mirror of https://github.com/k3s-io/k3s
Update node e2e "privileged pods" to use the framework.
Signed-off-by: Vishnu kannan <vishnuk@google.com>pull/6/head
parent
f24b7a7391
commit
9f730d5345
11
Makefile
11
Makefile
|
@ -80,7 +80,7 @@ check test:
|
||||||
# make test_integration
|
# make test_integration
|
||||||
test_integration:
|
test_integration:
|
||||||
hack/test-integration.sh
|
hack/test-integration.sh
|
||||||
.PHONY: test_integration test_integ
|
.PHONY: test_integration
|
||||||
|
|
||||||
# Build and run end-to-end tests.
|
# Build and run end-to-end tests.
|
||||||
#
|
#
|
||||||
|
@ -98,7 +98,7 @@ test_e2e:
|
||||||
# Example:
|
# Example:
|
||||||
# make test_e2e_node FOCUS=kubelet SKIP=container
|
# make test_e2e_node FOCUS=kubelet SKIP=container
|
||||||
# Build and run tests.
|
# Build and run tests.
|
||||||
test_e2e_node:
|
test_e2e_node: ginkgo
|
||||||
hack/e2e-node-test.sh FOCUS=$(FOCUS) SKIP=$(SKIP)
|
hack/e2e-node-test.sh FOCUS=$(FOCUS) SKIP=$(SKIP)
|
||||||
.PHONY: test_e2e_node
|
.PHONY: test_e2e_node
|
||||||
|
|
||||||
|
@ -146,3 +146,10 @@ release-skip-tests quick-release:
|
||||||
KUBE_RELEASE_RUN_TESTS=n KUBE_FASTBUILD=true build/release.sh
|
KUBE_RELEASE_RUN_TESTS=n KUBE_FASTBUILD=true build/release.sh
|
||||||
.PHONY: release-skip-tests quick-release
|
.PHONY: release-skip-tests quick-release
|
||||||
|
|
||||||
|
# Build ginkgo for tests
|
||||||
|
#
|
||||||
|
# Example:
|
||||||
|
# make ginkgo
|
||||||
|
ginkgo:
|
||||||
|
hack/build-go.sh vendor/github.com/onsi/ginkgo/ginkgo
|
||||||
|
.PHONY: ginkgo
|
||||||
|
|
|
@ -23,7 +23,7 @@ report=${REPORT:-"/tmp/"}
|
||||||
|
|
||||||
ginkgo=$(kube::util::find-binary "ginkgo")
|
ginkgo=$(kube::util::find-binary "ginkgo")
|
||||||
if [[ -z "${ginkgo}" ]]; then
|
if [[ -z "${ginkgo}" ]]; then
|
||||||
echo "You do not appear to have ginkgo built. Try 'make WHAT=vendor/github.com/onsi/ginkgo/ginkgo'"
|
echo "You do not appear to have ginkgo built. 'make WHAT=vendor/github.com/onsi/ginkgo/ginkgo'"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
|
@ -24,9 +24,9 @@ import (
|
||||||
|
|
||||||
"k8s.io/kubernetes/pkg/api"
|
"k8s.io/kubernetes/pkg/api"
|
||||||
"k8s.io/kubernetes/pkg/client/restclient"
|
"k8s.io/kubernetes/pkg/client/restclient"
|
||||||
client "k8s.io/kubernetes/pkg/client/unversioned"
|
|
||||||
"k8s.io/kubernetes/pkg/client/unversioned/remotecommand"
|
"k8s.io/kubernetes/pkg/client/unversioned/remotecommand"
|
||||||
remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand"
|
remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand"
|
||||||
|
"k8s.io/kubernetes/test/e2e/framework"
|
||||||
)
|
)
|
||||||
|
|
||||||
func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error {
|
func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error {
|
||||||
|
@ -37,11 +37,11 @@ func execute(method string, url *url.URL, config *restclient.Config, stdin io.Re
|
||||||
return exec.Stream(remotecommandserver.SupportedStreamingProtocols, stdin, stdout, stderr, tty)
|
return exec.Stream(remotecommandserver.SupportedStreamingProtocols, stdin, stdout, stderr, tty)
|
||||||
}
|
}
|
||||||
|
|
||||||
func execCommandInContainer(config *restclient.Config, c *client.Client, ns, podName, containerName string, cmd []string) (string, error) {
|
func execCommandInContainer(config *restclient.Config, f *framework.Framework, ns, podName, containerName string, cmd []string) (string, error) {
|
||||||
var stdout, stderr bytes.Buffer
|
var stdout, stderr bytes.Buffer
|
||||||
var stdin io.Reader
|
var stdin io.Reader
|
||||||
tty := false
|
tty := false
|
||||||
req := c.RESTClient.Post().
|
req := f.Client.RESTClient.Post().
|
||||||
Resource("pods").
|
Resource("pods").
|
||||||
Name(podName).
|
Name(podName).
