Skip to content

Commit 020e54c

Browse files
ceshihaoceshihao
committed
add unit test for RunAsGroup in both pod and podsecuritypolicy
1 parent d4c85e9 commit 020e54c

File tree

2 files changed

+217
-0
lines changed

2 files changed

+217
-0
lines changed

‎pkg/api/pod/util_test.go‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -911,3 +911,140 @@ func TestDropEmptyDirSizeLimit(t *testing.T) {
911911
}
912912
}
913913
}
914+
915+
func TestDropRunAsGroup(t *testing.T) {
916+
group := func() *int64 {
917+
testGroup := int64(1000)
918+
return &testGroup
919+
}
920+
defaultProcMount := api.DefaultProcMount
921+
defaultSecurityContext := func() *api.SecurityContext {
922+
return &api.SecurityContext{ProcMount: &defaultProcMount}
923+
}
924+
securityContextWithRunAsGroup := func() *api.SecurityContext {
925+
return &api.SecurityContext{ProcMount: &defaultProcMount, RunAsGroup: group()}
926+
}
927+
podWithoutRunAsGroup := func() *api.Pod {
928+
return &api.Pod{
929+
Spec: api.PodSpec{
930+
RestartPolicy: api.RestartPolicyNever,
931+
SecurityContext: &api.PodSecurityContext{},
932+
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
933+
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
934+
},
935+
}
936+
}
937+
podWithRunAsGroupInPod := func() *api.Pod {
938+
return &api.Pod{
939+
Spec: api.PodSpec{
940+
RestartPolicy: api.RestartPolicyNever,
941+
SecurityContext: &api.PodSecurityContext{RunAsGroup: group()},
942+
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
943+
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
944+
},
945+
}
946+
}
947+
podWithRunAsGroupInContainers := func() *api.Pod {
948+
return &api.Pod{
949+
Spec: api.PodSpec{
950+
RestartPolicy: api.RestartPolicyNever,
951+
SecurityContext: &api.PodSecurityContext{},
952+
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: securityContextWithRunAsGroup()}},
953+
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
954+
},
955+
}
956+
}
957+
podWithRunAsGroupInInitContainers := func() *api.Pod {
958+
return &api.Pod{
959+
Spec: api.PodSpec{
960+
RestartPolicy: api.RestartPolicyNever,
961+
SecurityContext: &api.PodSecurityContext{},
962+
Containers: []api.Container{{Name: "container1", Image: "testimage", SecurityContext: defaultSecurityContext()}},
963+
InitContainers: []api.Container{{Name: "initContainer1", Image: "testimage", SecurityContext: securityContextWithRunAsGroup()}},
964+
},
965+
}
966+
}
967+
968+
podInfo := []struct {
969+
description string
970+
hasRunAsGroup bool
971+
pod func() *api.Pod
972+
}{
973+
{
974+
description: "have RunAsGroup in Pod",
975+
hasRunAsGroup: true,
976+
pod: podWithRunAsGroupInPod,
977+
},
978+
{
979+
description: "have RunAsGroup in Container",
980+
hasRunAsGroup: true,
981+
pod: podWithRunAsGroupInContainers,
982+
},
983+
{
984+
description: "have RunAsGroup in InitContainer",
985+
hasRunAsGroup: true,
986+
pod: podWithRunAsGroupInInitContainers,
987+
},
988+
{
989+
description: "does not have RunAsGroup",
990+
hasRunAsGroup: false,
991+
pod: podWithoutRunAsGroup,
992+
},
993+
{
994+
description: "is nil",
995+
hasRunAsGroup: false,
996+
pod: func() *api.Pod { return nil },
997+
},
998+
}
999+
1000+
for _, enabled := range []bool{true, false} {
1001+
for _, oldPodInfo := range podInfo {
1002+
for _, newPodInfo := range podInfo {
1003+
oldPodHasRunAsGroup, oldPod := oldPodInfo.hasRunAsGroup, oldPodInfo.pod()
1004+
newPodHasRunAsGroup, newPod := newPodInfo.hasRunAsGroup, newPodInfo.pod()
1005+
if newPod == nil {
1006+
continue
1007+
}
1008+
1009+
t.Run(fmt.Sprintf("feature enabled=%v, old pod %v, new pod %v", enabled, oldPodInfo.description, newPodInfo.description), func(t *testing.T) {
1010+
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RunAsGroup, enabled)()
1011+
1012+
var oldPodSpec *api.PodSpec
1013+
if oldPod != nil {
1014+
oldPodSpec = &oldPod.Spec
1015+
}
1016+
DropDisabledFields(&newPod.Spec, oldPodSpec)
1017+
1018+
// old pod should never be changed
1019+
if !reflect.DeepEqual(oldPod, oldPodInfo.pod()) {
1020+
t.Errorf("old pod changed: %v", diff.ObjectReflectDiff(oldPod, oldPodInfo.pod()))
1021+
}
1022+
1023+
switch {
1024+
case enabled || oldPodHasRunAsGroup:
1025+
// new pod should not be changed if the feature is enabled, or if the old pod had RunAsGroup
1026+
if !reflect.DeepEqual(newPod, newPodInfo.pod()) {
1027+
t.Errorf("new pod changed: %v", diff.ObjectReflectDiff(newPod, newPodInfo.pod()))
1028+
}
1029+
case newPodHasRunAsGroup:
1030+
// new pod should be changed
1031+
if reflect.DeepEqual(newPod, newPodInfo.pod()) {
1032+
t.Errorf("%v", oldPod)
1033+
t.Errorf("%v", newPod)
1034+
t.Errorf("new pod was not changed")
1035+
}
1036+
// new pod should not have RunAsGroup
1037+
if !reflect.DeepEqual(newPod, podWithoutRunAsGroup()) {
1038+
t.Errorf("new pod had RunAsGroup: %v", diff.ObjectReflectDiff(newPod, podWithoutRunAsGroup()))
1039+
}
1040+
default:
1041+
// new pod should not need to be changed
1042+
if !reflect.DeepEqual(newPod, newPodInfo.pod()) {
1043+
t.Errorf("new pod changed: %v", diff.ObjectReflectDiff(newPod, newPodInfo.pod()))
1044+
}
1045+
}
1046+
})
1047+
}
1048+
}
1049+
}
1050+
}

