Skip to content

Commit fc8f84b

Browse files
zhaohuabingzhaohuabing
authored
chore: fix wasm file cache directory permission (envoyproxy#6173)
* fix wasm file cache directory permission Signed-off-by: Huabing (Robin) Zhao <[email protected]>
1 parent 419ed2a commit fc8f84b

File tree

3 files changed

+122
-3
lines changed

3 files changed

+122
-3
lines changed

‎test/e2e/testdata/custom-container-security-contex-userid.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# This test is to verify that the basic http route works with EG having custom security context user id
2+
# The custom security context user id is set to 65534 in the test go code
3+
apiVersion: gateway.networking.k8s.io/v1
4+
kind: HTTPRoute
5+
metadata:
6+
name: custom-eg-security-context-userid
7+
namespace: gateway-conformance-infra
8+
spec:
9+
parentRefs:
10+
- name: same-namespace
11+
rules:
12+
- backendRefs:
13+
- name: infra-backend-v1
14+
port: 8080

‎test/e2e/tests/httproute_with_custom_security_context_userid.go‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Copyright Envoy Gateway Authors
2+
// SPDX-License-Identifier: Apache-2.0
3+
// The full text of the Apache license is available in the LICENSE file at
4+
// the root of the repo.
5+
6+
//go:build e2e
7+
8+
package tests
9+
10+
import (
11+
"context"
12+
"testing"
13+
14+
"github.com/stretchr/testify/require"
15+
appsv1 "k8s.io/api/apps/v1"
16+
corev1 "k8s.io/api/core/v1"
17+
"k8s.io/apimachinery/pkg/types"
18+
"k8s.io/utils/ptr"
19+
"sigs.k8s.io/controller-runtime/pkg/client"
20+
"sigs.k8s.io/gateway-api/conformance/utils/http"
21+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
22+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
23+
)
24+
25+
func init() {
26+
ConformanceTests = append(ConformanceTests, EnvoyGatewayCustomSecurityContextUseridTest)
27+
}
28+
29+
var EnvoyGatewayCustomSecurityContextUseridTest = suite.ConformanceTest{
30+
ShortName: "EnvoyGatewayCustomSecurityContextUserid",
31+
Description: "Envoy Gateway container with custom security context user id",
32+
Manifests: []string{
33+
"testdata/custom-container-security-contex-userid.yaml",
34+
},
35+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
36+
t.Run("route with custom security context user id", func(t *testing.T) {
37+
// set envoy-gateway deployment security context user id to 65534 to test custom user has the necessary permissions
38+
// to run the envoy-gateway container
39+
setEGSecurityContextUserID(t, suite, 65534)
40+
41+
ns := "gateway-conformance-infra"
42+
routeNN := types.NamespacedName{Name: "custom-eg-security-context-userid", Namespace: ns}
43+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
44+
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
45+
46+
expectedResponse := http.ExpectedResponse{
47+
Request: http.Request{
48+
Path: "/",
49+
},
50+
Response: http.Response{
51+
StatusCode: 200,
52+
},
53+
Namespace: ns,
54+
}
55+
56+
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
57+
58+
// reset envoy-gateway deployment security context user id to the default value 65532
59+
setEGSecurityContextUserID(t, suite, 65532)
60+
// We have to manually delete the envoy proxy deployment to ensure that the test suite can clean up properly.
61+
// This is because the rollout restart of the envoy-gateway deployment may cause Envoy Gateway fail to delete
62+
// the envoy proxy deployments after the Gateway resources are deleted in ControllerNamspace mod, which can
63+
// lead to failure of the upgrade test.
64+
if suite.Cleanup {
65+
proxies := appsv1.DeploymentList{}
66+
err := suite.Client.List(
67+
context.Background(),
68+
&proxies,
69+
client.InNamespace("envoy-gateway-system"),
70+
client.MatchingLabels{"app.kubernetes.io/component": "proxy", "app.kubernetes.io/managed-by": "envoy-gateway"})
71+
require.NoError(t, err, "failed to list envoy proxy deployments")
72+
for _, proxy := range proxies.Items {
73+
err = suite.Client.Delete(context.Background(), &proxy)
74+
require.NoError(t, err, "failed to delete envoy proxy deployment %s", proxy.Name)
75+
}
76+
}
77+
})
78+
},
79+
}
80+
81+
func setEGSecurityContextUserID(t *testing.T, suite *suite.ConformanceTestSuite, uid int64) {
82+
// update envoy-gateway deployment with custom security context user id
83+
egDeployment := &appsv1.Deployment{}
84+
err := suite.Client.Get(
85+
context.Background(),
86+
types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
87+
egDeployment)
88+
require.NoError(t, err)
89+
egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To(uid)
90+
egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup = ptr.To(uid)
91+
err = suite.Client.Update(context.Background(), egDeployment)
92+
require.NoError(t, err)
93+
// test that envoy-gateway pod is running with custom security context user id
94+
WaitForPods(t, suite.Client, "envoy-gateway-system", map[string]string{"control-plane": "envoy-gateway"}, corev1.PodRunning, PodReady)
95+
96+
// test that envoy-gateway deployment is updated with custom security context user id
97+
egDeployment = &appsv1.Deployment{}
98+
err = suite.Client.Get(
99+
context.Background(),
100+
types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
101+
egDeployment)
102+
require.NoError(t, err)
103+
require.Equal(t, uid, *egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser, "envoy-gateway deployment is not updated with custom security context user id")
104+
require.Equal(t, uid, *egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup, "envoy-gateway deployment is not updated with custom security context group id")
105+
}

‎tools/docker/envoy-gateway/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
FROM busybox@sha256:37f7b378a29ceb4c551b1b5582e27747b855bbfaa73fa11914fe0df028dc581f AS source
22
# Create the data directory for eg
3-
RUN mkdir -p /var/lib/eg
3+
RUN mkdir -p /var/lib/eg && chmod -R 0777 /var/lib/eg
44

55
# Use distroless as minimal base image to package the manager binary
66
# Refer to https://github.com/GoogleContainerTools/distroless for more details
77
FROM gcr.io/distroless/base-nossl:nonroot@sha256:ecbab76d6a504ddf7c58a9d786e70f1f1731fa546b1ac0b20dab35c6fc2f3138
88
ARG TARGETPLATFORM
9-
COPY --chown=65532:65532 $TARGETPLATFORM/envoy-gateway /usr/local/bin/
10-
COPY --from=source --chown=65532:65532 /var/lib /var/lib
9+
COPY $TARGETPLATFORM/envoy-gateway /usr/local/bin/
10+
COPY --from=source /var/lib /var/lib
1111

1212
USER 65532:65532
1313

0 commit comments

Comments
 (0)