mirror of
				https://github.com/optim-enterprises-bv/kubernetes.git
				synced 2025-10-31 18:28:13 +00:00 
			
		
		
		
	Update node e2e "privileged pods" to use the framework.
Signed-off-by: Vishnu kannan <vishnuk@google.com>
This commit is contained in:
		
							
								
								
									
										11
									
								
								Makefile
									
									
									
									
									
								
							
							
						
						
									
										11
									
								
								Makefile
									
									
									
									
									
								
							| @@ -80,7 +80,7 @@ check test: | |||||||
| #   make test_integration | #   make test_integration | ||||||
| test_integration: | test_integration: | ||||||
| 	hack/test-integration.sh | 	hack/test-integration.sh | ||||||
| .PHONY: test_integration test_integ | .PHONY: test_integration | ||||||
|  |  | ||||||
| # Build and run end-to-end tests. | # Build and run end-to-end tests. | ||||||
| # | # | ||||||
| @@ -98,7 +98,7 @@ test_e2e: | |||||||
| # Example: | # Example: | ||||||
| #   make test_e2e_node FOCUS=kubelet SKIP=container | #   make test_e2e_node FOCUS=kubelet SKIP=container | ||||||
| # Build and run tests. | # Build and run tests. | ||||||
| test_e2e_node: | test_e2e_node: ginkgo | ||||||
| 	hack/e2e-node-test.sh FOCUS=$(FOCUS) SKIP=$(SKIP) | 	hack/e2e-node-test.sh FOCUS=$(FOCUS) SKIP=$(SKIP) | ||||||
| .PHONY: test_e2e_node | .PHONY: test_e2e_node | ||||||
|  |  | ||||||
| @@ -146,3 +146,10 @@ release-skip-tests quick-release: | |||||||
| 	KUBE_RELEASE_RUN_TESTS=n KUBE_FASTBUILD=true build/release.sh | 	KUBE_RELEASE_RUN_TESTS=n KUBE_FASTBUILD=true build/release.sh | ||||||
| .PHONY: release-skip-tests quick-release | .PHONY: release-skip-tests quick-release | ||||||
|  |  | ||||||
|  | # Build ginkgo for tests | ||||||
|  | # | ||||||
|  | # Example: | ||||||
|  | #   make ginkgo | ||||||
|  | ginkgo: | ||||||
|  | 	hack/build-go.sh vendor/github.com/onsi/ginkgo/ginkgo | ||||||
|  | .PHONY: ginkgo | ||||||
|   | |||||||
| @@ -23,7 +23,7 @@ report=${REPORT:-"/tmp/"} | |||||||
|  |  | ||||||
| ginkgo=$(kube::util::find-binary "ginkgo") | ginkgo=$(kube::util::find-binary "ginkgo") | ||||||
| if [[ -z "${ginkgo}" ]]; then | if [[ -z "${ginkgo}" ]]; then | ||||||
|   echo "You do not appear to have ginkgo built. Try 'make WHAT=vendor/github.com/onsi/ginkgo/ginkgo'" |   echo "You do not appear to have ginkgo built. 'make WHAT=vendor/github.com/onsi/ginkgo/ginkgo'" | ||||||
|   exit 1 |   exit 1 | ||||||
| fi | fi | ||||||
|  |  | ||||||
|   | |||||||
| @@ -24,9 +24,9 @@ import ( | |||||||
|  |  | ||||||
| 	"k8s.io/kubernetes/pkg/api" | 	"k8s.io/kubernetes/pkg/api" | ||||||
| 	"k8s.io/kubernetes/pkg/client/restclient" | 	"k8s.io/kubernetes/pkg/client/restclient" | ||||||
| 	client "k8s.io/kubernetes/pkg/client/unversioned" |  | ||||||
| 	"k8s.io/kubernetes/pkg/client/unversioned/remotecommand" | 	"k8s.io/kubernetes/pkg/client/unversioned/remotecommand" | ||||||
| 	remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand" | 	remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand" | ||||||
|  | 	"k8s.io/kubernetes/test/e2e/framework" | ||||||
| ) | ) | ||||||
|  |  | ||||||
| func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error { | func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error { | ||||||
| @@ -37,11 +37,11 @@ func execute(method string, url *url.URL, config *restclient.Config, stdin io.Re | |||||||
