@@ -32,49 +32,63 @@ import (
3232)
3333
3434var _ = describe ("PSP use" , func () {
35- privilegedRole := "privileged-psp"
3635 privilegedSA := "privileged-sa"
3736 f := framework .NewDefaultFramework ("psp" )
37+ f .SkipNamespaceCreation = true
3838 f .NamespacePodSecurityEnforceLevel = admissionapi .LevelPrivileged
3939 var cs kubernetes.Interface
4040
4141 BeforeEach (func () {
4242 cs = f .ClientSet
43- saObj := createServiceAccount (f .Namespace .Name , privilegedSA )
44- _ , err := cs .CoreV1 ().ServiceAccounts (f .Namespace .Name ).Create (context .TODO (), saObj , metav1.CreateOptions {})
43+ })
44+
45+ It ("Should not create a privileged POD if restricted SA [PSP] [Zalando]" , func () {
46+ defaultSA := "default"
47+ ns := "psp-restricted-zalando"
48+ _ , err := cs .CoreV1 ().Namespaces ().Create (context .TODO (), & v1.Namespace {
49+ ObjectMeta : metav1.ObjectMeta {
50+ Name : ns ,
51+ },
52+ }, metav1.CreateOptions {})
4553 Expect (err ).NotTo (HaveOccurred ())
4654
47- _ , err = cs .RbacV1 ().RoleBindings (f .Namespace .Name ).Create (context .TODO (), createRBACRoleBindingSA (privilegedRole , f .Namespace .Name , privilegedSA ), metav1.CreateOptions {})
55+ // create SA
56+ saObj := createServiceAccount (ns , privilegedSA )
57+ _ , err = cs .CoreV1 ().ServiceAccounts (ns ).Create (context .TODO (), saObj , metav1.CreateOptions {})
4858 Expect (err ).NotTo (HaveOccurred ())
49- })
5059
51- // TODO: We have to have a solution to get an unprivileged
52- // User to check this, if not it would always create a
53- // privileged POD for an unprivileged serviceAccount.
54- // --
55- // It("Should not create a POD that use privileged PSP [PSP] [Zalando]", func() {
56- // defaultSA := "default"
57- // ns := f.Namespace.Name
58- // label := map[string]string{
59- // "app": "psp",
60- // }
61- // msg := fmt.Sprintf("Creating a privileged POD as %s", defaultSA)
62- // By(msg)
63- // route := fmt.Sprintf(`* -> inlineContent("%s") -> <shunt>`, "OK")
64- // pod := createSkipperPodWithHostNetwork("", ns, defaultSA, route, label, 80)
65- // defer func() {
66- // By(msg)
67- // defer GinkgoRecover()
68- // err := cs.CoreV1().Pods(ns).Delete(pod.Name, metav1.NewDeleteOptions(0))
69- // Expect(err).To(HaveOccurred())
70- // }()
71- // _, err := cs.CoreV1().Pods(ns).Create(pod)
72- // Expect(err).To(HaveOccurred())
73- // framework.ExpectNoError(f.WaitForPodRunning(pod.Name))
74- // })
60+ label := map [string ]string {
61+ "app" : "psp" ,
62+ }
63+ msg := fmt .Sprintf ("Creating a privileged POD as %s" , defaultSA )
64+ By (msg )
65+ route := fmt .Sprintf (`* -> inlineContent("%s") -> <shunt>` , "OK" )
66+ pod := createSkipperPodWithHostNetwork ("" , ns , defaultSA , route , label , 80 )
67+ defer func () {
68+ By (msg )
69+ defer GinkgoRecover ()
70+
71+ err = cs .CoreV1 ().Namespaces ().Delete (context .TODO (), ns , metav1.DeleteOptions {})
72+ Expect (err ).NotTo (HaveOccurred ())
73+ }()
74+ _ , err = cs .CoreV1 ().Pods (ns ).Create (context .TODO (), pod , metav1.CreateOptions {})
75+ Expect (err ).To (HaveOccurred ())
76+ })
7577
7678 It ("Should create a POD that use privileged PSP [PSP] [Zalando]" , func () {
77- ns := f .Namespace .Name
