e8d7835bc6
Automatic merge from submit-queue (batch tested with PRs 56579, 55236, 56512, 56549, 56538). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. security_context_test.go(TestVerifyRunAsNonRoot): remove unused variables **What this PR does / why we need it**: This PR removed unused member and related variables from the test. **Special notes for your reviewer**: It's better to review this PR in the mode that ignore whitespace-related changes: https://github.com/kubernetes/kubernetes/pull/56579/files?w=1 **Release note**: ```release-note NONE ``` CC @simo5
108 lines
2.4 KiB
Go
108 lines
2.4 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package kuberuntime
|
|
|
|
import (
|
|
"k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"testing"
|
|
)
|
|
|
|
func TestVerifyRunAsNonRoot(t *testing.T) {
|
|
pod := &v1.Pod{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
UID: "12345678",
|
|
Name: "bar",
|
|
Namespace: "new",
|
|
},
|
|
Spec: v1.PodSpec{
|
|
Containers: []v1.Container{
|
|
{
|
|
Name: "foo",
|
|
Image: "busybox",
|
|
ImagePullPolicy: v1.PullIfNotPresent,
|
|
Command: []string{"testCommand"},
|
|
WorkingDir: "testWorkingDir",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
rootUser := int64(0)
|
|
runAsNonRootTrue := true
|
|
runAsNonRootFalse := false
|
|
for _, test := range []struct {
|
|
desc string
|
|
sc *v1.SecurityContext
|
|
fail bool
|
|
}{
|
|
{
|
|
desc: "Pass if SecurityContext is not set",
|
|
sc: nil,
|
|
fail: false,
|
|
},
|
|
{
|
|
desc: "Pass if RunAsNonRoot is not set",
|
|
sc: &v1.SecurityContext{
|
|
RunAsUser: &rootUser,
|
|
},
|
|
fail: false,
|
|
},
|
|
{
|
|
desc: "Pass if RunAsNonRoot is false (image user is root)",
|
|
sc: &v1.SecurityContext{
|
|
RunAsNonRoot: &runAsNonRootFalse,
|
|
},
|
|
fail: false,
|
|
},
|
|
{
|
|
desc: "Pass if RunAsNonRoot is false (RunAsUser is root)",
|
|
sc: &v1.SecurityContext{
|
|
RunAsNonRoot: &runAsNonRootFalse,
|
|
RunAsUser: &rootUser,
|
|
},
|
|
fail: false,
|
|
},
|
|
{
|
|
desc: "Fail if container's RunAsUser is root and RunAsNonRoot is true",
|
|
sc: &v1.SecurityContext{
|
|
RunAsNonRoot: &runAsNonRootTrue,
|
|
RunAsUser: &rootUser,
|
|
},
|
|
fail: true,
|
|
},
|
|
{
|
|
desc: "Fail if image's user is root and RunAsNonRoot is true",
|
|
sc: &v1.SecurityContext{
|
|
RunAsNonRoot: &runAsNonRootTrue,
|
|
},
|
|
fail: true,
|
|
},
|
|
} {
|
|
pod.Spec.Containers[0].SecurityContext = test.sc
|
|
uid := int64(0)
|
|
err := verifyRunAsNonRoot(pod, &pod.Spec.Containers[0], &uid, "")
|
|
if test.fail {
|
|
assert.Error(t, err, test.desc)
|
|
} else {
|
|
assert.NoError(t, err, test.desc)
|
|
}
|
|
}
|
|
}
|