "/sys/fs/cgroup", "cgroup", []string{"ro"}, []string{"rw"}) | ||||
| 		} else { | ||||
| 			checkMount(t, spec.Mounts, "cgroup", "/sys/fs/cgroup", "cgroup", []string{"rw"}, []string{"ro"}) | ||||
| 		} | ||||
| 			assert.NoError(t, err) | ||||
| 			if test.expectedSysFSRO { | ||||
| 				checkMount(t, spec.Mounts, "sysfs", "/sys", "sysfs", []string{"ro"}, []string{"rw"}) | ||||
| 			} else { | ||||
| 				checkMount(t, spec.Mounts, "sysfs", "/sys", "sysfs", []string{"rw"}, []string{"ro"}) | ||||
| 			} | ||||
| 			if test.expectedCgroupFSRO { | ||||
| 				checkMount(t, spec.Mounts, "cgroup", "/sys/fs/cgroup", "cgroup", []string{"ro"}, []string{"rw"}) | ||||
| 			} else { | ||||
| 				checkMount(t, spec.Mounts, "cgroup", "/sys/fs/cgroup", "cgroup", []string{"rw"}, []string{"ro"}) | ||||
| 			} | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -736,21 +740,22 @@ func TestMountPropagation(t *testing.T) { | ||||
| 			expectErr:         true, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		c := newTestCRIService() | ||||
| 		c.os.(*ostesting.FakeOS).LookupMountFn = test.fakeLookupMountFn | ||||
| 		config, _, _, _ := getCreateContainerTestData() | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			c := newTestCRIService() | ||||
| 			c.os.(*ostesting.FakeOS).LookupMountFn = test.fakeLookupMountFn | ||||
| 			config, _, _, _ := getCreateContainerTestData() | ||||
|  | ||||
| 		var spec runtimespec.Spec | ||||
| 		spec.Linux = &runtimespec.Linux{} | ||||
| 			var spec runtimespec.Spec | ||||
| 			spec.Linux = &runtimespec.Linux{} | ||||
|  | ||||
| 		err := opts.WithMounts(c.os, config, []*runtime.Mount{test.criMount}, "")(context.Background(), nil, nil, &spec) | ||||
| 		if test.expectErr { | ||||
| 			require.Error(t, err) | ||||
| 		} else { | ||||
| 			require.NoError(t, err) | ||||
| 			checkMount(t, spec.Mounts, test.criMount.HostPath, test.criMount.ContainerPath, "bind", test.optionsCheck, nil) | ||||
| 		} | ||||
| 			err := opts.WithMounts(c.os, config, []*runtime.Mount{test.criMount}, "")(context.Background(), nil, nil, &spec) | ||||
| 			if test.expectErr { | ||||
| 				require.Error(t, err) | ||||
| 			} else { | ||||
| 				require.NoError(t, err) | ||||
| 				checkMount(t, spec.Mounts, test.criMount.HostPath, test.criMount.ContainerPath, "bind", test.optionsCheck, nil) | ||||
| 			} | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -787,11 +792,12 @@ func TestPidNamespace(t *testing.T) { | ||||
| 			}, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		containerConfig.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS} | ||||
| 		spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		require.NoError(t, err) | ||||
| 		assert.Contains(t, spec.Linux.Namespaces, test.expected) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			containerConfig.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS} | ||||
| 			spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			require.NoError(t, err) | ||||
| 			assert.Contains(t, spec.Linux.Namespaces, test.expected) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -920,7 +926,7 @@ func TestGenerateSeccompSecurityProfileSpecOpts(t *testing.T) { | ||||
| 			}, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Run(fmt.Sprintf("TestCase %q", desc), func(t *testing.T) { | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			cri := &criService{} | ||||
| 			cri.config.UnsetSeccompProfile = test.defaultProfile | ||||
| 			ssp := test.sp | ||||
| @@ -1073,29 +1079,30 @@ func TestGenerateApparmorSpecOpts(t *testing.T) { | ||||
| 			}, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		asp := test.sp | ||||
| 		csp, err := generateApparmorSecurityProfile(test.profile) | ||||
| 		if err != nil { | ||||