79+ ns := "psp-privileged-zalando"
80+ _ , err := cs .CoreV1 ().Namespaces ().Create (context .TODO (), & v1.Namespace {
81+ ObjectMeta : metav1.ObjectMeta {
82+ Name : ns ,
83+ },
84+ }, metav1.CreateOptions {})
85+ Expect (err ).NotTo (HaveOccurred ())
86+
87+ // create SA
88+ saObj := createServiceAccount (ns , privilegedSA )
89+ _ , err = cs .CoreV1 ().ServiceAccounts (ns ).Create (context .TODO (), saObj , metav1.CreateOptions {})
90+ Expect (err ).NotTo (HaveOccurred ())
91+
7892 label := map [string ]string {
7993 "app" : "psp" ,
8094 }
@@ -89,16 +103,31 @@ var _ = describe("PSP use", func() {
89103 defer GinkgoRecover ()
90104 err := cs .CoreV1 ().Pods (ns ).Delete (context .TODO (), pod .Name , metav1.DeleteOptions {})
91105 Expect (err ).NotTo (HaveOccurred ())
106+
107+ err = cs .CoreV1 ().Namespaces ().Delete (context .TODO (), ns , metav1.DeleteOptions {})
108+ Expect (err ).NotTo (HaveOccurred ())
92109 }()
93110
94- _ , err : =cs .CoreV1 ().Pods (ns ).Create (context .TODO (), pod , metav1.CreateOptions {})
111+ _ , err = cs .CoreV1 ().Pods (ns ).Create (context .TODO (), pod , metav1.CreateOptions {})
95112 Expect (err ).NotTo (HaveOccurred ())
96113
97114 framework .ExpectNoError (e2epod .WaitForPodNameRunningInNamespace (f .ClientSet , pod .Name , pod .Namespace ))
98115 })
99116
100117 It ("Should create a POD that use privileged PSP via deployment [PSP] [Zalando]" , func () {
101- ns := f .Namespace .Name
118+ ns := "psp-privileged-deployment-zalando"
119+ _ , err := cs .CoreV1 ().Namespaces ().Create (context .TODO (), & v1.Namespace {
120+ ObjectMeta : metav1.ObjectMeta {
121+ Name : ns ,
122+ },
123+ }, metav1.CreateOptions {})
124+ Expect (err ).NotTo (HaveOccurred ())
125+
126+ // create SA
127+ saObj := createServiceAccount (ns , privilegedSA )
128+ _ , err = cs .CoreV1 ().ServiceAccounts (ns ).Create (context .TODO (), saObj , metav1.CreateOptions {})
129+ Expect (err ).NotTo (HaveOccurred ())
130+
102131 label := map [string ]string {
103132 "app" : "psp" ,
104133 }
@@ -117,6 +146,9 @@ var _ = describe("PSP use", func() {
117146 defer GinkgoRecover ()
118147 err := cs .AppsV1 ().Deployments (ns ).Delete (context .TODO (), d .Name , metav1.DeleteOptions {})
119148 Expect (err ).NotTo (HaveOccurred ())
149+
150+ err = cs .CoreV1 ().Namespaces ().Delete (context .TODO (), ns , metav1.DeleteOptions {})
151+ Expect (err ).NotTo (HaveOccurred ())
120152 }()
121153
122154 deploy , err := cs .AppsV1 ().Deployments (ns ).Create (context .TODO (), d , metav1.CreateOptions {})
@@ -134,7 +166,7 @@ var _ = describe("PSP use", func() {
134166 Expect (err ).NotTo (HaveOccurred ())
135167 By (fmt .Sprintf ("Got rs: %s, from deployment: %s" , rs .Name , deploy .Name ))
136168
137- pods , err := e2epod .PodsCreatedByLabel (f .ClientSet , f . Namespace . Name , rs .Name , replicas , labelSelector )
169+ pods , err := e2epod .PodsCreatedByLabel (f .ClientSet , ns , rs .Name , replicas , labelSelector )
138170 Expect (err ).NotTo (HaveOccurred ())
139171 By (fmt .Sprintf ("Ensuring each pod is running for rs: %s, pod: %s" , rs .Name , pods .Items [0 ].Name ))
140172 // Wait for the pods to enter the running state. Waiting loops until the pods
0 commit comments