Commit Graph

73 Commits (8b98e802eddb9f478ff7d991a2f72f60c165388a)

Author SHA1 Message Date
Kubernetes Prow Robot 6a8ad537a7
Merge pull request #72688 from liggitt/token-test
Update service account token mount test
2019-01-10 14:42:51 -08:00
Kubernetes Prow Robot 8955857998
Merge pull request #71199 from k-toyoda-pi/fix_node_authn_e2e_test
e2e/auth: fix NodeAuthenticator tests not working
2019-01-10 02:31:28 -08:00
Jordan Liggitt 421d8649bf Update service account token mount test 2019-01-08 11:27:51 -05:00
Tim Allclair 10f45aacd5 Split audit test cases into separate tests 2018-12-18 16:58:19 -08:00
Dennis Czombera f9df691c72 Add an impersonation test case to the audit E2E test 2018-12-18 11:13:39 +01:00
toyoda 52959b4bcb e2e/auth: fix NodeAuthenticator tests not working 2018-11-19 15:40:17 +09:00
David Eads 9b31985b08 fix client-side specification of timeout now that it is honored 2018-11-16 11:43:37 -05:00
k8s-ci-robot fb6716e83c
Merge pull request #67495 from islinwb/policy_psp
use PodSecurityPolicySpec of policy/v1beta1 instead of extensions/v1beta1
2018-10-29 08:31:15 -07:00
Pradip-Khakurel 8c4fd312c9 make error messages more helpful for some e2e auth tests 2018-10-18 22:03:02 +02:00
Weibin Lin e81776b140 update bazel 2018-10-18 10:18:15 +08:00
Weibin Lin d02e3bd780 use PodSecurityPolicySpec of policy/v1beta1 instead of extensions/v1beta1 2018-10-18 10:18:13 +08:00
Eric Chiang 766f5875bf Remove ericchiang from OWNERS files
Kept myself in the OpenID Connect ones for now.
2018-10-11 18:11:15 -07:00
Janet Kuo 0a6389e872 Add e2e test for TTL after finished 2018-09-04 14:21:14 -07:00
Kubernetes Submit Queue a224e53dab
Merge pull request #66842 from hanxiaoshuai/cleanup0801
Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up unused parameter in func restrictedPod and testPrivilegedPods

**What this PR does / why we need it**:
clean up unused parameter in func restrictedPod and testPrivilegedPods
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/kind cleanup
**Release note**:

```release-note
NONE
```
2018-08-09 08:39:41 -07:00
Kubernetes Submit Queue 28b2b21287
Merge pull request #65891 from CaoShuFeng/audit_v1_stable
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

upgrade Audit api version to stable

Partial Fix: https://github.com/kubernetes/kubernetes/issues/65266

TODO:
    use v1 version of advanced audit policy in [kubeadm](86b9a53226/cmd/kubeadm/app/util/audit/utils.go (L29)), [gce script](86b9a53226/cluster/gce/gci/configure-helper.sh (L743)), [kubemark](86b9a53226/test/kubemark/resources/start-kubemark-master.sh (L349))



