Add non-root end-to-end test cases to credentials test suite #327
Conversation
Signed-off-by: Burak Varlı <burakvar@amazon.co.uk>
Signed-off-by: Burak Varlı <burakvar@amazon.co.uk>
Signed-off-by: Burak Varlı <burakvar@amazon.co.uk>
unexge
force-pushed
the
unexge/credential-tests-non-root
branch
from
540618a to
1c0014d
Compare
|
|
||
| return pod, sa | ||
| } | ||
|
|
||
| It("should use pod's service account's read-only role", func(ctx context.Context) { | ||
| pod, _ := createPodWithServiceAccountAndPolicy(ctx, iamPolicyS3ReadOnlyAccess, false) | ||
| pod, _ := createPodWithServiceAccountAndPolicy(ctx, iamPolicyS3ReadOnlyAccess, false, false) |
There was a problem hiding this comment.
Is there a way to pass in keyword arguments here? Right now I can't understand what these boolean arguments are for.
There was a problem hiding this comment.
Go doesn't support named arguments, usually structs are used if such a thing is desired, but I think it'd make this more verbose. Since this is a local helper function and not used outside this test-case, I think I'd prefer current one.
| @@ -183,13 +182,9 @@ func (t *s3CSICacheTestSuite) DefineTests(driver storageframework.TestDriver, pa | |||
| mountOptions := append(baseMountOptions, | |||
| "allow-delete", | |||
| "allow-other", | |||
| fmt.Sprintf("uid=%d", *e2epod.GetDefaultNonRootUser()), | |||
| fmt.Sprintf("uid=%d", defaultNonRootUser), | |||
There was a problem hiding this comment.
Where does this variable come from? I think it would be better to do explicit imports rather than clobbering the variable namespace
There was a problem hiding this comment.
It's coming from util.go in the same directory/package. Go declarations are package-scoped, if an identifier used without any package prefix it means it's coming from the same package (or imported via dot import, but that's discouraged except in test packages)
| pod.Spec.Containers[0].SecurityContext.RunAsGroup = ptr.To(defaultNonRootGroup) | ||
| pod.Spec.Containers[0].SecurityContext.RunAsNonRoot = ptr.To(true) | ||
| }) | ||
| podModifiers := append([]func(*v1.Pod){podModifierNonRoot}, basePodModifiers...) |
There was a problem hiding this comment.
Same here, could we add the file's namespace here so it's easier to search? Also, why does it need the []func(*v1.Pod){...} bit?
There was a problem hiding this comment.
For local/unexported identifiers (i.e., the identifiers starts with a lowercase, see https://go.dev/tour/basics/3) that means they're coming from the same package and there is no importing mechanism for them.
This append block basically infers the type of slice, and []func(*v1.Pod){...} is to make sure it infers the correct type.
| } | ||
| // We need to set this false at Pod-level as `chmod-cache-dir` needs to run as `root` and this | ||
| // would prevent container creation if its true. | ||
| pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(false) |
There was a problem hiding this comment.
Why are we always changing this even if the test explicitly set the security context?
There was a problem hiding this comment.
If you instantiate Kubernetes testing framework with LevelRestricted, it sets this to true, meaning all containers in the Pod must run as non-root (i.e., not 0).
Since this is a generic helper function and gets called from different security levels, we're just making sure to set it to false, so we can spawn our privileged container needed to create cache directory. The other containers created for this Pod would probably have their RunAsUser set to non-root (due to security level), so we just need to remove this restriction at Pod-level for our container.
This whole ensureCacheDirExistsInNode is very hacky due to fact Mountpoint running in the host and hopefully this will go away with running Mountpoint inside container.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.