| 			if test.expectErr { | ||||
| 				assert.Error(t, err) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			asp := test.sp | ||||
| 			csp, err := generateApparmorSecurityProfile(test.profile) | ||||
| 			if err != nil { | ||||
| 				if test.expectErr { | ||||
| 					assert.Error(t, err) | ||||
| 				} else { | ||||
| 					assert.NoError(t, err) | ||||
| 				} | ||||
| 			} else { | ||||
| 				assert.NoError(t, err) | ||||
| 				if asp == nil { | ||||
| 					asp = csp | ||||
| 				} | ||||
| 				specOpts, err := generateApparmorSpecOpts(asp, test.privileged, !test.disable) | ||||
| 				assert.Equal(t, | ||||
| 					reflect.ValueOf(test.specOpts).Pointer(), | ||||
| 					reflect.ValueOf(specOpts).Pointer()) | ||||
| 				if test.expectErr { | ||||
| 					assert.Error(t, err) | ||||
| 				} else { | ||||
| 					assert.NoError(t, err) | ||||
| 				} | ||||
| 			} | ||||
| 		} else { | ||||
| 			if asp == nil { | ||||
| 				asp = csp | ||||
| 			} | ||||
| 			specOpts, err := generateApparmorSpecOpts(asp, test.privileged, !test.disable) | ||||
| 			assert.Equal(t, | ||||
| 				reflect.ValueOf(test.specOpts).Pointer(), | ||||
| 				reflect.ValueOf(specOpts).Pointer()) | ||||
| 			if test.expectErr { | ||||
| 				assert.Error(t, err) | ||||
| 			} else { | ||||
| 				assert.NoError(t, err) | ||||
| 			} | ||||
| 		} | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -1169,21 +1176,22 @@ func TestMaskedAndReadonlyPaths(t *testing.T) { | ||||
| 			privileged:       true, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		c.config.DisableProcMount = test.disableProcMount | ||||
| 		containerConfig.Linux.SecurityContext.MaskedPaths = test.masked | ||||
| 		containerConfig.Linux.SecurityContext.ReadonlyPaths = test.readonly | ||||
| 		containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 		sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 			Privileged: test.privileged, | ||||
| 		} | ||||
| 		spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		require.NoError(t, err) | ||||
| 		if !test.privileged { // specCheck presumes an unprivileged container | ||||
| 			specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 		} | ||||
| 		assert.Equal(t, test.expectedMasked, spec.Linux.MaskedPaths) | ||||
| 		assert.Equal(t, test.expectedReadonly, spec.Linux.ReadonlyPaths) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			c.config.DisableProcMount = test.disableProcMount | ||||
| 			containerConfig.Linux.SecurityContext.MaskedPaths = test.masked | ||||
| 			containerConfig.Linux.SecurityContext.ReadonlyPaths = test.readonly | ||||
| 			containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 			sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 				Privileged: test.privileged, | ||||
| 			} | ||||
| 			spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			require.NoError(t, err) | ||||
| 			if !test.privileged { // specCheck presumes an unprivileged container | ||||
| 				specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 			} | ||||
| 			assert.Equal(t, test.expectedMasked, spec.Linux.MaskedPaths) | ||||
| 			assert.Equal(t, test.expectedReadonly, spec.Linux.ReadonlyPaths) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -1219,15 +1227,16 @@ func TestHostname(t *testing.T) { | ||||
| 			expectedEnv: "HOSTNAME=real-hostname", | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		sandboxConfig.Hostname = test.hostname | ||||
| 		sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 			NamespaceOptions: &runtime.NamespaceOption{Network: test.networkNs}, | ||||
| 		} | ||||
| 		spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		require.NoError(t, err) | ||||
