Skip to content

Commit f2c5eb4

Browse files
cognifloydcognifloyd
committed
Add unit tests for securityContext
1 parent e7203c8 commit f2c5eb4

File tree

1 file changed

+216
-0
lines changed

1 file changed

+216
-0
lines changed

‎tests/unit/security_context_test.yaml‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
---
2+
suite: Custom SecurityContext
3+
templates:
4+
# primary template files
5+
- deployments.yaml
6+
- jobs.yaml
7+
8+
# included templates must also be listed
9+
- configmaps_packs.yaml
10+
- configmaps_rbac.yaml
11+
- configmaps_st2-conf.yaml
12+
- configmaps_st2-urls.yaml
13+
- configmaps_st2web.yaml
14+
- secrets_datastore_crypto_key.yaml
15+
- secrets_ssh.yaml
16+
- secrets_st2apikeys.yaml
17+
- secrets_st2auth.yaml
18+
- secrets_st2chatops.yaml
19+
20+
tests:
21+
- it: Deployment and Job Pods+Containers have no SecurityContext by default
22+
templates:
23+
- deployments.yaml
24+
# st2auth, st2api,
25+
# st2stream, st2web,
26+
# st2rulesengine, st2timersengine,
27+
# st2workflowengine, st2scheduler,
28+
# st2notifier, (1) st2sensorcontainer,
29+
# st2actionrunner, st2garbagecollector,
30+
# st2client, st2chatops
31+
- jobs.yaml
32+
# job-st2-apply-rbac-defintions
33+
# job-st2-apikey-load
34+
# job-st2-key-load
35+
# job-st2-register-content
36+
set:
37+
st2chatops:
38+
enabled: true
39+
st2:
40+
packs: { sensors: [] } # ensure only 1 sensor
41+
rbac: { enabled: true } # enable rbac job
42+
43+
podSecurityContext: {}
44+
securityContext: {}
45+
46+
asserts:
47+
# pod
48+
- isNull:
49+
path: spec.template.spec.securityContext
50+
# container
51+
- isNull:
52+
path: 'spec.template.spec.containers[0].securityContext'
53+
# path can only select one element, not all initContainers (if present).
54+
#- isNull:
55+
# path: 'spec.template.spec.initContainers[].securityContext'
56+
57+
- it: Deployment and Job Pods+Containers use same SecurityContext when defined
58+
templates:
59+
- deployments.yaml
60+
# st2auth, st2api,
61+
# st2stream, st2web,
62+
# st2rulesengine, st2timersengine,
63+
# st2workflowengine, st2scheduler,
64+
# st2notifier, (1) st2sensorcontainer,
65+
# st2actionrunner, st2garbagecollector,
66+
# st2client, st2chatops
67+
- jobs.yaml
68+
# job-st2-apply-rbac-defintions
69+
# job-st2-apikey-load
70+
# job-st2-key-load
71+
# job-st2-register-content
72+
set:
73+
st2chatops:
74+
enabled: true
75+
st2:
76+
packs: { sensors: [] } # ensure only 1 sensor
77+
rbac: { enabled: true } # enable rbac job
78+
79+
podSecurityContext: &global_pod_security_context
80+
fsGroup: 1234
81+
supplementalGroups: [5678]
82+
securityContext: &global_security_context
83+
capabilities:
84+
drop: [ALL]
85+
86+
asserts:
87+
88+
# pod
89+
- equal:
90+
path: spec.template.spec.securityContext
91+
value: *global_pod_security_context
92+
# container
93+
- equal:
94+
path: spec.template.spec.containers[0].securityContext
95+
value: *global_security_context
96+
# path can only select one element, not all initContainers (if present).
97+
#- equal:
98+
# path: spec.template.spec.initContainers[].securityContext
99+
# value: *global_security_context
100+
101+
# overrides for st2web, st2actionrunner, st2sensorcontainer, st2client
102+
# document indexes: 3, 10, 9, 12
103+
104+
- it: Deployment Pod+Containers accept SecurityContext overrides
105+
template: deployments.yaml
106+
set:
107+
st2:
108+
packs: { sensors: [] } # ensure only 1 sensor
109+
rbac: { enabled: true } # enable rbac job
110+
111+
podSecurityContext: *global_pod_security_context
112+
securityContext: *global_security_context
113+
114+
st2web:
115+
podSecurityContext: &pod_security_context_override
116+
fsGroup: 9867
117+
supplementalGroups: [5432]
118+
