github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #66842 from hanxiaoshuai/cleanup0801 

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up unused parameter in func restrictedPod and testPrivilegedPods

**What this PR does / why we need it**:
clean up unused parameter in func restrictedPod and testPrivilegedPods
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/kind cleanup
**Release note**:

```release-note
NONE
```
pull/8/head
Kubernetes Submit Queue 2018-08-09 08:39:41 -07:00 committed by GitHub
parent d04d7b4db2 7e61ea9e72
commit a224e53dab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
test/e2e/auth/pod_security_policy.go
View File

@ -75,7 +75,7 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
It("should forbid pod creation when no PSP is available", func() { It("should forbid pod creation when no PSP is available", func() {
By("Running a restricted pod") By("Running a restricted pod")
_, err := c.CoreV1().Pods(ns).Create(restrictedPod(f, "restricted")) _, err := c.CoreV1().Pods(ns).Create(restrictedPod("restricted"))
expectForbidden(err) expectForbidden(err)
}) })
@ -87,11 +87,11 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
defer cleanup() defer cleanup()
By("Running a restricted pod") By("Running a restricted pod")
pod, err := c.CoreV1().Pods(ns).Create(restrictedPod(f, "allowed")) pod, err := c.CoreV1().Pods(ns).Create(restrictedPod("allowed"))
framework.ExpectNoError(err) framework.ExpectNoError(err)
framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, pod.Name, pod.Namespace)) framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, pod.Name, pod.Namespace))
testPrivilegedPods(f, func(pod *v1.Pod) { testPrivilegedPods(func(pod *v1.Pod) {
_, err := c.CoreV1().Pods(ns).Create(pod) _, err := c.CoreV1().Pods(ns).Create(pod)
expectForbidden(err) expectForbidden(err)
}) })
@ -103,11 +103,11 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
defer cleanup() defer cleanup()
By("Running a restricted pod") By("Running a restricted pod")
pod, err := c.CoreV1().Pods(ns).Create(restrictedPod(f, "allowed")) pod, err := c.CoreV1().Pods(ns).Create(restrictedPod("allowed"))
framework.ExpectNoError(err) framework.ExpectNoError(err)
framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, pod.Name, pod.Namespace)) framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, pod.Name, pod.Namespace))
testPrivilegedPods(f, func(pod *v1.Pod) { testPrivilegedPods(func(pod *v1.Pod) {
_, err := c.CoreV1().Pods(ns).Create(pod) _, err := c.CoreV1().Pods(ns).Create(pod)
expectForbidden(err) expectForbidden(err)
}) })
@ -121,7 +121,7 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
expectedPSP, cleanup := createAndBindPSP(f, framework.PrivilegedPSP("permissive")) expectedPSP, cleanup := createAndBindPSP(f, framework.PrivilegedPSP("permissive"))
defer cleanup() defer cleanup()
testPrivilegedPods(f, func(pod *v1.Pod) { testPrivilegedPods(func(pod *v1.Pod) {
p, err := c.CoreV1().Pods(ns).Create(pod) p, err := c.CoreV1().Pods(ns).Create(pod)
framework.ExpectNoError(err) framework.ExpectNoError(err)
framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, p.Name, p.Namespace)) framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, p.Name, p.Namespace))
@ -143,7 +143,7 @@ var _ = SIGDescribe("PodSecurityPolicy", func() {
expectedPSP, cleanup := createAndBindPSPInPolicy(f, privilegedPSPInPolicy("permissive")) expectedPSP, cleanup := createAndBindPSPInPolicy(f, privilegedPSPInPolicy("permissive"))
defer cleanup() defer cleanup()
testPrivilegedPods(f, func(pod *v1.Pod) { testPrivilegedPods(func(pod *v1.Pod) {
p, err := c.CoreV1().Pods(ns).Create(pod) p, err := c.CoreV1().Pods(ns).Create(pod)
framework.ExpectNoError(err) framework.ExpectNoError(err)
framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, p.Name, p.Namespace)) framework.ExpectNoError(framework.WaitForPodNameRunningInNamespace(c, p.Name, p.Namespace))
@ -163,16 +163,16 @@ func expectForbidden(err error) {
Expect(apierrs.IsForbidden(err)).To(BeTrue(), "should be forbidden error") Expect(apierrs.IsForbidden(err)).To(BeTrue(), "should be forbidden error")
} }
func testPrivilegedPods(f *framework.Framework, tester func(pod *v1.Pod)) { func testPrivilegedPods(tester func(pod *v1.Pod)) {
By("Running a privileged pod", func() { By("Running a privileged pod", func() {
privileged := restrictedPod(f, "privileged") privileged := restrictedPod("privileged")
privileged.Spec.Containers[0].SecurityContext.Privileged = boolPtr(true) privileged.Spec.Containers[0].SecurityContext.Privileged = boolPtr(true)
privileged.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil privileged.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil
tester(privileged) tester(privileged)
}) })
By("Running a HostPath pod", func() { By("Running a HostPath pod", func() {
hostpath := restrictedPod(f, "hostpath") hostpath := restrictedPod("hostpath")
hostpath.Spec.Containers[0].VolumeMounts = []v1.VolumeMount{{ hostpath.Spec.Containers[0].VolumeMounts = []v1.VolumeMount{{
Name: "hp", Name: "hp",
MountPath: "/hp", MountPath: "/hp",
@ -187,26 +187,26 @@ func testPrivilegedPods(f *framework.Framework, tester func(pod *v1.Pod)) {
}) })
By("Running a HostNetwork pod", func() { By("Running a HostNetwork pod", func() {
hostnet := restrictedPod(f, "hostnet") hostnet := restrictedPod("hostnet")
hostnet.Spec.HostNetwork = true hostnet.Spec.HostNetwork = true
tester(hostnet) tester(hostnet)
}) })
By("Running a HostPID pod", func() { By("Running a HostPID pod", func() {
hostpid := restrictedPod(f, "hostpid") hostpid := restrictedPod("hostpid")
hostpid.Spec.HostPID = true hostpid.Spec.HostPID = true
tester(hostpid) tester(hostpid)
}) })
By("Running a HostIPC pod", func() { By("Running a HostIPC pod", func() {
hostipc := restrictedPod(f, "hostipc") hostipc := restrictedPod("hostipc")
hostipc.Spec.HostIPC = true hostipc.Spec.HostIPC = true
tester(hostipc) tester(hostipc)
}) })
if common.IsAppArmorSupported() { if common.IsAppArmorSupported() {
By("Running a custom AppArmor profile pod", func() { By("Running a custom AppArmor profile pod", func() {
aa := restrictedPod(f, "apparmor") aa := restrictedPod("apparmor")
// Every node is expected to have the docker-default profile. // Every node is expected to have the docker-default profile.
aa.Annotations[apparmor.ContainerAnnotationKeyPrefix+"pause"] = "localhost/docker-default" aa.Annotations[apparmor.ContainerAnnotationKeyPrefix+"pause"] = "localhost/docker-default"
tester(aa) tester(aa)
@ -214,13 +214,13 @@ func testPrivilegedPods(f *framework.Framework, tester func(pod *v1.Pod)) {
} }
By("Running an unconfined Seccomp pod", func() { By("Running an unconfined Seccomp pod", func() {
unconfined := restrictedPod(f, "seccomp") unconfined := restrictedPod("seccomp")
unconfined.Annotations[v1.SeccompPodAnnotationKey] = "unconfined" unconfined.Annotations[v1.SeccompPodAnnotationKey] = "unconfined"
tester(unconfined) tester(unconfined)
}) })
By("Running a SYS_ADMIN pod", func() { By("Running a SYS_ADMIN pod", func() {
sysadmin := restrictedPod(f, "sysadmin") sysadmin := restrictedPod("sysadmin")
sysadmin.Spec.Containers[0].SecurityContext.Capabilities = &v1.Capabilities{ sysadmin.Spec.Containers[0].SecurityContext.Capabilities = &v1.Capabilities{
Add: []v1.Capability{"SYS_ADMIN"}, Add: []v1.Capability{"SYS_ADMIN"},
} }
@ -311,7 +311,7 @@ func createAndBindPSPInPolicy(f *framework.Framework, pspTemplate *policy.PodSec
} }
} }
func restrictedPod(f *framework.Framework, name string) *v1.Pod { func restrictedPod(name string) *v1.Pod {
return &v1.Pod{ return &v1.Pod{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: name, Name: name,