github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Promote RunAsGroup to GA

Browse Source
This commit is contained in:
Mayank Kumar
2020-09-09 01:08:06 -07:00
parent 033d950152
commit 9a6f1e807e
7 changed files with 16 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
pkg/api/podsecuritypolicy/util_test.go
View File

@@ -108,86 +108,6 @@ func TestDropAllowedProcMountTypes(t *testing.T) {
}
}
func TestDropRunAsGroup(t *testing.T) {
group := func() *policy.RunAsGroupStrategyOptions {
return &policy.RunAsGroupStrategyOptions{}
}
scWithoutRunAsGroup := func() *policy.PodSecurityPolicySpec {
return &policy.PodSecurityPolicySpec{}
}
scWithRunAsGroup := func() *policy.PodSecurityPolicySpec {
return &policy.PodSecurityPolicySpec{
RunAsGroup: group(),
}
}
scInfo := []struct {
description string
hasRunAsGroup bool
sc func() *policy.PodSecurityPolicySpec
}{
{
description: "PodSecurityPolicySpec Without RunAsGroup",
hasRunAsGroup: false,
sc: scWithoutRunAsGroup,
},
{
description: "PodSecurityPolicySpec With RunAsGroup",
hasRunAsGroup: true,
sc: scWithRunAsGroup,
},
{
description: "is nil",
hasRunAsGroup: false,
sc: func() *policy.PodSecurityPolicySpec { return nil },
},
}
for _, enabled := range []bool{true, false} {
for _, oldPSPSpecInfo := range scInfo {
for _, newPSPSpecInfo := range scInfo {
oldPSPSpecHasRunAsGroup, oldPSPSpec := oldPSPSpecInfo.hasRunAsGroup, oldPSPSpecInfo.sc()
newPSPSpecHasRunAsGroup, newPSPSpec := newPSPSpecInfo.hasRunAsGroup, newPSPSpecInfo.sc()
if newPSPSpec == nil {
continue
}
t.Run(fmt.Sprintf("feature enabled=%v, old PodSecurityPolicySpec %v, new PodSecurityPolicySpec %v", enabled, oldPSPSpecInfo.description, newPSPSpecInfo.description), func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RunAsGroup, enabled)()
DropDisabledFields(newPSPSpec, oldPSPSpec)
// old PodSecurityPolicySpec should never be changed
if !reflect.DeepEqual(oldPSPSpec, oldPSPSpecInfo.sc()) {
t.Errorf("old PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(oldPSPSpec, oldPSPSpecInfo.sc()))
}
switch {
case enabled || oldPSPSpecHasRunAsGroup:
// new PodSecurityPolicySpec should not be changed if the feature is enabled, or if the old PodSecurityPolicySpec had RunAsGroup
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
}
case newPSPSpecHasRunAsGroup:
// new PodSecurityPolicySpec should be changed
if reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec was not changed")
}
// new PodSecurityPolicySpec should not have RunAsGroup
if !reflect.DeepEqual(newPSPSpec, scWithoutRunAsGroup()) {
t.Errorf("new PodSecurityPolicySpec had RunAsGroup: %v", diff.ObjectReflectDiff(newPSPSpec, scWithoutRunAsGroup()))
}
default:
// new PodSecurityPolicySpec should not need to be changed
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
}
}
})
}
}
}
}
func TestDropSysctls(t *testing.T) {
scWithSysctls := func() *policy.PodSecurityPolicySpec {
return &policy.PodSecurityPolicySpec{