Skip to content

Commit 052f1fe

Browse files
jsafranejsafrane
committed
Update tests
1 parent a86cca4 commit 052f1fe

File tree

3 files changed

+83
-46
lines changed

3 files changed

+83
-46
lines changed

‎pkg/controller/volume/selinuxwarning/cache/volumecache_test.go‎

Lines changed: 6 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -119,21 +119,21 @@ func TestVolumeCache_AddVolumeSendConflicts(t *testing.T) {
119119
podNamespace: "ns2",
120120
podName: "pod2-recursive",
121121
volumeName: "vol2",
122-
label: "system_u:system_r:label2",
122+
label: "", // labels on volumes with Recursive policy are cleared, we don't want the controller to report label conflicts on them
123123
changePolicy: v1.SELinuxChangePolicyRecursive,
124124
},
125125
{
126126
podNamespace: "ns3",
127127
podName: "pod3-1",
128128
volumeName: "vol3", // vol3 is used by 2 pods with the same label + recursive policy
129-
label: "system_u:system_r:label3",
129+
label: "", // labels on volumes with Recursive policy are cleared, we don't want the controller to report label conflicts on them
130130
changePolicy: v1.SELinuxChangePolicyRecursive,
131131
},
132132
{
133133
podNamespace: "ns3",
134134
podName: "pod3-2",
135135
volumeName: "vol3", // vol3 is used by 2 pods with the same label + recursive policy
136-
label: "system_u:system_r:label3",
136+
label: "", // labels on volumes with Recursive policy are cleared, we don't want the controller to report label conflicts on them
137137
changePolicy: v1.SELinuxChangePolicyRecursive,
138138
},
139139
{
@@ -244,34 +244,13 @@ func TestVolumeCache_AddVolumeSendConflicts(t *testing.T) {
244244
},
245245
},
246246
{
247-
name: "existing volume in a new pod with new conflicting policy and existing label",
247+
name: "existing volume in a new pod with new conflicting policy",
248248
initialPods: existingPods,
249249
podToAdd: podWithVolume{
250250
podNamespace: "testns",
251251
podName: "testpod",
252252
volumeName: "vol1",
253-
label: "system_u:system_r:label1",
254-
changePolicy: v1.SELinuxChangePolicyRecursive,
255-
},
256-
expectedConflicts: []Conflict{
257-
{
258-
PropertyName: "SELinuxChangePolicy",
259-
EventReason: "SELinuxChangePolicyConflict",
260-
Pod: cache.ObjectName{Namespace: "testns", Name: "testpod"},
261-
PropertyValue: "Recursive",
262-
OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod1-mountOption"},
263-
OtherPropertyValue: "MountOption",
264-
},
265-
},
266-
},
267-
{
268-
name: "existing volume in a new pod with new conflicting policy and new conflicting label",
269-
initialPods: existingPods,
270-
podToAdd: podWithVolume{
271-
podNamespace: "testns",
272-
podName: "testpod",
273-
volumeName: "vol1",
274-
label: "system_u:system_r:label-new",
253+
label: "",
275254
changePolicy: v1.SELinuxChangePolicyRecursive,
276255
},
277256
expectedConflicts: []Conflict{
@@ -283,14 +262,6 @@ func TestVolumeCache_AddVolumeSendConflicts(t *testing.T) {
283262
OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod1-mountOption"},
284263
OtherPropertyValue: "MountOption",
285264
},
286-
{
287-
PropertyName: "SELinuxLabel",
288-
EventReason: "SELinuxLabelConflict",
289-
Pod: cache.ObjectName{Namespace: "testns", Name: "testpod"},
290-
PropertyValue: "system_u:system_r:label-new",
291-
OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod1-mountOption"},
292-
OtherPropertyValue: "system_u:system_r:label1",
293-
},
294265
},
295266
},
296267
{
@@ -307,7 +278,7 @@ func TestVolumeCache_AddVolumeSendConflicts(t *testing.T) {
307278
expectedConflicts: nil,
308279
},
309280
{
310-
name: "existing pod is replaced with conflicting policy and label",
281+
name: "existing pod is replaced with conflicting policy",
311282
initialPods: existingPods,
312283
podToAdd: podWithVolume{
313284