‎pkg/api/podsecuritypolicy/util_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,3 +107,83 @@ func TestDropAllowedProcMountTypes(t *testing.T) {
107107
}
108108
}
109109
}
110+
111+
func TestDropRunAsGroup(t *testing.T) {
112+
group := func() *policy.RunAsGroupStrategyOptions {
113+
return &policy.RunAsGroupStrategyOptions{}
114+
}
115+
scWithoutRunAsGroup := func() *policy.PodSecurityPolicySpec {
116+
return &policy.PodSecurityPolicySpec{}
117+
}
118+
scWithRunAsGroup := func() *policy.PodSecurityPolicySpec {
119+
return &policy.PodSecurityPolicySpec{
120+
RunAsGroup: group(),
121+
}
122+
}
123+
scInfo := []struct {
124+
description string
125+
hasRunAsGroup bool
126+
sc func() *policy.PodSecurityPolicySpec
127+
}{
128+
{
129+
description: "PodSecurityPolicySpec Without RunAsGroup",
130+
hasRunAsGroup: false,
131+
sc: scWithoutRunAsGroup,
132+
},
133+
{
134+
description: "PodSecurityPolicySpec With RunAsGroup",
135+
hasRunAsGroup: true,
136+
sc: scWithRunAsGroup,
137+
},
138+
{
139+
description: "is nil",
140+
hasRunAsGroup: false,
141+
sc: func() *policy.PodSecurityPolicySpec { return nil },
142+
},
143+
}
144+
145+
for _, enabled := range []bool{true, false} {
146+
for _, oldPSPSpecInfo := range scInfo {
147+
for _, newPSPSpecInfo := range scInfo {
148+
oldPSPSpecHasRunAsGroup, oldPSPSpec := oldPSPSpecInfo.hasRunAsGroup, oldPSPSpecInfo.sc()
149+
newPSPSpecHasRunAsGroup, newPSPSpec := newPSPSpecInfo.hasRunAsGroup, newPSPSpecInfo.sc()
150+
if newPSPSpec == nil {
151+
continue
152+
}
153+
154+
t.Run(fmt.Sprintf("feature enabled=%v, old PodSecurityPolicySpec %v, new PodSecurityPolicySpec %v", enabled, oldPSPSpecInfo.description, newPSPSpecInfo.description), func(t *testing.T) {
155+
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RunAsGroup, enabled)()
156+
157+
DropDisabledFields(newPSPSpec, oldPSPSpec)
158+
159+
// old PodSecurityPolicySpec should never be changed
160+
if !reflect.DeepEqual(oldPSPSpec, oldPSPSpecInfo.sc()) {
161+
t.Errorf("old PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(oldPSPSpec, oldPSPSpecInfo.sc()))
162+
}
163+
164+
switch {
165+
case enabled || oldPSPSpecHasRunAsGroup:
166+
// new PodSecurityPolicySpec should not be changed if the feature is enabled, or if the old PodSecurityPolicySpec had RunAsGroup
167+
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
168+
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
169+
}
170+
case newPSPSpecHasRunAsGroup:
171+
// new PodSecurityPolicySpec should be changed
172+
if reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
173+
t.Errorf("new PodSecurityPolicySpec was not changed")
174+
}
175+
// new PodSecurityPolicySpec should not have RunAsGroup
176+
if !reflect.DeepEqual(newPSPSpec, scWithoutRunAsGroup()) {
177+
t.Errorf("new PodSecurityPolicySpec had RunAsGroup: %v", diff.ObjectReflectDiff(newPSPSpec, scWithoutRunAsGroup()))
178+
}
179+
default:
180+
// new PodSecurityPolicySpec should not need to be changed
181+
if !reflect.DeepEqual(newPSPSpec, newPSPSpecInfo.sc()) {
182+
t.Errorf("new PodSecurityPolicySpec changed: %v", diff.ObjectReflectDiff(newPSPSpec, newPSPSpecInfo.sc()))
183+
}
184+
}
185+
})
186+
}
187+
}
188+
}
189+
}

0 commit comments

Comments
 (0)