securityContext: &security_context_override
119+
capabilities:
120+
drop: [ALL]
121+
add: [kill,net_raw]
122+
123+
st2actionrunner:
124+
podSecurityContext: *pod_security_context_override
125+
securityContext: *security_context_override
126+
127+
st2sensorcontainer:
128+
podSecurityContext: *pod_security_context_override
129+
securityContext: *security_context_override
130+
131+
st2client:
132+
podSecurityContext: *pod_security_context_override
133+
securityContext: *security_context_override
134+
asserts:
135+
- hasDocuments:
136+
count: 13
137+
138+
# st2web pod
139+
- notEqual: &global_pod_security_context_assert
140+
path: spec.template.spec.securityContext
141+
value: *global_pod_security_context
142+
documentIndex: 3
143+
- equal: &override_pod_security_context_assert
144+
path: spec.template.spec.securityContext
145+
value: *pod_security_context_override
146+
documentIndex: 3
147+
148+
# st2web container
149+
- notEqual: &global_container0_security_context_assert
150+
path: spec.template.spec.containers[0].securityContext
151+
value: *global_security_context
152+
documentIndex: 3
153+
- equal: &override_container0_security_context_assert
154+
path: spec.template.spec.containers[0].securityContext
155+
value: *security_context_override
156+
documentIndex: 3
157+
# path can only select one element, not all initContainers (if present).
158+
#- notEqual: &global_initcontainers_security_context_assert
159+
# path: spec.template.spec.initContainers[].securityContext
160+
# value: *global_security_context
161+
# documentIndex: 3
162+
#- equal: &override_initcontainers_security_context_assert
163+
# path: spec.template.spec.initContainers[].securityContext
164+
# value: *security_context_override
165+
# documentIndex: 3
166+
167+
# st2actionrunner pod
168+
- notEqual: *global_pod_security_context_assert
169+
documentIndex: 10
170+
- equal: *override_pod_security_context_assert
171+
documentIndex: 10
172+
173+
# st2actionrunner container
174+
- notEqual: *global_container0_security_context_assert
175+
documentIndex: 10
176+
- equal: *override_container0_security_context_assert
177+
documentIndex: 10
178+
# path can only select one element, not all initContainers (if present).
179+
#- notEqual: *global_initcontainers_security_context_assert
180+
# documentIndex: 10
181+
#- equal: *override_initcontainers_security_context_assert
182+
# documentIndex: 10
183+
184+
# st2sensorcontainer pod
185+
- notEqual: *global_pod_security_context_assert
186+
documentIndex: 9
187+
- equal: *override_pod_security_context_assert
188+
documentIndex: 9
189+
190+
# st2sensorcontainer container
191+
- notEqual: *global_container0_security_context_assert
192+
documentIndex: 9
193+
- equal: *override_container0_security_context_assert
194+
documentIndex: 9
195+
# path can only select one element, not all initContainers (if present).
196+
#- notEqual: *global_initcontainers_security_context_assert
197+
# documentIndex: 9
198+
#- equal: *override_initcontainers_security_context_assert
199+
# documentIndex: 9
200+
201+
# st2client pod
202+
- notEqual: *global_pod_security_context_assert
203+
documentIndex: 12
204+
- equal: *override_pod_security_context_assert
205+
documentIndex: 12
206+
207+
# st2client container
208+
- notEqual: *global_container0_security_context_assert
209+
documentIndex: 12
210+
- equal: *override_container0_security_context_assert
211+
documentIndex: 12
212+
# path can only select one element, not all initContainers (if present).
213+
#- notEqual: *global_initcontainers_security_context_assert
214+
# documentIndex: 12
215+
#- equal: *override_initcontainers_security_context_assert
216+
# documentIndex: 12

0 commit comments

Comments
 (0)