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
audit.k8s.io api group is upgraded from v1beta1 to v1.
Deprecated element metav1.ObjectMeta and Timestamp are removed from audit Events in v1 version.
Default value of option --audit-webhook-version and --audit-log-version will be changed from `audit.k8s.io/v1beta1` to `audit.k8s.io/v1` in release 1.13
```
2018-08-08 02:17:24 -07:00
hangaoshuai 7e61ea9e72 clean up unused parameter in func restrictedPod and testPrivilegedPods 2018-08-01 09:55:39 +08:00
hangaoshuai e0796ab913 should get return err and check it 2018-08-01 09:34:41 +08:00
Cao Shufeng 858e4508c4 add an integration test for advanced audit feature 2018-07-31 11:10:51 +08:00
stewart-yu f1343af5d7 auto-generated file 2018-07-28 07:54:17 +08:00
stewart-yu 55251c716a update the import file for move util/pointer to k8s.io/utils 2018-07-27 19:47:02 +08:00
Srini Brahmaroutu dbeb16c221 Adding details to Conformance Tests using RFC 2119 standards. 2018-07-05 16:02:59 -07:00
Dr. Stefan Schimanski 42f1e81488 apiextensions-apiserver: add pkg/cmd/server/testing pkg for integration bootstrapping
In analogy to kube-apiserver.
2018-07-05 17:34:16 +02:00
Jeff Grafton 23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Di Xu 924df8a111 auto-generated files 2018-06-12 17:05:27 +08:00
Di Xu 8094e1c681 add e2e regression tests for the kubelet being secure 2018-06-12 17:05:27 +08:00
Kubernetes Submit Queue deb632e727
Merge pull request #64204 from sttts/sttts-unify-NewNoxuInstance
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions: unify mono- and multi-versioned test helpers

The mono-versioned helpers are a special case of the multi-versioned ones.

Fixes part of https://github.com/kubernetes/kubernetes/issues/64136.
2018-05-25 04:49:37 -07:00
Dr. Stefan Schimanski 818147d6fb apiextensions: make CreateNewCustomResourceDefinition return created CRD 2018-05-23 21:41:55 +02:00
Anthony Yeh 046ae81e35
e2e/auth: Expect apps/v1 Deployment calls in audit test. 2018-05-22 13:43:07 -07:00
Anthony Yeh a6a5190494
test/e2e: Use apps/v1 Deployment/ReplicaSet.
This must be done at the same time as the controller update,
since they share code.
2018-05-22 13:43:06 -07:00
Kubernetes Submit Queue b75d6464c8
Merge pull request #63189 from hzxuzhonghu/master
Automatic merge from submit-queue (batch tested with PRs 61804, 63189). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

make use of simple dynamic client instead of deprecated client pool

**What this PR does / why we need it**:

Use simple dynamic client through all integration test.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63182

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-04-27 08:44:07 -07:00
xuzhonghu 393324497f make use of simple dynamic client in test 2018-04-27 13:38:58 +08:00
Zhen Wang e102633ae8 Change docker/default to runtime/default 2018-04-19 10:39:53 -07:00
Kubernetes Submit Queue 58c0748b4d
Merge pull request #58807 from CaoShuFeng/audit_annotation_rbac
Automatic merge from submit-queue (batch tested with PRs 61183, 58807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add RBAC information to audit logs

Depends on: https://github.com/kubernetes/kubernetes/pull/58806
**Release note**:
```release-note
RBAC information is included in audit logs via audit.Event annotations:
authorization.k8s.io/decision = {allow, forbid}
authorization.k8s.io/reason = human-readable reason for the decision
```
2018-04-06 19:31:04 -07:00
Manjunath A Kumatagi 1bb810e749 Use pause manifest image 2018-04-06 11:00:50 +05:30
Kubernetes Submit Queue c46738a3f0
Merge pull request #60073 from justaugustus/int-to-int32ptr
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use `pkg/util/pointer` functions instead of self-written versions

**What this PR does / why we need it**:
Replaces instances of module-written `int(32|64)? --> *int(32|64)?` functions with functions from k8s.io/kubernetes/pkg/util/pointer

**Special notes for your reviewer**:

Here's the grep used, based on the comments in:
* https://github.com/kubernetes/kubernetes/pull/59924#issuecomment-366119396
* https://github.com/kubernetes/kubernetes/issues/59971#issue-297766556

```bash
$ git grep -E 'func\ [^ (]+\([^ ]+\ int(32|64)?\)\ \*int(32|64)?' !(vendor|staging) | grep -v pkg/util/pointer

pkg/apis/apps/v1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/apps/v1beta1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/apps/v1beta2/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/autoscaling/v1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/autoscaling/v2beta1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/autoscaling/validation/validation_test.go:func newInt32(val int32) *int32 {
pkg/apis/batch/v1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/batch/v1beta1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/apis/core/v1/defaults_test.go:func newInt(val int32) *int32 {
pkg/apis/core/validation/validation_test.go:func newInt32(val int) *int32 {
pkg/apis/extensions/v1beta1/defaults_test.go:func newInt32(val int32) *int32 {
pkg/controller/deployment/sync_test.go:func intOrStrP(val int) *intstr.IntOrString {
pkg/kubectl/autoscale_test.go:func newInt32(value int) *int32 {
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go:func userIDPtr(i int) *int64 {
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go:func groupIDPtr(i int) *int64 {
test/e2e/apps/deployment.go:func intOrStrP(num int) *intstr.IntOrString {
test/e2e/auth/pod_security_policy.go:func intPtr(i int64) *int64 {
test/integration/deployment/util.go:func intOrStrP(num int) *intstr.IntOrString {
```

**Release note**:

