Skip to content

Commit c5b01a3

Browse files
test/e2e/windows: drop securityContext test for ProcMount
Fixes kubernetes#126180 As the ProcMountType feature is disabled by default in beta and relies on the UserNamespacesSupport feature, which is also set to false in beta, running this test is unnecessary. Signed-off-by: Sohan Kunkerkar <[email protected]>
1 parent 04cc0a1 commit c5b01a3

File tree

1 file changed

+1
-25
lines changed

1 file changed

+1
-25
lines changed

test/e2e/windows/security_context.go

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ var _ = sigDescribe(feature.Windows, "SecurityContext", skipUnlessWindows(func()
136136
e2eoutput.TestContainerOutput(ctx, f, "check pod SecurityContext username", pod, 1, []string{"ContainerAdministrator"})
137137
})
138138

139-
ginkgo.It("should ignore SELinux Specific SecurityContext if set", func(ctx context.Context) {
139+
ginkgo.It("should ignore Linux Specific SecurityContext if set", func(ctx context.Context) {
140140
ginkgo.By("Creating a pod with SELinux options")
141141
// It is sufficient to show that the pod comes up here. Since we're stripping the SELinux and other linux
142142
// security contexts in apiserver and not updating the pod object in the apiserver, we cannot validate the
@@ -160,30 +160,6 @@ var _ = sigDescribe(feature.Windows, "SecurityContext", skipUnlessWindows(func()
160160
f.Namespace.Name), "failed to wait for pod %s to be running", windowsPodWithSELinux.Name)
161161
})
162162

163-
ginkgo.It("should ignore ProcMount Specific SecurityContext if set", func(ctx context.Context) {
164-
ginkgo.By("Creating a pod with ProcMount options")
165-
// It is sufficient to show that the pod comes up here. Since we're stripping the SELinux and other linux
166-
// security contexts in apiserver and not updating the pod object in the apiserver, we cannot validate the
167-
// pod object to not have those security contexts. However the pod coming to running state is a sufficient
168-
// enough condition for us to validate since prior to https://github.com/kubernetes/kubernetes/pull/93475
169-
// the pod would have failed to come up.
170-
windowsPodWithSELinux := createTestPod(f, imageutils.GetE2EImage(imageutils.Agnhost), windowsOS)
171-
windowsPodWithSELinux.Spec.Containers[0].Args = []string{"test-webserver-with-selinux"}
172-
windowsPodWithSELinux.Spec.SecurityContext = &v1.PodSecurityContext{}
173-
pmt := v1.UnmaskedProcMount
174-
containerUserName := "ContainerAdministrator"
175-
windowsPodWithSELinux.Spec.Containers[0].SecurityContext = &v1.SecurityContext{
176-
ProcMount: &pmt,
177-
WindowsOptions: &v1.WindowsSecurityContextOptions{RunAsUserName: &containerUserName}}
178-
windowsPodWithSELinux.Spec.Tolerations = []v1.Toleration{{Key: "os", Value: "Windows"}}
179-
windowsPodWithSELinux, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(ctx,
180-
windowsPodWithSELinux, metav1.CreateOptions{})
181-
framework.ExpectNoError(err)
182-
framework.Logf("Created pod %v", windowsPodWithSELinux)
183-
framework.ExpectNoError(e2epod.WaitForPodNameRunningInNamespace(ctx, f.ClientSet, windowsPodWithSELinux.Name,
184-
f.Namespace.Name), "failed to wait for pod %s to be running", windowsPodWithSELinux.Name)
185-
})
186-
187163
ginkgo.It("should not be able to create pods with containers running as ContainerAdministrator when runAsNonRoot is true", func(ctx context.Context) {
188164
ginkgo.By("Creating a pod")
189165

0 commit comments

Comments
 (0)