| 		specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 		assert.Contains(t, spec.Process.Env, test.expectedEnv) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			sandboxConfig.Hostname = test.hostname | ||||
| 			sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{ | ||||
| 				NamespaceOptions: &runtime.NamespaceOption{Network: test.networkNs}, | ||||
| 			} | ||||
| 			spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			require.NoError(t, err) | ||||
| 			specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 			assert.Contains(t, spec.Process.Env, test.expectedEnv) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -1363,24 +1372,24 @@ func TestNonRootUserAndDevices(t *testing.T) { | ||||
| 			expectedDeviceGID:                  *testDevice.GID, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			c.config.DeviceOwnershipFromSecurityContext = test.deviceOwnershipFromSecurityContext | ||||
| 			containerConfig.Linux.SecurityContext.RunAsUser = test.uid | ||||
| 			containerConfig.Linux.SecurityContext.RunAsGroup = test.gid | ||||
| 			containerConfig.Devices = []*runtime.Device{ | ||||
| 				{ | ||||
| 					ContainerPath: testDevice.Path, | ||||
| 					HostPath:      testDevice.Path, | ||||
| 					Permissions:   "r", | ||||
| 				}, | ||||
| 			} | ||||
|  | ||||
| 		c.config.DeviceOwnershipFromSecurityContext = test.deviceOwnershipFromSecurityContext | ||||
| 		containerConfig.Linux.SecurityContext.RunAsUser = test.uid | ||||
| 		containerConfig.Linux.SecurityContext.RunAsGroup = test.gid | ||||
| 		containerConfig.Devices = []*runtime.Device{ | ||||
| 			{ | ||||
| 				ContainerPath: testDevice.Path, | ||||
| 				HostPath:      testDevice.Path, | ||||
| 				Permissions:   "r", | ||||
| 			}, | ||||
| 		} | ||||
| 			spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{}) | ||||
| 			assert.NoError(t, err) | ||||
|  | ||||
| 		spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{}) | ||||
| 		assert.NoError(t, err) | ||||
|  | ||||
| 		assert.Equal(t, test.expectedDeviceUID, *spec.Linux.Devices[0].UID) | ||||
| 		assert.Equal(t, test.expectedDeviceGID, *spec.Linux.Devices[0].GID) | ||||
| 			assert.Equal(t, test.expectedDeviceUID, *spec.Linux.Devices[0].UID) | ||||
| 			assert.Equal(t, test.expectedDeviceGID, *spec.Linux.Devices[0].GID) | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -1434,38 +1443,37 @@ func TestPrivilegedDevices(t *testing.T) { | ||||
| 			expectAllDevicesAllowed: true, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", desc) | ||||
| 		t.Run(desc, func(t *testing.T) { | ||||
| 			containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 			sandboxConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
|  | ||||
| 		containerConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
| 		sandboxConfig.Linux.SecurityContext.Privileged = test.privileged | ||||
|  | ||||
| 		ociRuntime := config.Runtime{ | ||||
| 			PrivilegedWithoutHostDevices:                  test.privilegedWithoutHostDevices, | ||||
| 			PrivilegedWithoutHostDevicesAllDevicesAllowed: test.privilegedWithoutHostDevicesAllDevicesAllowed, | ||||
| 		} | ||||
| 		spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		assert.NoError(t, err) | ||||
|  | ||||
| 		hostDevicesRaw, err := oci.HostDevices() | ||||
| 		assert.NoError(t, err) | ||||
| 		var hostDevices = make([]string, 0) | ||||
| 		for _, dev := range hostDevicesRaw { | ||||
| 			// https://github.com/containerd/cri/pull/1521#issuecomment-652807951 | ||||
| 			if dev.Major != 0 { | ||||
| 				hostDevices = append(hostDevices, dev.Path) | ||||
| 			ociRuntime := config.Runtime{ | ||||
| 				PrivilegedWithoutHostDevices:                  test.privilegedWithoutHostDevices, | ||||
| 				PrivilegedWithoutHostDevicesAllDevicesAllowed: test.privilegedWithoutHostDevicesAllDevicesAllowed, | ||||
| 			} | ||||
