scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-10-31 18:28:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add SELinuxChangePolicy validation

Browse Source
This commit is contained in:
Jan Safranek
2024-10-08 10:27:08 +02:00
parent 3867cb40ad
commit 6ca7b959e4
4 changed files with 282 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
pkg/apis/core/validation/validation_test.go
View File

@@ -20557,6 +20557,7 @@ func TestValidateOSFields(t *testing.T) {
"SecurityContext.RunAsGroup",
"SecurityContext.RunAsUser",
"SecurityContext.SELinuxOptions",
"SecurityContext.SELinuxChangePolicy",
"SecurityContext.SeccompProfile",
"SecurityContext.ShareProcessNamespace",
"SecurityContext.SupplementalGroups",
@@ -25000,3 +25001,78 @@ func TestValidateContainerStatusAllocatedResourcesStatus(t *testing.T) {
})
}
}
func TestValidateSELinuxChangePolicy(t *testing.T) {
tests := []struct {
name string
pod *core.Pod
allowOnlyRecursive bool
wantErrs field.ErrorList
}{
{
name: "nil is valid",
pod: podtest.MakePod("pod", podtest.SetSecurityContext(&core.PodSecurityContext{
SELinuxChangePolicy: nil,
})),
allowOnlyRecursive: false,
wantErrs: nil,
},
{
name: "Recursive is always valid",
pod: podtest.MakePod("pod", podtest.SetSecurityContext(&core.PodSecurityContext{
SELinuxChangePolicy: ptr.To(core.SELinuxChangePolicyRecursive),
})),
allowOnlyRecursive: false,
wantErrs: nil,
},
{
name: "MountOption is not valid when AllowOnlyRecursiveSELinuxChangePolicy",
pod: podtest.MakePod("pod", podtest.SetSecurityContext(&core.PodSecurityContext{
SELinuxChangePolicy: ptr.To(core.SELinuxChangePolicyMountOption),
})),
allowOnlyRecursive: true,
wantErrs: field.ErrorList{
field.NotSupported(
field.NewPath("spec", "securityContext", "seLinuxChangePolicy"),
core.PodSELinuxChangePolicy("MountOption"),
[]string{"Recursive"}),
},
},
{
name: "MountOption is valid when not AllowOnlyRecursiveSELinuxChangePolicy",
pod: podtest.MakePod("pod", podtest.SetSecurityContext(&core.PodSecurityContext{
SELinuxChangePolicy: ptr.To(core.SELinuxChangePolicyMountOption),
})),
allowOnlyRecursive: false,
wantErrs: nil,
},
{
name: "invalid value",
pod: podtest.MakePod("pod", podtest.SetSecurityContext(&core.PodSecurityContext{
SELinuxChangePolicy: ptr.To(core.PodSELinuxChangePolicy("InvalidValue")),
})),
allowOnlyRecursive: false,
wantErrs: field.ErrorList{
field.NotSupported(field.NewPath("spec", "securityContext", "seLinuxChangePolicy"),
core.PodSELinuxChangePolicy("InvalidValue"),
[]string{"MountOption", "Recursive"}),
},
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
opts := PodValidationOptions{
AllowOnlyRecursiveSELinuxChangePolicy: tc.allowOnlyRecursive,
}
errs := ValidatePodSpec(&tc.pod.Spec, &tc.pod.ObjectMeta, field.NewPath("spec"), opts)
if len(errs) == 0 {
errs = nil
}
if diff := cmp.Diff(tc.wantErrs, errs); diff != "" {
t.Errorf("unexpected field errors (-want, +got):\n%s", diff)
}
})
}
}