scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-03 03:38:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #88488 from gnufied/implement-fix-recursive-chown

Browse Source 
Implement changes for fsgroup recursive chown
This commit is contained in:
Kubernetes Prow Robot
2020-03-05 21:39:30 -08:00
committed by GitHub
parent e90c908f64 b132959687
commit 264e2f1744
107 changed files with 2924 additions and 2001 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
pkg/apis/core/validation/validation_test.go
View File

@@ -6558,6 +6558,9 @@ func TestValidatePodSpec(t *testing.T) {
maxUserID := int64(2147483647)
minGroupID := int64(0)
maxGroupID := int64(2147483647)
goodfsGroupChangePolicy := core.FSGroupChangeAlways
badfsGroupChangePolicy1 := core.PodFSGroupChangePolicy("invalid")
badfsGroupChangePolicy2 := core.PodFSGroupChangePolicy("")
successCases := []core.PodSpec{
{ // Populate basic fields, leave defaults for most.
@@ -6705,6 +6708,14 @@ func TestValidatePodSpec(t *testing.T) {
RuntimeClassName: utilpointer.StringPtr("valid-sandbox"),
Overhead: core.ResourceList{},
},
{
Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}},
SecurityContext: &core.PodSecurityContext{
FSGroupChangePolicy: &goodfsGroupChangePolicy,
},
RestartPolicy: core.RestartPolicyAlways,
DNSPolicy: core.DNSClusterFirst,
},
}
for i := range successCases {
if errs := ValidatePodSpec(&successCases[i], field.NewPath("field")); len(errs) != 0 {
@@ -6892,6 +6903,22 @@ func TestValidatePodSpec(t *testing.T) {
DNSPolicy: core.DNSClusterFirst,
RuntimeClassName: utilpointer.StringPtr("invalid/sandbox"),
},
"bad empty fsGroupchangepolicy": {
Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}},
SecurityContext: &core.PodSecurityContext{
FSGroupChangePolicy: &badfsGroupChangePolicy2,
},
RestartPolicy: core.RestartPolicyAlways,
DNSPolicy: core.DNSClusterFirst,
},
"bad invalid fsgroupchangepolicy": {
Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}},
SecurityContext: &core.PodSecurityContext{
FSGroupChangePolicy: &badfsGroupChangePolicy1,
},
RestartPolicy: core.RestartPolicyAlways,
DNSPolicy: core.DNSClusterFirst,
},
}
for k, v := range failureCases {
if errs := ValidatePodSpec(&v, field.NewPath("field")); len(errs) == 0 {
@@ -8269,6 +8296,7 @@ func TestValidatePodUpdate(t *testing.T) {
activeDeadlineSecondsNegative = int64(-30)
activeDeadlineSecondsPositive = int64(30)
activeDeadlineSecondsLarger = int64(31)
validfsGroupChangePolicy = core.FSGroupChangeOnRootMismatch
now = metav1.Now()
grace = int64(30)
@@ -8719,6 +8747,36 @@ func TestValidatePodUpdate(t *testing.T) {
"spec: Forbidden: pod updates may not change fields",
"cpu change",
},
{
core.Pod{
ObjectMeta: metav1.ObjectMeta{Name: "foo"},
Spec: core.PodSpec{
Containers: []core.Container{
{
Image: "foo:V1",
},
},
SecurityContext: &core.PodSecurityContext{
FSGroupChangePolicy: &validfsGroupChangePolicy,
},
},
},
core.Pod{
ObjectMeta: metav1.ObjectMeta{Name: "foo"},
Spec: core.PodSpec{
Containers: []core.Container{
{
Image: "foo:V2",
},
},
SecurityContext: &core.PodSecurityContext{
FSGroupChangePolicy: nil,
},
},
},
"spec: Forbidden: pod updates may not change fields",
"fsGroupChangePolicy change",
},
{
core.Pod{
ObjectMeta: metav1.ObjectMeta{Name: "foo"},