| 	return exec.Stream(remotecommandserver.SupportedStreamingProtocols, stdin, stdout, stderr, tty) | 	return exec.Stream(remotecommandserver.SupportedStreamingProtocols, stdin, stdout, stderr, tty) | ||||||
| } | } | ||||||
|  |  | ||||||
| func execCommandInContainer(config *restclient.Config, c *client.Client, ns, podName, containerName string, cmd []string) (string, error) { | func execCommandInContainer(config *restclient.Config, f *framework.Framework, ns, podName, containerName string, cmd []string) (string, error) { | ||||||
| 	var stdout, stderr bytes.Buffer | 	var stdout, stderr bytes.Buffer | ||||||
| 	var stdin io.Reader | 	var stdin io.Reader | ||||||
| 	tty := false | 	tty := false | ||||||
| 	req := c.RESTClient.Post(). | 	req := f.Client.RESTClient.Post(). | ||||||
| 		Resource("pods"). | 		Resource("pods"). | ||||||
| 		Name(podName). | 		Name(podName). | ||||||
| 		Namespace(ns). | 		Namespace(ns). | ||||||
|   | |||||||
| @@ -24,9 +24,9 @@ import ( | |||||||
|  |  | ||||||
| 	"k8s.io/kubernetes/pkg/api" | 	"k8s.io/kubernetes/pkg/api" | ||||||
| 	"k8s.io/kubernetes/pkg/api/unversioned" | 	"k8s.io/kubernetes/pkg/api/unversioned" | ||||||
| 	"k8s.io/kubernetes/pkg/apimachinery/registered" |  | ||||||
| 	"k8s.io/kubernetes/pkg/client/restclient" | 	"k8s.io/kubernetes/pkg/client/restclient" | ||||||
| 	client "k8s.io/kubernetes/pkg/client/unversioned" | 	client "k8s.io/kubernetes/pkg/client/unversioned" | ||||||
|  | 	"k8s.io/kubernetes/test/e2e/framework" | ||||||
|  |  | ||||||
| 	. "github.com/onsi/ginkgo" | 	. "github.com/onsi/ginkgo" | ||||||
| 	. "github.com/onsi/gomega" | 	. "github.com/onsi/gomega" | ||||||
| @@ -45,55 +45,60 @@ const ( | |||||||
| 	privilegedCommand          = "ip link add dummy1 type dummy" | 	privilegedCommand          = "ip link add dummy1 type dummy" | ||||||
| ) | ) | ||||||
|  |  | ||||||
| type PrivilegedPodTestConfig struct { |  | ||||||
| 	config        *restclient.Config |  | ||||||
| 	client        *client.Client |  | ||||||
| 	namespace     string |  | ||||||
| 	hostExecPod   *api.Pod |  | ||||||
| 	privilegedPod *api.Pod |  | ||||||
| } |  | ||||||
|  |  | ||||||
| var _ = Describe("PrivilegedPod", func() { | var _ = Describe("PrivilegedPod", func() { | ||||||
| 	var c *client.Client | 	f := NewDefaultFramework("privileged-pod") | ||||||
| 	restClientConfig := &restclient.Config{Host: *apiServerAddress} |  | ||||||
| 	BeforeEach(func() { |  | ||||||
| 		// Setup the apiserver client |  | ||||||
| 		c = client.NewOrDie(restClientConfig) |  | ||||||
| 	}) |  | ||||||
| 	It("should test privileged pod", func() { | 	It("should test privileged pod", func() { | ||||||
| 		namespace := "privileged-pods" | 		restClientConfig := &restclient.Config{Host: *apiServerAddress} | ||||||
| 		config := &PrivilegedPodTestConfig{ |  | ||||||
| 			client:    c, |  | ||||||
| 			config:    restClientConfig, |  | ||||||
| 			namespace: namespace, |  | ||||||
| 		} |  | ||||||
| 		By("Creating a host exec pod") | 		By("Creating a host exec pod") | ||||||
| 		config.hostExecPod = createPodAndWaitUntilRunning(c, newHostExecPodSpec(config.namespace, "hostexec")) | 		podClient := f.Client.Pods(f.Namespace.Name) | ||||||
|  | 		hostExecPod := newHostExecPodSpec("hostexec") | ||||||
|  | 		defer podClient.Delete(hostExecPod.Name, nil) | ||||||
|  | 		_, err := podClient.Create(hostExecPod) | ||||||
