github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CRI: move apparmor annotations to container security context

Browse Source
This commit is contained in:
Pengfei Ni
2017-05-01 20:55:16 +08:00
parent 08606b530b
commit ac76766a92
10 changed files with 363 additions and 321 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
pkg/kubelet/dockershim/helpers_test.go
View File

@@ -43,10 +43,10 @@ func TestLabelsAndAnnotationsRoundTrip(t *testing.T) {
assert.Equal(t, expectedAnnotations, actualAnnotations)
}
// TestGetContainerSecurityOpts tests the logic of generating container security options from sandbox annotations.
// TestGetSeccompSecurityOpts tests the logic of generating container seccomp options from sandbox annotations.
// The actual profile loading logic is tested in dockertools.
// TODO: Migrate the corresponding test to dockershim.
func TestGetContainerSecurityOpts(t *testing.T) {
func TestGetSeccompSecurityOpts(t *testing.T) {
containerName := "bar"
makeConfig := func(annotations map[string]string) *runtimeapi.PodSandboxConfig {
return makeSandboxConfigWithLabelsAndAnnotations("pod", "ns", "1234", 1, nil, annotations)
@@ -78,29 +78,10 @@ func TestGetContainerSecurityOpts(t *testing.T) {
v1.SeccompPodAnnotationKey: "docker/default",
}),
expectedOpts: nil,
}, {
msg: "AppArmor runtime/default",
config: makeConfig(map[string]string{
apparmor.ContainerAnnotationKeyPrefix + containerName: apparmor.ProfileRuntimeDefault,
}),
expectedOpts: []string{"seccomp=unconfined"},
}, {
msg: "AppArmor local profile",
config: makeConfig(map[string]string{
apparmor.ContainerAnnotationKeyPrefix + containerName: apparmor.ProfileNamePrefix + "foo",
}),
expectedOpts: []string{"seccomp=unconfined", "apparmor=foo"},
}, {
msg: "AppArmor and seccomp profile",
config: makeConfig(map[string]string{
v1.SeccompContainerAnnotationKeyPrefix + containerName: "docker/default",
apparmor.ContainerAnnotationKeyPrefix + containerName: apparmor.ProfileNamePrefix + "foo",
}),
expectedOpts: []string{"apparmor=foo"},
}}
for i, test := range tests {
opts, err := getContainerSecurityOpts(containerName, test.config, "test/seccomp/profile/root", '=')
opts, err := getSeccompSecurityOpts(containerName, test.config, "test/seccomp/profile/root", '=')
assert.NoError(t, err, "TestCase[%d]: %s", i, test.msg)
assert.Len(t, opts, len(test.expectedOpts), "TestCase[%d]: %s", i, test.msg)
for _, opt := range test.expectedOpts {
@@ -109,43 +90,36 @@ func TestGetContainerSecurityOpts(t *testing.T) {
}
}
// TestGetSandboxSecurityOpts tests the logic of generating sandbox security options from sandbox annotations.
func TestGetSandboxSecurityOpts(t *testing.T) {
makeConfig := func(annotations map[string]string) *runtimeapi.PodSandboxConfig {
return makeSandboxConfigWithLabelsAndAnnotations("pod", "ns", "1234", 1, nil, annotations)
// TestGetApparmorSecurityOpts tests the logic of generating container apparmor options from sandbox annotations.
// The actual profile loading logic is tested in dockertools.
// TODO: Migrate the corresponding test to dockershim.
func TestGetApparmorSecurityOpts(t *testing.T) {
makeConfig := func(profile string) *runtimeapi.LinuxContainerSecurityContext {
return &runtimeapi.LinuxContainerSecurityContext{
ApparmorProfile: profile,
}
}
tests := []struct {
msg string
config *runtimeapi.PodSandboxConfig
config *runtimeapi.LinuxContainerSecurityContext
expectedOpts []string
}{{
msg: "No security annotations",
config: makeConfig(nil),
expectedOpts: []string{"seccomp=unconfined"},
}, {
msg: "Seccomp default",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "docker/default",
}),
msg: "No AppArmor options",
config: makeConfig(""),
expectedOpts: nil,
}, {
msg: "Seccomp unconfined",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "unconfined",
}),
expectedOpts: []string{"seccomp=unconfined"},
msg: "AppArmor runtime/default",
config: makeConfig("runtime/default"),
expectedOpts: []string{},
}, {
msg: "Seccomp pod and container profile",
config: makeConfig(map[string]string{
v1.SeccompContainerAnnotationKeyPrefix + "test-container": "unconfined",
v1.SeccompPodAnnotationKey: "docker/default",
}),
expectedOpts: nil,
msg: "AppArmor local profile",
config: makeConfig(apparmor.ProfileNamePrefix + "foo"),
expectedOpts: []string{"apparmor=foo"},
}}
for i, test := range tests {
opts, err := getSandboxSecurityOpts(test.config, "test/seccomp/profile/root", '=')
opts, err := getApparmorSecurityOpts(test.config, '=')
assert.NoError(t, err, "TestCase[%d]: %s", i, test.msg)
assert.Len(t, opts, len(test.expectedOpts), "TestCase[%d]: %s", i, test.msg)
for _, opt := range test.expectedOpts {