github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adding unit test coverage for API validation for emphermal contaienrs in hostprocess pods on Windows

Browse Source 
Signed-off-by: Mark Rossetti <marosset@microsoft.com>
This commit is contained in:
Mark Rossetti 2021-10-05 13:14:05 -07:00
parent 5889fb4fbc
commit 3ddff55fe6
1 changed files with 87 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
pkg/apis/core/validation/validation_test.go
View File

@ -18567,11 +18567,98 @@ func TestValidateWindowsHostProcessPod(t *testing.T) {
}},
},
},
{
name: "Non-HostProcess ephemeral container in HostProcess pod should not validate",
expectError: true,
featureEnabled: true,
allowPrivileged: true,
podSpec: &core.PodSpec{
SecurityContext: &core.PodSecurityContext{
HostNetwork: true,
WindowsOptions: &core.WindowsSecurityContextOptions{
HostProcess: &trueVar,
},
},
Containers: []core.Container{{
Name: containerName,
}},
EphemeralContainers: []core.EphemeralContainer{{
EphemeralContainerCommon: core.EphemeralContainerCommon{
SecurityContext: &core.SecurityContext{
WindowsOptions: &core.WindowsSecurityContextOptions{
HostProcess: &falseVar,
},
},
},
}},
},
},
{
name: "HostProcess ephemeral container in HostProcess pod should validate",
expectError: false,
featureEnabled: true,
allowPrivileged: true,
podSpec: &core.PodSpec{
SecurityContext: &core.PodSecurityContext{
HostNetwork: true,
WindowsOptions: &core.WindowsSecurityContextOptions{
HostProcess: &trueVar,
},
},
Containers: []core.Container{{
Name: containerName,
}},
EphemeralContainers: []core.EphemeralContainer{{
EphemeralContainerCommon: core.EphemeralContainerCommon{},
}},
},
},
{
name: "Non-HostProcess ephemeral container in Non-HostProcess pod should validate",
expectError: false,
featureEnabled: true,
allowPrivileged: true,
podSpec: &core.PodSpec{
Containers: []core.Container{{
Name: containerName,
}},
EphemeralContainers: []core.EphemeralContainer{{
EphemeralContainerCommon: core.EphemeralContainerCommon{
SecurityContext: &core.SecurityContext{
WindowsOptions: &core.WindowsSecurityContextOptions{
HostProcess: &falseVar,
},
},
},
}},
},
},
{
name: "HostProcess ephemeral container in Non-HostProcess pod should not validate",
expectError: true,
featureEnabled: true,
allowPrivileged: true,
podSpec: &core.PodSpec{
Containers: []core.Container{{
Name: containerName,
}},
EphemeralContainers: []core.EphemeralContainer{{
EphemeralContainerCommon: core.EphemeralContainerCommon{
SecurityContext: &core.SecurityContext{
WindowsOptions: &core.WindowsSecurityContextOptions{
HostProcess: &trueVar,
},
},
},
}},
},
},
}
for _, testCase := range testCases {
t.Run(testCase.name, func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.WindowsHostProcessContainers, testCase.featureEnabled)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.EphemeralContainers, true)()
opts := PodValidationOptions{AllowWindowsHostProcessField: testCase.featureEnabled}