Skip to content

Commit c981bce

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#83368 from Jefftree/move-hostpid-tests
Move hostPID tests to common
2 parents b717be8 + 20ac249 commit c981bce

File tree

2 files changed

+82
-82
lines changed

2 files changed

+82
-82
lines changed

‎test/e2e/common/security_context.go‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
v1 "k8s.io/api/core/v1"
2424
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
25+
"k8s.io/apimachinery/pkg/util/sets"
2526
"k8s.io/apimachinery/pkg/util/uuid"
2627
"k8s.io/kubernetes/pkg/kubelet/events"
2728
"k8s.io/kubernetes/test/e2e/framework"
@@ -40,6 +41,86 @@ var _ = framework.KubeDescribe("Security Context", func() {
4041
podClient = f.PodClient()
4142
})
4243

44+
ginkgo.Context("when creating a pod in the host PID namespace", func() {
45+
makeHostPidPod := func(podName, image string, command []string, hostPID bool) *v1.Pod {
46+
return &v1.Pod{
47+
ObjectMeta: metav1.ObjectMeta{
48+
Name: podName,
49+
},
50+
Spec: v1.PodSpec{
51+
RestartPolicy: v1.RestartPolicyNever,
52+
HostPID: hostPID,
53+
Containers: []v1.Container{
54+
{
55+
Image: image,
56+
Name: podName,
57+
Command: command,
58+
},
59+
},
60+
},
61+
}
62+
}
63+
createAndWaitHostPidPod := func(podName string, hostPID bool) {
64+
podClient.Create(makeHostPidPod(podName,
65+
framework.BusyBoxImage,
66+
[]string{"sh", "-c", "pidof nginx || true"},
67+
hostPID,
68+
))
69+
70+
podClient.WaitForSuccess(podName, framework.PodStartTimeout)
71+
}
72+
73+
nginxPid := ""
74+
ginkgo.BeforeEach(func() {
75+
nginxPodName := "nginx-hostpid-" + string(uuid.NewUUID())
76+
podClient.CreateSync(makeHostPidPod(nginxPodName,
77+
imageutils.GetE2EImage(imageutils.Nginx),
78+
nil,
79+
true,
80+
))
81+
82+
output := f.ExecShellInContainer(nginxPodName, nginxPodName,
83+
"cat /var/run/nginx.pid")
84+
nginxPid = strings.TrimSpace(output)
85+
})
86+
87+
ginkgo.It("should show its pid in the host PID namespace [LinuxOnly] [NodeFeature:HostAccess]", func() {
88+
busyboxPodName := "busybox-hostpid-" + string(uuid.NewUUID())
89+
createAndWaitHostPidPod(busyboxPodName, true)
90+
logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
91+
if err != nil {
92+
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
93+
}
94+
95+
pids := strings.TrimSpace(logs)
96+
framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName)
97+
if pids == "" {
98+
framework.Failf("nginx's pid should be seen by hostpid containers")
99+
}
100+
101+
pidSets := sets.NewString(strings.Split(pids, " ")...)
102+
if !pidSets.Has(nginxPid) {
103+
framework.Failf("nginx's pid should be seen by hostpid containers")
104+
}
105+
})
106+
107+
ginkgo.It("should not show its pid in the non-hostpid containers [LinuxOnly] [NodeFeature:HostAccess]", func() {
108+
busyboxPodName := "busybox-non-hostpid-" + string(uuid.NewUUID())
109+
createAndWaitHostPidPod(busyboxPodName, false)
110+
logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
111+
if err != nil {
112+
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
113+
}
114+
115+
pids := strings.TrimSpace(logs)
116+
framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName)
117+
pidSets := sets.NewString(strings.Split(pids, " ")...)
118+
if pidSets.Has(nginxPid) {
119+
framework.Failf("nginx's pid should not be seen by non-hostpid containers")
120+
}
121+
})
122+
})
123+
43124
ginkgo.Context("When creating a container with runAsUser", func() {
44125
makeUserPod := func(podName, image string, command []string, userid int64) *v1.Pod {
45126
return &v1.Pod{

