Skip to content

Commit ea2dee6

Browse files
lunarwhitelunarwhite
authored
✨ feat: enforce restricted Pod Security Context Compliance in testing (#4435)
feat: enforce restricted Pod Security Context Compliance in testing
1 parent 814e0d7 commit ea2dee6

File tree

11 files changed

+261
-51
lines changed

11 files changed

+261
-51
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/test/e2e/e2e_test.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,20 @@ var _ = Describe("Manager", Ordered, func() {
4646
var controllerPodName string
4747

4848
// Before running the tests, set up the environment by creating the namespace,
49-
// installing CRDs, and deploying the controller.
49+
// enforce the restricted security policy to the namespace, installing CRDs,
50+
// and deploying the controller.
5051
BeforeAll(func() {
5152
By("creating manager namespace")
5253
cmd := exec.Command("kubectl", "create", "ns", namespace)
5354
_, err := utils.Run(cmd)
5455
Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
5556

57+
By("labeling the namespace to enforce the restricted security policy")
58+
cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
59+
"pod-security.kubernetes.io/enforce=restricted")
60+
_, err = utils.Run(cmd)
61+
Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
62+
5663
By("installing CRDs")
5764
cmd = exec.Command("make", "install")
5865
_, err = utils.Run(cmd)
@@ -209,10 +216,30 @@ var _ = Describe("Manager", Ordered, func() {
209216
By("creating the curl-metrics pod to access the metrics endpoint")
210217
cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never",
211218
"--namespace", namespace,
212-
"--image=curlimages/curl:7.78.0",
213-
"--", "/bin/sh", "-c", fmt.Sprintf(
214-
"curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics",
215-
token, metricsServiceName, namespace))
219+
"--image=curlimages/curl:latest",
220+
"--overrides",
221+
fmt.Sprintf(`{
222+
"spec": {
223+
"containers": [{
224+
"name": "curl",
225+
"image": "curlimages/curl:latest",
226+
"command": ["/bin/sh", "-c"],
227+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"],
228+
"securityContext": {
229+
"allowPrivilegeEscalation": false,
230+
"capabilities": {
231+
"drop": ["ALL"]
232+
},
233+
"runAsNonRoot": true,
234+
"runAsUser": 1000,
235+
"seccompProfile": {
236+
"type": "RuntimeDefault"
237+
}
238+
}
239+
}],
240+
"serviceAccount": "%s"
241+
}
242+
}`, token, metricsServiceName, namespace, serviceAccountName))
216243
_, err = utils.Run(cmd)
217244
Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod")
218245

‎docs/book/src/getting-started/testdata/project/test/e2e/e2e_test.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,20 @@ var _ = Describe("Manager", Ordered, func() {
4646
var controllerPodName string
4747

4848
// Before running the tests, set up the environment by creating the namespace,
49-
// installing CRDs, and deploying the controller.
49+
// enforce the restricted security policy to the namespace, installing CRDs,
50+
// and deploying the controller.
5051
BeforeAll(func() {
5152
By("creating manager namespace")
5253
cmd := exec.Command("kubectl", "create", "ns", namespace)
5354
_, err := utils.Run(cmd)
5455
Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
5556

57+
By("labeling the namespace to enforce the restricted security policy")
58+
cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
59+
"pod-security.kubernetes.io/enforce=restricted")
60+
_, err = utils.Run(cmd)
61+
Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
62+
5663
By("installing CRDs")
5764
cmd = exec.Command("make", "install")
5865
_, err = utils.Run(cmd)
@@ -209,10 +216,30 @@ var _ = Describe("Manager", Ordered, func() {
209216
By("creating the curl-metrics pod to access the metrics endpoint")
210217
cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never",
211218
"--namespace", namespace,
212-
"--image=curlimages/curl:7.78.0",
213-
"--", "/bin/sh", "-c", fmt.Sprintf(
214-
"curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics",
215-
token, metricsServiceName, namespace))
219+
"--image=curlimages/curl:latest",
220+
"--overrides",
221+
fmt.Sprintf(`{
222+
"spec": {
223+
"containers": [{
224+
"name": "curl",
225+
"image": "curlimages/curl:latest",
226+
"command": ["/bin/sh", "-c"],
227+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"],
228+
"securityContext": {
229+
"allowPrivilegeEscalation": false,
230+
"capabilities": {
231+
"drop": ["ALL"]
232+
},
233+
"runAsNonRoot": true,
234+
"runAsUser": 1000,
235+
"seccompProfile": {
236+
"type": "RuntimeDefault"
237+
}
238+
}
239+
}],
240+
"serviceAccount": "%s"
241+
}
242+
}`, token, metricsServiceName, namespace, serviceAccountName))
216243
_, err = utils.Run(cmd)
217244
Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod")
218245