```release-note
NONE
```
/kind cleanup
/cc @php-coder 
/assign @tallclair
2018-04-02 16:22:28 -07:00
Michael Taufen ab8dc12333 node authorizer sets up access rules for dynamic config
This PR makes the node authorizer automatically set up access rules for
dynamic Kubelet config.

I also added some validation to the node strategy, which I discovered we
were missing while writing this.
2018-03-27 08:49:45 -07:00
Stephen Augustus 09aa0b9c1d pkg/util/pointer: Update `int` pointer functions
* Implement `Int64Ptr` function
* Replace per module functions of `int(32|64)?` --> `*int(32|64)?`
* Update bazel rules
2018-03-27 10:30:01 -04:00
Cao Shufeng 440aab5b86 add e2e test 2018-03-19 08:57:39 +08:00
Mik Vyatskov f327a2a4c0 Add retrying to audit logging e2e tests
Signed-off-by: Mik Vyatskov <vmik@google.com>
2018-03-06 14:56:56 +01:00
Slava Semushin 4e273a69f7 Run hack/update-bazel.sh 2018-02-27 17:14:41 +01:00
Slava Semushin b783c6e25b E2E: add tests for PSP from the "policy" API Group. 2018-02-27 17:14:40 +01:00
Kubernetes Submit Queue da171196d9
Merge pull request #58900 from Random-Liu/fix-psp-test
Automatic merge from submit-queue (batch tested with PRs 58903, 58141, 58900). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix pod security policy capability test.

Fixes https://github.com/kubernetes/kubernetes/issues/58901.

In our document, we explicitly say:
```
The following fields take a list of capabilities, specified as the capability name in ALL_CAPS without the CAP_ prefix.
```
https://kubernetes.io/docs/concepts/policy/pod-security-policy/

@kubernetes/sig-node-pr-reviews 

**Release note**:
```release-note
none
```
2018-01-26 21:00:38 -08:00
Lantao Liu 49dfaec72e Fix pod security policy capability test. 2018-01-27 01:43:01 +00:00
Cao Shufeng 4e7398b67b remove duplicated import 2018-01-17 09:34:59 +08:00
liz b814c5677f
Collect all the assorted image URLs from e2e tests in one place
utils/image/manifest has an additional `arch` parameter, which determines
whether an image ends in `-$ARCH` (like `-amd64`).

All locations that previously had gcr.io urls referenced in costants or inline
have been updated to refere test/utils/image.
2017-12-19 12:16:07 -05:00
Tim Hockin eba5b6092a Use k8s.gcr.io vanity domain for container images 2017-12-18 09:18:34 -08:00
Kubernetes Submit Queue baf93c060e
Merge pull request #55995 from supereagle/extensions-client-with-version
Automatic merge from submit-queue (batch tested with PRs 55900, 55995, 55913, 55467, 55376). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use extensions client with explicit version

**What this PR does / why we need it**:
Extensions client without explicit version has been deprecated, change them to the one with explicit version.

**Which issue(s) this PR fixes**:
Fixes partially #55993

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-12-14 00:45:15 -08:00
Kubernetes Submit Queue 876259435a
Merge pull request #55991 from supereagle/core-client-with-version
Automatic merge from submit-queue (batch tested with PRs 54604, 55781, 55806, 55935, 55991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use core client with explicit version

**What this PR does / why we need it**:
Core client without explicit version has been deprecated, change them to the one with explicit version.

**Which issue(s) this PR fixes**:
Fixes partially #55993

**Special notes for your reviewer**:
/cc @kubernetes/sig-api-machinery-pr-reviews
/cc @caesarxuchao @k82cn @sttts @kevin-wangzefeng 

**Release note**:
```release-note
NONE
```
2017-12-13 22:26:01 -08:00
Marian Lobur 7a159835bc Add DisabledForLargeClusters tag to audit tests.
Remove this tag once functionality from feature request #53455 is implemented.
2017-12-04 13:58:25 +01:00
Marian Lobur b2cf695bcb Remove gke from expected providers of audit e2e test.
In case of GKE we don't write logs to the file.
2017-11-28 12:15:21 +01:00