Skip to content

Commit a00c834

Browse files
authored
Merge pull request kubernetes#123303 from haircommander/proc-mount-e2e-tests
KEP-4265: add e2e tests for ProcMountType
2 parents 52c0ed4 + a20a822 commit a00c834

File tree

3 files changed

+166
-1
lines changed

3 files changed

+166
-1
lines changed

test/e2e/nodefeature/nodefeature.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ var (
8888
// RecursiveReadOnlyMounts (SIG-node, used for testing recursive read-only mounts <https://kep.k8s.io/3857>)
8989
RecursiveReadOnlyMounts = framework.WithNodeFeature(framework.ValidNodeFeatures.Add("RecursiveReadOnlyMounts"))
9090

91+
// TODO: document the feature (owning SIG, when to use this feature for a test)
92+
ProcMountType = framework.WithNodeFeature(framework.ValidNodeFeatures.Add("ProcMountType"))
93+
9194
// TODO: document the feature (owning SIG, when to use this feature for a test)
9295
ResourceMetrics = framework.WithNodeFeature(framework.ValidNodeFeatures.Add("ResourceMetrics"))
9396

@@ -104,6 +107,8 @@ var (
104107
// TODO: document the feature (owning SIG, when to use this feature for a test)
105108
SystemNodeCriticalPod = framework.WithNodeFeature(framework.ValidNodeFeatures.Add("SystemNodeCriticalPod"))
106109

110+
// TODO: document the feature (owning SIG, when to use this feature for a test)
111+
UserNamespacesSupport = framework.WithNodeFeature(framework.ValidNodeFeatures.Add("UserNamespacesSupport"))
107112
// Please keep the list in alphabetical order.
108113
)
109114

test/e2e/windows/security_context.go

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ var _ = sigDescribe(feature.Windows, "SecurityContext", skipUnlessWindows(func()
136136
e2eoutput.TestContainerOutput(ctx, f, "check pod SecurityContext username", pod, 1, []string{"ContainerAdministrator"})
137137
})
138138

139-
ginkgo.It("should ignore Linux Specific SecurityContext if set", func(ctx context.Context) {
139+
ginkgo.It("should ignore SELinux Specific SecurityContext if set", func(ctx context.Context) {
140140
ginkgo.By("Creating a pod with SELinux options")
141141
// It is sufficient to show that the pod comes up here. Since we're stripping the SELinux and other linux
142142
// security contexts in apiserver and not updating the pod object in the apiserver, we cannot validate the
@@ -160,6 +160,30 @@ var _ = sigDescribe(feature.Windows, "SecurityContext", skipUnlessWindows(func()
160160
f.Namespace.Name), "failed to wait for pod %s to be running", windowsPodWithSELinux.Name)
161161
})
162162

163+
ginkgo.It("should ignore ProcMount Specific SecurityContext if set", func(ctx context.Context) {
164+
ginkgo.By("Creating a pod with ProcMount options")
165+
// It is sufficient to show that the pod comes up here. Since we're stripping the SELinux and other linux
166+
// security contexts in apiserver and not updating the pod object in the apiserver, we cannot validate the
167+
// pod object to not have those security contexts. However the pod coming to running state is a sufficient
168+
// enough condition for us to validate since prior to https://github.com/kubernetes/kubernetes/pull/93475
169+
// the pod would have failed to come up.
170+
windowsPodWithSELinux := createTestPod(f, imageutils.GetE2EImage(imageutils.Agnhost), windowsOS)
171+
windowsPodWithSELinux.Spec.Containers[0].Args = []string{"test-webserver-with-selinux"}
172+
windowsPodWithSELinux.Spec.SecurityContext = &v1.PodSecurityContext{}
173+
pmt := v1.UnmaskedProcMount
174+
containerUserName := "ContainerAdministrator"
175+
windowsPodWithSELinux.Spec.Containers[0].SecurityContext = &v1.SecurityContext{
176+
ProcMount: &pmt,
177+
WindowsOptions: &v1.WindowsSecurityContextOptions{RunAsUserName: &containerUserName}}
178+
windowsPodWithSELinux.Spec.Tolerations = []v1.Toleration{{Key: "os", Value: "Windows"}}
179+
windowsPodWithSELinux, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(ctx,
180+
windowsPodWithSELinux, metav1.CreateOptions{})
181+
framework.ExpectNoError(err)
182+
framework.Logf("Created pod %v", windowsPodWithSELinux)
183+
framework.ExpectNoError(e2epod.WaitForPodNameRunningInNamespace(ctx, f.ClientSet, windowsPodWithSELinux.Name,
184+
f.Namespace.Name), "failed to wait for pod %s to be running", windowsPodWithSELinux.Name)
185+
})
186+
163187
ginkgo.It("should not be able to create pods with containers running as ContainerAdministrator when runAsNonRoot is true", func(ctx context.Context) {
164188
ginkgo.By("Creating a pod")
165189

