github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

e2e_node: skip proc mount tests on nodes without userns support in the runtime

Browse Source 
Signed-off-by: Peter Hunt <pehunt@redhat.com>
Co-authored-by: Sohan Kunkerkar <sohank2602@gmail.com>
This commit is contained in:
Peter Hunt
2024-03-04 15:41:41 -05:00
committed by Sohan Kunkerkar
parent 4f57a1448d
commit a20a8225cf
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
test/e2e_node/proc_mount_test.go
View File

@@ -28,6 +28,7 @@ import (
"k8s.io/kubernetes/test/e2e/feature" "k8s.io/kubernetes/test/e2e/feature"
"k8s.io/kubernetes/test/e2e/framework" "k8s.io/kubernetes/test/e2e/framework"
e2epod "k8s.io/kubernetes/test/e2e/framework/pod" e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
"k8s.io/kubernetes/test/e2e/nodefeature" "k8s.io/kubernetes/test/e2e/nodefeature"
testutils "k8s.io/kubernetes/test/utils" testutils "k8s.io/kubernetes/test/utils"
imageutils "k8s.io/kubernetes/test/utils/image" imageutils "k8s.io/kubernetes/test/utils/image"
@@ -50,6 +51,9 @@ var _ = SIGDescribe("ProcMount [LinuxOnly]", nodefeature.ProcMountType, nodefeat
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
f.It("will fail to unmask proc mounts if not privileged", func(ctx context.Context) { f.It("will fail to unmask proc mounts if not privileged", func(ctx context.Context) {
if !supportsUserNS(ctx, f) {
e2eskipper.Skipf("runtime does not support user namespaces")
}
pmt := v1.UnmaskedProcMount pmt := v1.UnmaskedProcMount
podClient := e2epod.NewPodClient(f) podClient := e2epod.NewPodClient(f)
_, err := podClient.PodInterface.Create(ctx, &v1.Pod{ _, err := podClient.PodInterface.Create(ctx, &v1.Pod{
@@ -79,6 +83,9 @@ var _ = SIGDescribe("ProcMount [LinuxOnly]", nodefeature.ProcMountType, nodefeat
f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
f.It("will unmask proc mounts if requested", func(ctx context.Context) { f.It("will unmask proc mounts if requested", func(ctx context.Context) {
if !supportsUserNS(ctx, f) {
e2eskipper.Skipf("runtime does not support user namespaces")
}
testProcMount(ctx, f, v1.UnmaskedProcMount, gomega.Equal(1), gomega.BeZero()) testProcMount(ctx, f, v1.UnmaskedProcMount, gomega.Equal(1), gomega.BeZero())
}) })
}) })
@@ -113,3 +120,17 @@ func testProcMount(ctx context.Context, f *framework.Framework, pmt v1.ProcMount
gomega.Expect(len(lines)).To(expectedLines) gomega.Expect(len(lines)).To(expectedLines)
gomega.Expect(strings.Count(output, "(ro")).To(expectedReadOnly) gomega.Expect(strings.Count(output, "(ro")).To(expectedReadOnly)
} }
func supportsUserNS(ctx context.Context, f *framework.Framework) bool {
nodeList, err := f.ClientSet.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
framework.ExpectNoError(err)
// Assuming that there is only one node, because this is a node e2e test.
gomega.Expect(nodeList.Items).To(gomega.HaveLen(1))
node := nodeList.Items[0]
for _, rc := range node.Status.RuntimeHandlers {
if rc.Name == "" && rc.Features != nil && *rc.Features.UserNamespaces {
return true
}
}
return false
}