|
|
|
@ -708,7 +708,7 @@ func testWebhook(f *framework.Framework) {
|
|
|
|
|
// Creating the pod, the request should be rejected
|
|
|
|
|
pod := nonCompliantPod(f)
|
|
|
|
|
_, err := client.CoreV1().Pods(f.Namespace.Name).Create(pod)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create pod %s in namespace %s should have been denied by webhook", pod.Name, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "create pod %s in namespace %s should have been denied by webhook", pod.Name, f.Namespace.Name)
|
|
|
|
|
expectedErrMsg1 := "the pod contains unwanted container name"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg1) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg1, err.Error())
|
|
|
|
@ -723,7 +723,7 @@ func testWebhook(f *framework.Framework) {
|
|
|
|
|
// Creating the pod, the request should be rejected
|
|
|
|
|
pod = hangingPod(f)
|
|
|
|
|
_, err = client.CoreV1().Pods(f.Namespace.Name).Create(pod)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create pod %s in namespace %s should have caused webhook to hang", pod.Name, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "create pod %s in namespace %s should have caused webhook to hang", pod.Name, f.Namespace.Name)
|
|
|
|
|
expectedTimeoutErr := "request did not complete within"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedTimeoutErr) {
|
|
|
|
|
framework.Failf("expect timeout error %q, got %q", expectedTimeoutErr, err.Error())
|
|
|
|
@ -733,7 +733,7 @@ func testWebhook(f *framework.Framework) {
|
|
|
|
|
// Creating the configmap, the request should be rejected
|
|
|
|
|
configmap := nonCompliantConfigMap(f)
|
|
|
|
|
_, err = client.CoreV1().ConfigMaps(f.Namespace.Name).Create(configmap)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create configmap %s in namespace %s should have been denied by the webhook", configmap.Name, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "create configmap %s in namespace %s should have been denied by the webhook", configmap.Name, f.Namespace.Name)
|
|
|
|
|
expectedErrMsg := "the configmap contains unwanted key and value"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
@ -760,7 +760,7 @@ func testWebhook(f *framework.Framework) {
|
|
|
|
|
cm.Data["webhook-e2e-test"] = "webhook-disallow"
|
|
|
|
|
}
|
|
|
|
|
_, err = updateConfigMap(client, f.Namespace.Name, allowedConfigMapName, toNonCompliantFn)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "update (PUT) admitted configmap %s in namespace %s to a non-compliant one should be rejected by webhook", allowedConfigMapName, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "update (PUT) admitted configmap %s in namespace %s to a non-compliant one should be rejected by webhook", allowedConfigMapName, f.Namespace.Name)
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
|
}
|
|
|
|
@ -768,7 +768,7 @@ func testWebhook(f *framework.Framework) {
|
|
|
|
|
ginkgo.By("update (PATCH) the admitted configmap to a non-compliant one should be rejected by the webhook")
|
|
|
|
|
patch := nonCompliantConfigMapPatch()
|
|
|
|
|
_, err = client.CoreV1().ConfigMaps(f.Namespace.Name).Patch(allowedConfigMapName, types.StrategicMergePatchType, []byte(patch))
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "update admitted configmap %s in namespace %s by strategic merge patch to a non-compliant one should be rejected by webhook. Patch: %+v", allowedConfigMapName, f.Namespace.Name, patch)
|
|
|
|
|
framework.ExpectError(err, "update admitted configmap %s in namespace %s by strategic merge patch to a non-compliant one should be rejected by webhook. Patch: %+v", allowedConfigMapName, f.Namespace.Name, patch)
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
|
}
|
|
|
|
@ -799,7 +799,7 @@ func testBlockingConfigmapDeletion(f *framework.Framework) {
|
|
|
|
|
|
|
|
|
|
ginkgo.By("deleting the configmap should be denied by the webhook")
|
|
|
|
|
err = client.CoreV1().ConfigMaps(f.Namespace.Name).Delete(configmap.Name, &metav1.DeleteOptions{})
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "deleting configmap %s in namespace: %s should be denied", configmap.Name, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "deleting configmap %s in namespace: %s should be denied", configmap.Name, f.Namespace.Name)
|
|
|
|
|