‎docs/book/src/multiversion-tutorial/testdata/project/test/e2e/e2e_test.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,20 @@ var _ = Describe("Manager", Ordered, func() {
4646
var controllerPodName string
4747

4848
// Before running the tests, set up the environment by creating the namespace,
49-
// installing CRDs, and deploying the controller.
49+
// enforce the restricted security policy to the namespace, installing CRDs,
50+
// and deploying the controller.
5051
BeforeAll(func() {
5152
By("creating manager namespace")
5253
cmd := exec.Command("kubectl", "create", "ns", namespace)
5354
_, err := utils.Run(cmd)
5455
Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
5556

57+
By("labeling the namespace to enforce the restricted security policy")
58+
cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
59+
"pod-security.kubernetes.io/enforce=restricted")
60+
_, err = utils.Run(cmd)
61+
Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
62+
5663
By("installing CRDs")
5764
cmd = exec.Command("make", "install")
5865
_, err = utils.Run(cmd)
@@ -209,10 +216,30 @@ var _ = Describe("Manager", Ordered, func() {
209216
By("creating the curl-metrics pod to access the metrics endpoint")
210217
cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never",
211218
"--namespace", namespace,
212-
"--image=curlimages/curl:7.78.0",
213-
"--", "/bin/sh", "-c", fmt.Sprintf(
214-
"curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics",
215-
token, metricsServiceName, namespace))
219+
"--image=curlimages/curl:latest",
220+
"--overrides",
221+
fmt.Sprintf(`{
222+
"spec": {
223+
"containers": [{
224+
"name": "curl",
225+
"image": "curlimages/curl:latest",
226+
"command": ["/bin/sh", "-c"],
227+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"],
228+
"securityContext": {
229+
"allowPrivilegeEscalation": false,
230+
"capabilities": {
231+
"drop": ["ALL"]
232+
},
233+
"runAsNonRoot": true,
234+
"runAsUser": 1000,
235+
"seccompProfile": {
236+
"type": "RuntimeDefault"
237+
}
238+
}
239+
}],
240+
"serviceAccount": "%s"
241+
}
242+
}`, token, metricsServiceName, namespace, serviceAccountName))
216243
_, err = utils.Run(cmd)
217244
Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod")
218245

‎docs/book/src/reference/metrics.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ spec:
113113
serviceAccountName: controller-manager
114114
containers:
115115
- name: metrics-consumer
116-
image: curlimages/curl:7.78.0
116+
image: curlimages/curl:latest
117117
command: ["/bin/sh"]
118118
args:
119119
- "-c"