@@ -326,14 +297,6 @@ func TestVolumeCache_AddVolumeSendConflicts(t *testing.T) {
326297
OtherPod: cache.ObjectName{Namespace: "ns3", Name: "pod3-2"},
327298
OtherPropertyValue: "Recursive",
328299
},
329-
{
330-
PropertyName: "SELinuxLabel",
331-
EventReason: "SELinuxLabelConflict",
332-
Pod: cache.ObjectName{Namespace: "ns3", Name: "pod3-1"},
333-
PropertyValue: "system_u:system_r:label-new",
334-
OtherPod: cache.ObjectName{Namespace: "ns3", Name: "pod3-2"},
335-
OtherPropertyValue: "system_u:system_r:label3",
336-
},
337300
},
338301
},
339302
{

‎pkg/controller/volume/selinuxwarning/selinux_warning_controller_test.go‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,17 @@ import (
2525
storagev1 "k8s.io/api/storage/v1"
2626
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2727
"k8s.io/apimachinery/pkg/util/sets"
28+
utilfeature "k8s.io/apiserver/pkg/util/feature"
2829
"k8s.io/client-go/informers"
2930
"k8s.io/client-go/kubernetes/fake"
3031
"k8s.io/client-go/tools/cache"
3132
"k8s.io/client-go/tools/record"
33+
featuregatetesting "k8s.io/component-base/featuregate/testing"
3234
"k8s.io/klog/v2"
3335
"k8s.io/klog/v2/ktesting"
3436
"k8s.io/kubernetes/pkg/controller"
3537
volumecache "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache"
38+
"k8s.io/kubernetes/pkg/features"
3639
"k8s.io/kubernetes/pkg/volume"
3740
volumetesting "k8s.io/kubernetes/pkg/volume/testing"
3841
"k8s.io/utils/ptr"
@@ -117,7 +120,7 @@ func TestSELinuxWarningController_Sync(t *testing.T) {
117120
{
118121
volumeName: "fake-plugin/pv1",
119122
podKey: cache.ObjectName{Namespace: namespace, Name: "pod1"},
120-
label: ":::s0:c1,c2",
123+
label: "", // Label is cleared with the Recursive policy
121124
changePolicy: v1.SELinuxChangePolicyRecursive,
122125
csiDriver: "ebs.csi.aws.com", // The PV is a fake EBS volume
123126
},
@@ -221,6 +224,75 @@ func TestSELinuxWarningController_Sync(t *testing.T) {
221224
`Normal SELinuxLabelConflict SELinuxLabel ":::s0:c98,c99" conflicts with pod pod1 that uses the same volume as this pod with SELinuxLabel ":::s0:c1,c2". If both pods land on the same node, only one of them may access the volume.`,
222225
},
223226
},
227+
{
228+
name: "existing pod with Recursive policy does not generate conflicts",
229+
existingPVCs: []*v1.PersistentVolumeClaim{
230+
pvcBoundToPV("pv1", "pvc1"),
231+
},
232+
existingPVs: []*v1.PersistentVolume{
233+
pvBoundToPVC("pv1", "pvc1"),
234+
},
235+
existingPods: []*v1.Pod{
236+
podWithPVC("pod1", "s0:c1,c2", ptr.To(v1.SELinuxChangePolicyRecursive), "pvc1", "vol1"),
237+
pod("pod2", "s0:c98,c99", ptr.To(v1.SELinuxChangePolicyRecursive)),
238+
},
239+
pod: cache.ObjectName{Namespace: namespace, Name: "pod1"},
240+
conflicts: []volumecache.Conflict{},
241+
expectedAddedVolumes: []addedVolume{
242+
{
243+
volumeName: "fake-plugin/pv1",
244+
podKey: cache.ObjectName{Namespace: namespace, Name: "pod1"},
245+
label: "", // Label is cleared with the Recursive policy
246+
changePolicy: v1.SELinuxChangePolicyRecursive,
247+
csiDriver: "ebs.csi.aws.com", // The PV is a fake EBS volume
248+
},
249+
},
250+
},
251+
{
252+
name: "existing pod with Recursive policy does not conflict with pod with MountOption policy label, only with the policy",
253+
existingPVCs: []*v1.PersistentVolumeClaim{
254+
pvcBoundToPV("pv1", "pvc1"),
255+
},
256+
existingPVs: []*v1.PersistentVolume{
257+
pvBoundToPVC("pv1", "pvc1"),
258+
},
259+
existingPods: []*v1.Pod{
260+
podWithPVC("pod1", "s0:c1,c2", ptr.To(v1.SELinuxChangePolicyRecursive), "pvc1", "vol1"),
261+
podWithPVC("pod2", "s0:c98,c99", ptr.To(v1.SELinuxChangePolicyMountOption), "pvc1", "vol1"),
262+
},
263+
pod: cache.ObjectName{Namespace: namespace, Name: "pod1"},
264+
conflicts: []volumecache.Conflict{
265+
{
266+
PropertyName: "SELinuxChangePolicy",
267+
EventReason: "SELinuxChangePolicyConflict",
268+
Pod: cache.ObjectName{Namespace: namespace, Name: "pod1"},
269+
PropertyValue: string(v1.SELinuxChangePolicyRecursive),
270+
OtherPod: cache.ObjectName{Namespace: namespace, Name: "pod2"},
271+
OtherPropertyValue: string(v1.SELinuxChangePolicyMountOption),
272+
},
273+
{
274+
PropertyName: "SELinuxChangePolicy",
275+
EventReason: "SELinuxChangePolicyConflict",
276+
Pod: cache.ObjectName{Namespace: namespace, Name: "pod2"},
277+
PropertyValue: string(v1.SELinuxChangePolicyMountOption),
278+
OtherPod: cache.ObjectName{Namespace: namespace, Name: "pod1"},
279+
OtherPropertyValue: string(v1.SELinuxChangePolicyRecursive),
280+
},
281+
},
282+
expectedAddedVolumes: []addedVolume{
283+
{
284+
volumeName: "fake-plugin/pv1",
285+
podKey: cache.ObjectName{Namespace: namespace, Name: "pod1"},
286+
label: "", // Label is cleared with the Recursive policy
287+
changePolicy: v1.SELinuxChangePolicyRecursive,
288+
csiDriver: "ebs.csi.aws.com", // The PV is a fake EBS volume
289+
},
290+
},
291+
expectedEvents: []string{
292+
`Normal SELinuxChangePolicyConflict SELinuxChangePolicy "Recursive" conflicts with pod pod2 that uses the same volume as this pod with SELinuxChangePolicy "MountOption". If both pods land on the same node, only one of them may access the volume.`,
293+
`Normal SELinuxChangePolicyConflict SELinuxChangePolicy "MountOption" conflicts with pod pod1 that uses the same volume as this pod with SELinuxChangePolicy "Recursive". If both pods land on the same node, only one of them may access the volume.`,
294+
},
295+
},
224296
{
225297
name: "existing pod with PVC generates conflict, the other pod doesn't exist",
226298
existingPVCs: []*v1.PersistentVolumeClaim{
@@ -281,6 +353,8 @@ func TestSELinuxWarningController_Sync(t *testing.T) {
281353