‎test/e2e_node/security_context_test.go‎

Lines changed: 1 addition & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,8 @@ import (
2222
"os/exec"
2323
"strings"
2424

25-
"k8s.io/api/core/v1"
25+
v1 "k8s.io/api/core/v1"
2626
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
27-
"k8s.io/apimachinery/pkg/util/sets"
2827
"k8s.io/apimachinery/pkg/util/uuid"
2928
utilfeature "k8s.io/apiserver/pkg/util/feature"
3029
"k8s.io/kubernetes/pkg/features"
@@ -114,86 +113,6 @@ var _ = framework.KubeDescribe("Security Context", func() {
114113
})
115114
})
116115

117-
ginkgo.Context("when creating a pod in the host PID namespace", func() {
118-
makeHostPidPod := func(podName, image string, command []string, hostPID bool) *v1.Pod {
119-
return &v1.Pod{
120-
ObjectMeta: metav1.ObjectMeta{
121-
Name: podName,
122-
},
123-
Spec: v1.PodSpec{
124-
RestartPolicy: v1.RestartPolicyNever,
125-
HostPID: hostPID,
126-
Containers: []v1.Container{
127-
{
128-
Image: image,
129-
Name: podName,
130-
Command: command,
131-
},
132-
},
133-
},
134-
}
135-
}
136-
createAndWaitHostPidPod := func(podName string, hostPID bool) {
137-
podClient.Create(makeHostPidPod(podName,
138-
busyboxImage,
139-
[]string{"sh", "-c", "pidof nginx || true"},
140-
hostPID,
141-
))
142-
143-
podClient.WaitForSuccess(podName, framework.PodStartTimeout)
144-
}
145-
146-
nginxPid := ""
147-
ginkgo.BeforeEach(func() {
148-
nginxPodName := "nginx-hostpid-" + string(uuid.NewUUID())
149-
podClient.CreateSync(makeHostPidPod(nginxPodName,
150-
imageutils.GetE2EImage(imageutils.Nginx),
151-
nil,
152-
true,
153-
))
154-
155-
output := f.ExecShellInContainer(nginxPodName, nginxPodName,
156-
"cat /var/run/nginx.pid")
157-
nginxPid = strings.TrimSpace(output)
158-
})
159-
160-
ginkgo.It("should show its pid in the host PID namespace [NodeFeature:HostAccess]", func() {
161-
busyboxPodName := "busybox-hostpid-" + string(uuid.NewUUID())
162-
createAndWaitHostPidPod(busyboxPodName, true)
163-
logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
164-
if err != nil {
165-
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
166-
}
167-
168-
pids := strings.TrimSpace(logs)
169-
framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName)
170-
if pids == "" {
171-
framework.Failf("nginx's pid should be seen by hostpid containers")
172-
}
173-
174-
pidSets := sets.NewString(strings.Split(pids, " ")...)
175-
if !pidSets.Has(nginxPid) {
176-
framework.Failf("nginx's pid should be seen by hostpid containers")
177-
}
178-
})
179-
180-
ginkgo.It("should not show its pid in the non-hostpid containers [NodeFeature:HostAccess]", func() {
181-
busyboxPodName := "busybox-non-hostpid-" + string(uuid.NewUUID())
182-
createAndWaitHostPidPod(busyboxPodName, false)
183-
logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName)
184-
if err != nil {
185-
framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err)
186-
}
187-
188-
pids := strings.TrimSpace(logs)
189-
framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName)
190-
pidSets := sets.NewString(strings.Split(pids, " ")...)
191-
if pidSets.Has(nginxPid) {
192-
framework.Failf("nginx's pid should not be seen by non-hostpid containers")
193-
}
194-
})
195-
})
196-
197116
ginkgo.Context("when creating a pod in the host IPC namespace", func() {
198117
makeHostIPCPod := func(podName, image string, command []string, hostIPC bool) *v1.Pod {
199118
return &v1.Pod{

0 commit comments

Comments
 (0)