expectedErrMsg1 := "the configmap cannot be deleted because it contains unwanted key and value"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg1) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg1, err.Error())
|
|
|
|
@ -833,7 +833,7 @@ func testAttachingPodWebhook(f *framework.Framework) {
|
|
|
|
|
timer := time.NewTimer(30 * time.Second)
|
|
|
|
|
defer timer.Stop()
|
|
|
|
|
_, err = framework.NewKubectlCommand("attach", fmt.Sprintf("--namespace=%v", f.Namespace.Name), pod.Name, "-i", "-c=container1").WithTimeout(timer.C).Exec()
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "'kubectl attach' the pod, should be denied by the webhook")
|
|
|
|
|
framework.ExpectError(err, "'kubectl attach' the pod, should be denied by the webhook")
|
|
|
|
|
if e, a := "attaching to pod 'to-be-attached-pod' is not allowed", err.Error(); !strings.Contains(a, e) {
|
|
|
|
|
framework.Failf("unexpected 'kubectl attach' error message. expected to contain %q, got %q", e, a)
|
|
|
|
|
}
|
|
|
|
@ -923,7 +923,7 @@ func testFailClosedWebhook(f *framework.Framework) {
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
_, err = client.CoreV1().ConfigMaps(failNamespaceName).Create(configmap)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create configmap in namespace: %s should be unconditionally rejected by the webhook", failNamespaceName)
|
|
|
|
|
framework.ExpectError(err, "create configmap in namespace: %s should be unconditionally rejected by the webhook", failNamespaceName)
|
|
|
|
|
if !errors.IsInternalError(err) {
|
|
|
|
|
framework.Failf("expect an internal error, got %#v", err)
|
|
|
|
|
}
|
|
|
|
@ -1416,7 +1416,7 @@ func testCustomResourceWebhook(f *framework.Framework, crd *apiextensionsv1beta1
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
_, err := customResourceClient.Create(crInstance, metav1.CreateOptions{})
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create custom resource %s in namespace %s should be denied by webhook", crInstanceName, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "create custom resource %s in namespace %s should be denied by webhook", crInstanceName, f.Namespace.Name)
|
|
|
|
|
expectedErrMsg := "the custom resource contains unwanted data"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
@ -1444,7 +1444,7 @@ func testBlockingCustomResourceDeletion(f *framework.Framework, crd *apiextensio
|
|
|
|
|
|
|
|
|
|
ginkgo.By("Deleting the custom resource should be denied")
|
|
|
|
|
err = customResourceClient.Delete(crInstanceName, &metav1.DeleteOptions{})
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "deleting custom resource %s in namespace: %s should be denied", crInstanceName, f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "deleting custom resource %s in namespace: %s should be denied", crInstanceName, f.Namespace.Name)
|
|
|
|
|
expectedErrMsg1 := "the custom resource cannot be deleted because it contains unwanted key and value"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg1) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg1, err.Error())
|
|
|
|
@ -1621,7 +1621,7 @@ func testCRDDenyWebhook(f *framework.Framework) {
|
|
|
|
|
|
|
|
|
|
// create CRD
|
|
|
|
|
_, err = apiExtensionClient.ApiextensionsV1beta1().CustomResourceDefinitions().Create(crd)
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create custom resource definition %s should be denied by webhook", crd.Name)
|
|
|
|
|
framework.ExpectError(err, "create custom resource definition %s should be denied by webhook", crd.Name)
|
|
|
|
|
expectedErrMsg := "the crd contains unwanted label"
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
@ -1693,7 +1693,7 @@ func testSlowWebhookTimeoutFailEarly(f *framework.Framework) {
|
|
|
|
|
client := f.ClientSet
|
|
|
|
|
name := "e2e-test-slow-webhook-configmap"
|
|
|
|
|
_, err := client.CoreV1().ConfigMaps(f.Namespace.Name).Create(&v1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: name}})
|
|
|
|
|
gomega.Expect(err).To(gomega.HaveOccurred(), "create configmap in namespace %s should have timed-out reaching slow webhook", f.Namespace.Name)
|
|
|
|
|
framework.ExpectError(err, "create configmap in namespace %s should have timed-out reaching slow webhook", f.Namespace.Name)
|
|
|
|
|
expectedErrMsg := `/always-allow-delay-5s?timeout=1s: context deadline exceeded`
|
|
|
|
|
if !strings.Contains(err.Error(), expectedErrMsg) {
|
|
|
|
|
framework.Failf("expect error contains %q, got %q", expectedErrMsg, err.Error())
|
|
|
|
|