‎pkg/plugins/golang/v4/scaffolds/internal/templates/test/e2e/test.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -207,13 +207,20 @@ var _ = Describe("Manager", Ordered, func() {
207207
var controllerPodName string
208208
209209
// Before running the tests, set up the environment by creating the namespace,
210-
// installing CRDs, and deploying the controller.
210+
// enforce the restricted security policy to the namespace, installing CRDs,
211+
// and deploying the controller.
211212
BeforeAll(func() {
212213
By("creating manager namespace")
213214
cmd := exec.Command("kubectl", "create", "ns", namespace)
214215
_, err := utils.Run(cmd)
215216
Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
216217
218+
By("labeling the namespace to enforce the restricted security policy")
219+
cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
220+
"pod-security.kubernetes.io/enforce=restricted")
221+
_, err = utils.Run(cmd)
222+
Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
223+
217224
By("installing CRDs")
218225
cmd = exec.Command("make", "install")
219226
_, err = utils.Run(cmd)
@@ -370,10 +377,30 @@ var _ = Describe("Manager", Ordered, func() {
370377
By("creating the curl-metrics pod to access the metrics endpoint")
371378
cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never",
372379
"--namespace", namespace,
373-
"--image=curlimages/curl:7.78.0",
374-
"--", "/bin/sh", "-c", fmt.Sprintf(
375-
"curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics",
376-
token, metricsServiceName, namespace))
380+
"--image=curlimages/curl:latest",
381+
"--overrides",
382+
fmt.Sprintf(` + "`" + `{
383+
"spec": {
384+
"containers": [{
385+
"name": "curl",
386+
"image": "curlimages/curl:latest",
387+
"command": ["/bin/sh", "-c"],
388+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"],
389+
"securityContext": {
390+
"allowPrivilegeEscalation": false,
391+
"capabilities": {
392+
"drop": ["ALL"]
393+
},
394+
"runAsNonRoot": true,
395+
"runAsUser": 1000,
396+
"seccompProfile": {
397+
"type": "RuntimeDefault"
398+
}
399+
}
400+
}],
401+
"serviceAccount": "%s"
402+
}
403+
}` + "`" + `, token, metricsServiceName, namespace, serviceAccountName))
377404
_, err = utils.Run(cmd)
378405
Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod")
379406

‎test/e2e/deployimage/plugin_cluster_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,8 @@ func Run(kbc *utils.TestContext) {
9393

9494
By("deploying the controller-manager")
9595
cmd := exec.Command("make", "deploy", "IMG="+kbc.ImageName)
96-
Expect(kbc.Run(cmd)).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
96+
out, _ := kbc.Run(cmd)
97+
Expect(string(out)).NotTo(ContainSubstring("Warning: would violate PodSecurity"))
9798

9899
By("validating that the controller-manager pod is running as expected")
99100
verifyControllerUp := func(g Gomega) {

‎test/e2e/utils/test_context.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -252,18 +252,18 @@ func (t *TestContext) CreateManagerNamespace() error {
252252
return err
253253
}
254254

255-
// LabelNamespacesToWarnAboutRestricted will label all namespaces so that we can verify
256-
// if a warning with `Warning: would violate PodSecurity` will be raised when the manifests are applied
257-
func (t *TestContext) LabelNamespacesToWarnAboutRestricted() error {
255+
// LabelNamespacesToEnforceRestricted will label specified namespaces so that we can verify
256+
// if the manifests can be applied in restricted environments with strict security policy enforced
257+
func (t *TestContext) LabelNamespacesToEnforceRestricted() error {
258258
_, err := t.Kubectl.Command("label", "--overwrite", "ns", t.Kubectl.Namespace,
259-
"pod-security.kubernetes.io/warn=restricted")
259+
"pod-security.kubernetes.io/enforce=restricted")
260260
return err
261261
}
262262

263-
// RemoveNamespaceLabelToWarnAboutRestricted will remove the `pod-security.kubernetes.io/warn` label
263+
// RemoveNamespaceLabelToEnforceRestricted will remove the `pod-security.kubernetes.io/enforce` label
264264
// from the specified namespace
265-
func (t *TestContext) RemoveNamespaceLabelToWarnAboutRestricted() error {
266-
_, err := t.Kubectl.Command("label", "ns", t.Kubectl.Namespace, "pod-security.kubernetes.io/warn-")
265+
func (t *TestContext) RemoveNamespaceLabelToEnforceRestricted() error {
266+
_, err := t.Kubectl.Command("label", "ns", t.Kubectl.Namespace, "pod-security.kubernetes.io/enforce-")
267267
return err
268268
}
269269

‎test/e2e/v4/plugin_cluster_test.go

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ var _ = Describe("kubebuilder", func() {
5858

5959
AfterEach(func() {
6060
By("By removing restricted namespace label")
61-
_ = kbc.RemoveNamespaceLabelToWarnAboutRestricted()
61+
_ = kbc.RemoveNamespaceLabelToEnforceRestricted()
6262

6363
By("clean up API objects created during the test")
6464
_ = kbc.Make("undeploy")
@@ -114,8 +114,8 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, isToUseHelmChart,
114114
err = kbc.CreateManagerNamespace()
115115
ExpectWithOffset(1, err).NotTo(HaveOccurred())
116116