282354
for _, tt := range tests {
283355
t.Run(tt.name, func(t *testing.T) {
356+
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SELinuxChangePolicy, true)
357+
284358
_, ctx := ktesting.NewTestContext(t)
285359
_, plugin := volumetesting.GetTestKubeletVolumePluginMgr(t)
286360
plugin.SupportsSELinux = true

‎test/e2e/storage/csimock/csi_selinux_mount.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
506506
volumeMode: v1.ReadWriteOnce,
507507
waitForSecondPodStart: true,
508508
expectNodeIncreases: sets.New[string]( /* no metric is increased, admitted_total was already increased when the first pod started */ ),
509-
expectControllerConflictProperty: "SELinuxLabel", /* SELinuxController does emit a warning for Recursive policy, while kubelet does not! */
509+
expectControllerConflictProperty: "", /* SELinuxController does not emit any warning either */
510510
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMountReadWriteOncePod), framework.WithFeatureGate(features.SELinuxChangePolicy), feature.SELinuxMountReadWriteOncePodOnly},
511511
},
512512
{
@@ -595,7 +595,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
595595
volumeMode: v1.ReadWriteMany,
596596
waitForSecondPodStart: true,
597597
expectNodeIncreases: sets.New[string]( /* no metric is increased, admitted_total was already increased when the first pod started */ ),
598-
expectControllerConflictProperty: "SELinuxLabel", /* SELinuxController does emit a warning for Recursive policy, while kubelet does not! */
598+
expectControllerConflictProperty: "", /* SELinuxController does not emit any warning either */
599599
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMountReadWriteOncePod), framework.WithFeatureGate(features.SELinuxChangePolicy), framework.WithFeatureGate(features.SELinuxMount)},
600600
},
601601
{

0 commit comments

Comments
 (0)