github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use ipc-utils container in HostIPC tests.

Browse Source 
This ensures the `ipcs` command from util-linux will be used, which
succeeds when Docker is running with SELinux enabled (while the one from
busybox fails.)

Tested: On a host with Docker running with SELinux enabled:

  $ make test-e2e-node REMOTE=true FOCUS="host IPC"

  • [SLOW TEST:17.272 seconds] (passed)
  [k8s.io] Security Context
    when creating a pod in the host IPC namespace
      should show the shared memory ID in the host IPC containers

  • [SLOW TEST:20.419 seconds] (passed)
  [k8s.io] Security Context
    when creating a pod in the host IPC namespace
      should not show the shared memory ID in the non-hostIPC containers

  Ran 2 of 257 Specs in 43.934 seconds
  SUCCESS! -- 2 Passed | 0 Failed | 0 Pending | 255 Skipped
This commit is contained in:
Filipe Brandenburger
2018-01-22 14:44:36 -08:00
parent c9e5bfbbbb
commit 46a83c2883
3 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
test/e2e_node/security_context_test.go
View File

@@ -140,7 +140,7 @@ var _ = framework.KubeDescribe("Security Context", func() {
}
createAndWaitHostIPCPod := func(podName string, hostNetwork bool) {
podClient.Create(makeHostIPCPod(podName,
busyboxImage,
imageutils.GetE2EImage(imageutils.IpcUtils),
[]string{"sh", "-c", "ipcs -m | awk '{print $2}'"},
hostNetwork,
))
@@ -159,30 +159,30 @@ var _ = framework.KubeDescribe("Security Context", func() {
})
It("should show the shared memory ID in the host IPC containers", func() {
busyboxPodName := "busybox-hostipc-" + string(uuid.NewUUID())
createAndWaitHostIPCPod(busyboxPodName, true)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
ipcutilsPodName := "ipcutils-hostipc-" + string(uuid.NewUUID())
createAndWaitHostIPCPod(ipcutilsPodName, true)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, ipcutilsPodName, ipcutilsPodName)
if err != nil {
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
framework.Failf("GetPodLogs for pod %q failed: %v", ipcutilsPodName, err)
}
podSharedMemoryIDs := strings.TrimSpace(logs)
framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, busyboxPodName)
framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, ipcutilsPodName)
if !strings.Contains(podSharedMemoryIDs, hostSharedMemoryID) {
framework.Failf("hostIPC container should show shared memory IDs on host")
}
})
It("should not show the shared memory ID in the non-hostIPC containers", func() {
busyboxPodName := "busybox-non-hostipc-" + string(uuid.NewUUID())
createAndWaitHostIPCPod(busyboxPodName, false)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
ipcutilsPodName := "ipcutils-non-hostipc-" + string(uuid.NewUUID())
createAndWaitHostIPCPod(ipcutilsPodName, false)
logs, err := framework.GetPodLogs(f.ClientSet, f.Namespace.Name, ipcutilsPodName, ipcutilsPodName)
if err != nil {
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
framework.Failf("GetPodLogs for pod %q failed: %v", ipcutilsPodName, err)
}
podSharedMemoryIDs := strings.TrimSpace(logs)
framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, busyboxPodName)
framework.Logf("Got shared memory IDs %q from pod %q", podSharedMemoryIDs, ipcutilsPodName)
if strings.Contains(podSharedMemoryIDs, hostSharedMemoryID) {
framework.Failf("non-hostIPC container should not show shared memory IDs on host")
}