117-
By("labeling all namespaces to warn about restricted")
118-
err = kbc.LabelNamespacesToWarnAboutRestricted()
117+
By("labeling the namespace to enforce the restricted security policy")
118+
err = kbc.LabelNamespacesToEnforceRestricted()
119119
ExpectWithOffset(1, err).NotTo(HaveOccurred())
120120

121121
By("updating the go.mod")
@@ -581,10 +581,30 @@ func cmdOptsToCreateCurlPod(kbc *utils.TestContext, token string) []string {
581581
"run", "curl",
582582
"--restart=Never",
583583
"--namespace", kbc.Kubectl.Namespace,
584-
"--image=curlimages/curl:7.78.0",
585-
"--",
586-
"/bin/sh", "-c", fmt.Sprintf("curl -v -k -H 'Authorization: Bearer %s' https://e2e-%s-controller-manager-metrics-service.%s.svc.cluster.local:8443/metrics",
587-
token, kbc.TestSuffix, kbc.Kubectl.Namespace),
584+
"--image=curlimages/curl:latest",
585+
"--overrides",
586+
fmt.Sprintf(`{
587+
"spec": {
588+
"containers": [{
589+
"name": "curl",
590+
"image": "curlimages/curl:latest",
591+
"command": ["/bin/sh", "-c"],
592+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://e2e-%s-controller-manager-metrics-service.%s.svc.cluster.local:8443/metrics"],
593+
"securityContext": {
594+
"allowPrivilegeEscalation": false,
595+
"capabilities": {
596+
"drop": ["ALL"]
597+
},
598+
"runAsNonRoot": true,
599+
"runAsUser": 1000,
600+
"seccompProfile": {
601+
"type": "RuntimeDefault"
602+
}
603+
}
604+
}],
605+
"serviceAccount": "%s"
606+
}
607+
}`, token, kbc.TestSuffix, kbc.Kubectl.Namespace, kbc.Kubectl.ServiceAccount),
588608
}
589609
return cmdOpts
590610
}

‎testdata/project-v4-multigroup/test/e2e/e2e_test.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,20 @@ var _ = Describe("Manager", Ordered, func() {
4646
var controllerPodName string
4747

4848
// Before running the tests, set up the environment by creating the namespace,
49-
// installing CRDs, and deploying the controller.
49+
// enforce the restricted security policy to the namespace, installing CRDs,
50+
// and deploying the controller.
5051
BeforeAll(func() {
5152
By("creating manager namespace")
5253
cmd := exec.Command("kubectl", "create", "ns", namespace)
5354
_, err := utils.Run(cmd)
5455
Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
5556

57+
By("labeling the namespace to enforce the restricted security policy")
58+
cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace,
59+
"pod-security.kubernetes.io/enforce=restricted")
60+
_, err = utils.Run(cmd)
61+
Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy")
62+
5663
By("installing CRDs")
5764
cmd = exec.Command("make", "install")
5865
_, err = utils.Run(cmd)
@@ -209,10 +216,30 @@ var _ = Describe("Manager", Ordered, func() {
209216
By("creating the curl-metrics pod to access the metrics endpoint")
210217
cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never",
211218
"--namespace", namespace,
212-
"--image=curlimages/curl:7.78.0",
213-
"--", "/bin/sh", "-c", fmt.Sprintf(
214-
"curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics",
215-
token, metricsServiceName, namespace))
219+
"--image=curlimages/curl:latest",
220+
"--overrides",
221+
fmt.Sprintf(`{
222+
"spec": {
223+
"containers": [{
224+
"name": "curl",
225+
"image": "curlimages/curl:latest",
226+
"command": ["/bin/sh", "-c"],
227+
"args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"],
228+
"securityContext": {
229+
"allowPrivilegeEscalation": false,
230+
"capabilities": {
231+
"drop": ["ALL"]
232+
},
233+
"runAsNonRoot": true,
234+
"runAsUser": 1000,
235+
"seccompProfile": {
236+
"type": "RuntimeDefault"
237+
}
238+
}
239+
}],
240+
"serviceAccount": "%s"
241+
}
242+
}`, token, metricsServiceName, namespace, serviceAccountName))
216243
_, err = utils.Run(cmd)
217244
Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod")
218245

0 commit comments

Comments
 (0)