test/e2e_node/proc_mount_test.go

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
/*
2+
Copyright 2024 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package e2enode
18+
19+
import (
20+
"context"
21+
"strings"
22+
23+
"github.com/onsi/ginkgo/v2"
24+
"github.com/onsi/gomega"
25+
gomegatypes "github.com/onsi/gomega/types"
26+
v1 "k8s.io/api/core/v1"
27+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
28+
"k8s.io/kubernetes/test/e2e/feature"
29+
"k8s.io/kubernetes/test/e2e/framework"
30+
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
31+
e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
32+
"k8s.io/kubernetes/test/e2e/nodefeature"
33+
testutils "k8s.io/kubernetes/test/utils"
34+
imageutils "k8s.io/kubernetes/test/utils/image"
35+
admissionapi "k8s.io/pod-security-admission/api"
36+
)
37+
38+
var falseVar = false
39+
40+
var _ = SIGDescribe("DefaultProcMount [LinuxOnly]", framework.WithNodeConformance(), func() {
41+
f := framework.NewDefaultFramework("proc-mount-default-test")
42+
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
43+
44+
ginkgo.It("will mask proc mounts by default", func(ctx context.Context) {
45+
testProcMount(ctx, f, v1.DefaultProcMount, gomega.BeNumerically(">=", 10), gomega.BeNumerically(">=", 7))
46+
})
47+
})
48+
49+
var _ = SIGDescribe("ProcMount [LinuxOnly]", nodefeature.ProcMountType, nodefeature.UserNamespacesSupport, feature.UserNamespacesSupport, func() {
50+
f := framework.NewDefaultFramework("proc-mount-baseline-test")
51+
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
52+
53+
f.It("will fail to unmask proc mounts if not privileged", func(ctx context.Context) {
54+
if !supportsUserNS(ctx, f) {
55+
e2eskipper.Skipf("runtime does not support user namespaces")
56+
}
57+
pmt := v1.UnmaskedProcMount
58+
podClient := e2epod.NewPodClient(f)
59+
_, err := podClient.PodInterface.Create(ctx, &v1.Pod{
60+
ObjectMeta: metav1.ObjectMeta{Name: "proc-mount-pod"},
61+
Spec: v1.PodSpec{
62+
Containers: []v1.Container{
63+
{
64+
Name: "test-container-1",
65+
Image: imageutils.GetE2EImage(imageutils.BusyBox),
66+
Command: []string{"/bin/sleep"},
67+
Args: []string{"10000"},
68+
SecurityContext: &v1.SecurityContext{
69+
ProcMount: &pmt,
70+
},
71+
},
72+
},
73+
HostUsers: &falseVar,
74+
},
75+
}, metav1.CreateOptions{})
76+
gomega.Expect(err).To(gomega.HaveOccurred())
77+
})
78+
})
79+
80+
var _ = SIGDescribe("ProcMount [LinuxOnly]", nodefeature.ProcMountType, nodefeature.UserNamespacesSupport, feature.UserNamespacesSupport, func() {
81+
f := framework.NewDefaultFramework("proc-mount-privileged-test")
82+
83+
f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
84+
85+
f.It("will unmask proc mounts if requested", func(ctx context.Context) {
86+
if !supportsUserNS(ctx, f) {
87+
e2eskipper.Skipf("runtime does not support user namespaces")
88+
}
89+
testProcMount(ctx, f, v1.UnmaskedProcMount, gomega.Equal(1), gomega.BeZero())
90+
})
91+
})
92+
93+
func testProcMount(ctx context.Context, f *framework.Framework, pmt v1.ProcMountType, expectedLines gomegatypes.GomegaMatcher, expectedReadOnly gomegatypes.GomegaMatcher) {
94+
ginkgo.By("creating a target pod")
95+
podClient := e2epod.NewPodClient(f)
96+
pod := podClient.CreateSync(ctx, &v1.Pod{
97+
ObjectMeta: metav1.ObjectMeta{Name: "proc-mount-pod"},
98+
Spec: v1.PodSpec{
99+
Containers: []v1.Container{
100+
{
101+
Name: "test-container-1",
102+
Image: imageutils.GetE2EImage(imageutils.BusyBox),
103+
Command: []string{"/bin/sleep"},
104+
Args: []string{"10000"},
105+
SecurityContext: &v1.SecurityContext{
106+
ProcMount: &pmt,
107+
},
108+
},
109+
},
110+
HostUsers: &falseVar,
111+
},
112+
})
113+
114+
_, err := testutils.PodRunningReady(pod)
115+
framework.ExpectNoError(err)
116+
117+
output := e2epod.ExecCommandInContainer(f, pod.Name, pod.Spec.Containers[0].Name, "/bin/sh", "-ec", "mount | grep /proc")
118+
ginkgo.By(output)
119+
lines := strings.Split(output, "\n")
120+
gomega.Expect(len(lines)).To(expectedLines)
121+
gomega.Expect(strings.Count(output, "(ro")).To(expectedReadOnly)
122+
}
123+
124+
func supportsUserNS(ctx context.Context, f *framework.Framework) bool {
125+
nodeList, err := f.ClientSet.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
126+
framework.ExpectNoError(err)
127+
// Assuming that there is only one node, because this is a node e2e test.
128+
gomega.Expect(nodeList.Items).To(gomega.HaveLen(1))
129+
node := nodeList.Items[0]
130+
for _, rc := range node.Status.RuntimeHandlers {
131+
if rc.Name == "" && rc.Features != nil && *rc.Features.UserNamespaces {
132+
return true
133+
}
134+
}
135+
return false
136+
}

0 commit comments

Comments
 (0)