|
||||||
Namespace(ns).
|
Namespace(ns).
|
||||||
|
|
|
@ -24,9 +24,9 @@ import (
|
||||||
|
|
||||||
"k8s.io/kubernetes/pkg/api"
|
"k8s.io/kubernetes/pkg/api"
|
||||||
"k8s.io/kubernetes/pkg/api/unversioned"
|
"k8s.io/kubernetes/pkg/api/unversioned"
|
||||||
"k8s.io/kubernetes/pkg/apimachinery/registered"
|
|
||||||
"k8s.io/kubernetes/pkg/client/restclient"
|
"k8s.io/kubernetes/pkg/client/restclient"
|
||||||
client "k8s.io/kubernetes/pkg/client/unversioned"
|
client "k8s.io/kubernetes/pkg/client/unversioned"
|
||||||
|
"k8s.io/kubernetes/test/e2e/framework"
|
||||||
|
|
||||||
. "github.com/onsi/ginkgo"
|
. "github.com/onsi/ginkgo"
|
||||||
. "github.com/onsi/gomega"
|
. "github.com/onsi/gomega"
|
||||||
|
@ -45,55 +45,60 @@ const (
|
||||||
privilegedCommand = "ip link add dummy1 type dummy"
|
privilegedCommand = "ip link add dummy1 type dummy"
|
||||||
)
|
)
|
||||||
|
|
||||||
type PrivilegedPodTestConfig struct {
|
|
||||||
config *restclient.Config
|
|
||||||
client *client.Client
|
|
||||||
namespace string
|
|
||||||
hostExecPod *api.Pod
|
|
||||||
privilegedPod *api.Pod
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ = Describe("PrivilegedPod", func() {
|
var _ = Describe("PrivilegedPod", func() {
|
||||||
var c *client.Client
|
f := NewDefaultFramework("privileged-pod")
|
||||||
restClientConfig := &restclient.Config{Host: *apiServerAddress}
|
|
||||||
BeforeEach(func() {
|
|
||||||
// Setup the apiserver client
|
|
||||||
c = client.NewOrDie(restClientConfig)
|
|
||||||
})
|
|
||||||
It("should test privileged pod", func() {
|
It("should test privileged pod", func() {
|
||||||
namespace := "privileged-pods"
|
restClientConfig := &restclient.Config{Host: *apiServerAddress}
|
||||||
config := &PrivilegedPodTestConfig{
|
|
||||||
client: c,
|
|
||||||
config: restClientConfig,
|
|
||||||
namespace: namespace,
|
|
||||||
}
|
|
||||||
By("Creating a host exec pod")
|
By("Creating a host exec pod")
|
||||||
config.hostExecPod = createPodAndWaitUntilRunning(c, newHostExecPodSpec(config.namespace, "hostexec"))
|
podClient := f.Client.Pods(f.Namespace.Name)
|
||||||
|
hostExecPod := newHostExecPodSpec("hostexec")
|
||||||
|
defer podClient.Delete(hostExecPod.Name, nil)
|
||||||
|
_, err := podClient.Create(hostExecPod)
|
||||||
|
Expect(err).To(BeNil(), fmt.Sprintf("Error creating Pod %v", err))
|
||||||
|
|
||||||
|
By("Waiting for host exec pod to be running")
|
||||||
|
framework.ExpectNoError(f.WaitForPodRunning(hostExecPod.Name))
|
||||||
|
|
||||||
|
By("Getting status of the host exec pod")
|
||||||
|
hostExecPod, err = podClient.Get(hostExecPod.Name)
|
||||||
|
Expect(err).To(BeNil(), fmt.Sprintf("Error getting Pod %v", err))
|
||||||
|
|
||||||
By("Creating a privileged pod")
|
By("Creating a privileged pod")
|
||||||
config.privilegedPod = createPodAndWaitUntilRunning(c, config.createPrivilegedPodSpec())
|
privilegedPod := createPrivilegedPodSpec()
|
||||||
|
defer podClient.Delete(privilegedPod.Name, nil)
|
||||||
|
_, err = podClient.Create(privilegedPod)
|
||||||
|
Expect(err).To(BeNil(), fmt.Sprintf("Error creating Pod %v", err))
|
||||||
|
|
||||||
|
By("Waiting for privileged pod to be running")
|
||||||
|
framework.ExpectNoError(f.WaitForPodRunning(privilegedPod.Name))
|
||||||
|
|
||||||
|
By("Getting status of privileged pod")
|
||||||
|
privilegedPod, err = podClient.Get(privilegedPod.Name)
|
||||||
|
Expect(err).To(BeNil(), fmt.Sprintf("Error getting Pod %v", err))
|
||||||
|
|
||||||
By("Executing privileged command on privileged container")
|
By("Executing privileged command on privileged container")
|
||||||
config.runPrivilegedCommandOnPrivilegedContainer()
|
outputMap := dialFromContainer(restClientConfig, f, hostExecPod, privilegedPod.Status.PodIP, privilegedHttpPort)
|
||||||
|
Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap))
|
||||||
|
|
||||||
By("Executing privileged command on non-privileged container")
|
By("Executing privileged command on non-privileged container")
|
||||||
config.runPrivilegedCommandOnNonPrivilegedContainer()
|
outputMap = dialFromContainer(restClientConfig, f, hostExecPod, privilegedPod.Status.PodIP, notPrivilegedHttpPort)