| 		} | ||||
| 			spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			assert.NoError(t, err) | ||||
|  | ||||
| 		if test.expectHostDevices { | ||||
| 			assert.Len(t, spec.Linux.Devices, len(hostDevices)) | ||||
| 		} else { | ||||
| 			assert.Empty(t, spec.Linux.Devices) | ||||
| 		} | ||||
| 			hostDevicesRaw, err := oci.HostDevices() | ||||
| 			assert.NoError(t, err) | ||||
| 			var hostDevices = make([]string, 0) | ||||
| 			for _, dev := range hostDevicesRaw { | ||||
| 				// https://github.com/containerd/cri/pull/1521#issuecomment-652807951 | ||||
| 				if dev.Major != 0 { | ||||
| 					hostDevices = append(hostDevices, dev.Path) | ||||
| 				} | ||||
| 			} | ||||
|  | ||||
| 		assert.Len(t, spec.Linux.Resources.Devices, 1) | ||||
| 		assert.Equal(t, spec.Linux.Resources.Devices[0].Allow, test.expectAllDevicesAllowed) | ||||
| 		assert.Equal(t, spec.Linux.Resources.Devices[0].Access, "rwm") | ||||
| 			if test.expectHostDevices { | ||||
| 				assert.Len(t, spec.Linux.Devices, len(hostDevices)) | ||||
| 			} else { | ||||
| 				assert.Empty(t, spec.Linux.Devices) | ||||
| 			} | ||||
|  | ||||
| 			assert.Len(t, spec.Linux.Resources.Devices, 1) | ||||
| 			assert.Equal(t, spec.Linux.Resources.Devices[0].Allow, test.expectAllDevicesAllowed) | ||||
| 			assert.Equal(t, spec.Linux.Resources.Devices[0].Access, "rwm") | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|  | ||||
| @@ -1628,34 +1636,34 @@ containerEdits: | ||||
| 			}, | ||||
| 		}, | ||||
| 	} { | ||||
| 		t.Logf("TestCase %q", test.description) | ||||
| 		t.Run(test.description, func(t *testing.T) { | ||||
| 			spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 			require.NoError(t, err) | ||||
|  | ||||
| 		spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime) | ||||
| 		require.NoError(t, err) | ||||
| 			specCheck(t, testID, testSandboxID, testPid, spec) | ||||
|  | ||||
| 		specCheck(t, testID, testSandboxID, testPid, spec) | ||||
| 			cdiDir, err := writeFilesToTempDir("containerd-test-CDI-injections-", test.cdiSpecFiles) | ||||
| 			if cdiDir != "" { | ||||
| 				defer os.RemoveAll(cdiDir) | ||||
| 			} | ||||
| 			require.NoError(t, err) | ||||
|  | ||||
| 		cdiDir, err := writeFilesToTempDir("containerd-test-CDI-injections-", test.cdiSpecFiles) | ||||
| 		if cdiDir != "" { | ||||
| 			defer os.RemoveAll(cdiDir) | ||||
| 		} | ||||
| 		require.NoError(t, err) | ||||
| 			injectFun := oci.WithCDI(test.annotations, []string{cdiDir}) | ||||
| 			err = injectFun(nil, nil, nil, spec) | ||||
| 			assert.Equal(t, test.expectError, err != nil) | ||||
|  | ||||
| 		injectFun := oci.WithCDI(test.annotations, []string{cdiDir}) | ||||
| 		err = injectFun(nil, nil, nil, spec) | ||||
| 		assert.Equal(t, test.expectError, err != nil) | ||||
|  | ||||
| 		if err != nil { | ||||
| 			if test.expectEnv != nil { | ||||
| 				for _, expectedEnv := range test.expectEnv { | ||||
| 					assert.Contains(t, spec.Process.Env, expectedEnv) | ||||
| 			if err != nil { | ||||
| 				if test.expectEnv != nil { | ||||
| 					for _, expectedEnv := range test.expectEnv { | ||||
| 						assert.Contains(t, spec.Process.Env, expectedEnv) | ||||
| 					} | ||||
| 				} | ||||
| 				if test.expectDevices != nil { | ||||
| 					for _, expectedDev := range test.expectDevices { | ||||
| 						assert.Contains(t, spec.Linux.Devices, expectedDev) | ||||
| 					} | ||||
| 				} | ||||
| 			} | ||||
| 			if test.expectDevices != nil { | ||||
| 				for _, expectedDev := range test.expectDevices { | ||||
| 					assert.Contains(t, spec.Linux.Devices, expectedDev) | ||||
| 				} | ||||
| 			} | ||||
| 		} | ||||
| 		}) | ||||
| 	} | ||||
| } | ||||
|   | ||||
		Reference in New Issue
	
	Block a user
	 Daniel Canter
					Daniel Canter