|
||||||
|
Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap))
|
||||||
})
|
})
|
||||||
})
|
})
|
||||||
|
|
||||||
func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
|
func createPrivilegedPodSpec() *api.Pod {
|
||||||
isPrivileged := true
|
isPrivileged := true
|
||||||
notPrivileged := false
|
notPrivileged := false
|
||||||
pod := &api.Pod{
|
pod := &api.Pod{
|
||||||
TypeMeta: unversioned.TypeMeta{
|
TypeMeta: unversioned.TypeMeta{
|
||||||
Kind: "Pod",
|
Kind: "Pod",
|
||||||
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
|
APIVersion: "v1",
|
||||||
},
|
},
|
||||||
ObjectMeta: api.ObjectMeta{
|
ObjectMeta: api.ObjectMeta{
|
||||||
Name: privilegedPodName,
|
Name: privilegedPodName,
|
||||||
Namespace: config.namespace,
|
|
||||||
},
|
},
|
||||||
Spec: api.PodSpec{
|
Spec: api.PodSpec{
|
||||||
|
NodeName: *nodeName,
|
||||||
Containers: []api.Container{
|
Containers: []api.Container{
|
||||||
{
|
{
|
||||||
Name: privilegedContainerName,
|
Name: privilegedContainerName,
|
||||||
|
@ -123,17 +128,7 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
|
||||||
return pod
|
return pod
|
||||||
}
|
}
|
||||||
|
|
||||||
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnPrivilegedContainer() {
|
func dialFromContainer(config *restclient.Config, f *framework.Framework, hostExecPod *api.Pod, containerIP string, containerHttpPort int) map[string]string {
|
||||||
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, privilegedHttpPort)
|
|
||||||
Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap))
|
|
||||||
}
|
|
||||||
|
|
||||||
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnNonPrivilegedContainer() {
|
|
||||||
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, notPrivilegedHttpPort)
|
|
||||||
Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap))
|
|
||||||
}
|
|
||||||
|
|
||||||
func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, containerHttpPort int) map[string]string {
|
|
||||||
v := url.Values{}
|
v := url.Values{}
|
||||||
v.Set("shellCommand", "ip link add dummy1 type dummy")
|
v.Set("shellCommand", "ip link add dummy1 type dummy")
|
||||||
cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'",
|
cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'",
|
||||||
|
@ -142,8 +137,7 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con
|
||||||
v.Encode())
|
v.Encode())
|
||||||
By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd))
|
By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd))
|
||||||
|
|
||||||
stdout, err := execCommandInContainer(config.config, config.client, config.hostExecPod.Namespace, config.hostExecPod.Name, config.hostExecPod.Spec.Containers[0].Name,
|
stdout, err := execCommandInContainer(config, f, f.Namespace.Name, hostExecPod.Name, hostExecPod.Spec.Containers[0].Name, []string{"/bin/sh", "-c", cmd})
|
||||||
[]string{"/bin/sh", "-c", cmd})
|
|
||||||
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err))
|
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err))
|
||||||
|
|
||||||
var output map[string]string
|
var output map[string]string
|
||||||
|
@ -153,17 +147,17 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con
|
||||||
}
|
}
|
||||||
|
|
||||||
// newHostExecPodSpec returns the pod spec of hostexec pod
|
// newHostExecPodSpec returns the pod spec of hostexec pod
|
||||||
func newHostExecPodSpec(ns, name string) *api.Pod {
|
func newHostExecPodSpec(name string) *api.Pod {
|
||||||
return &api.Pod{
|
return &api.Pod{
|
||||||
TypeMeta: unversioned.TypeMeta{
|
TypeMeta: unversioned.TypeMeta{
|
||||||
Kind: "Pod",
|
Kind: "Pod",
|
||||||
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
|
APIVersion: "v1",
|
||||||
},
|
},
|
||||||
ObjectMeta: api.ObjectMeta{
|
ObjectMeta: api.ObjectMeta{
|
||||||
Name: name,
|
Name: name,
|
||||||
Namespace: ns,
|
|
||||||
},
|
},
|
||||||
Spec: api.PodSpec{
|
Spec: api.PodSpec{
|
||||||
|
NodeName: *nodeName,
|
||||||
Containers: []api.Container{
|
Containers: []api.Container{
|
||||||
{
|
{
|
||||||
Name: "hostexec",
|
Name: "hostexec",
|
||||||
|
|
Loading…
Reference in New Issue