|  | 		Expect(err).To(BeNil(), fmt.Sprintf("Error creating Pod %v", err)) | ||||||
|  |  | ||||||
|  | 		By("Waiting for host exec pod to be running") | ||||||
|  | 		framework.ExpectNoError(f.WaitForPodRunning(hostExecPod.Name)) | ||||||
|  |  | ||||||
|  | 		By("Getting status of the host exec pod") | ||||||
|  | 		hostExecPod, err = podClient.Get(hostExecPod.Name) | ||||||
|  | 		Expect(err).To(BeNil(), fmt.Sprintf("Error getting Pod %v", err)) | ||||||
|  |  | ||||||
| 		By("Creating a privileged pod") | 		By("Creating a privileged pod") | ||||||
| 		config.privilegedPod = createPodAndWaitUntilRunning(c, config.createPrivilegedPodSpec()) | 		privilegedPod := createPrivilegedPodSpec() | ||||||
|  | 		defer podClient.Delete(privilegedPod.Name, nil) | ||||||
|  | 		_, err = podClient.Create(privilegedPod) | ||||||
|  | 		Expect(err).To(BeNil(), fmt.Sprintf("Error creating Pod %v", err)) | ||||||
|  |  | ||||||
|  | 		By("Waiting for privileged pod to be running") | ||||||
|  | 		framework.ExpectNoError(f.WaitForPodRunning(privilegedPod.Name)) | ||||||
|  |  | ||||||
|  | 		By("Getting status of privileged pod") | ||||||
|  | 		privilegedPod, err = podClient.Get(privilegedPod.Name) | ||||||
|  | 		Expect(err).To(BeNil(), fmt.Sprintf("Error getting Pod %v", err)) | ||||||
|  |  | ||||||
| 		By("Executing privileged command on privileged container") | 		By("Executing privileged command on privileged container") | ||||||
| 		config.runPrivilegedCommandOnPrivilegedContainer() | 		outputMap := dialFromContainer(restClientConfig, f, hostExecPod, privilegedPod.Status.PodIP, privilegedHttpPort) | ||||||
|  | 		Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap)) | ||||||
|  |  | ||||||
| 		By("Executing privileged command on non-privileged container") | 		By("Executing privileged command on non-privileged container") | ||||||
| 		config.runPrivilegedCommandOnNonPrivilegedContainer() | 		outputMap = dialFromContainer(restClientConfig, f, hostExecPod, privilegedPod.Status.PodIP, notPrivilegedHttpPort) | ||||||
|  | 		Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap)) | ||||||
| 	}) | 	}) | ||||||
| }) | }) | ||||||
|  |  | ||||||
| func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod { | func createPrivilegedPodSpec() *api.Pod { | ||||||
| 	isPrivileged := true | 	isPrivileged := true | ||||||
| 	notPrivileged := false | 	notPrivileged := false | ||||||
| 	pod := &api.Pod{ | 	pod := &api.Pod{ | ||||||
| 		TypeMeta: unversioned.TypeMeta{ | 		TypeMeta: unversioned.TypeMeta{ | ||||||
| 			Kind:       "Pod", | 			Kind:       "Pod", | ||||||
| 			APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(), | 			APIVersion: "v1", | ||||||
| 		}, | 		}, | ||||||
| 		ObjectMeta: api.ObjectMeta{ | 		ObjectMeta: api.ObjectMeta{ | ||||||
| 			Name: privilegedPodName, | 			Name: privilegedPodName, | ||||||
| 			Namespace: config.namespace, |  | ||||||
| 		}, | 		}, | ||||||
| 		Spec: api.PodSpec{ | 		Spec: api.PodSpec{ | ||||||
|  | 			NodeName: *nodeName, | ||||||
| 			Containers: []api.Container{ | 			Containers: []api.Container{ | ||||||
| 				{ | 				{ | ||||||
| 					Name:            privilegedContainerName, | 					Name:            privilegedContainerName, | ||||||
| @@ -123,17 +128,7 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod { | |||||||
| 	return pod | 	return pod | ||||||
| } | } | ||||||
|  |  | ||||||
| func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnPrivilegedContainer() { | func dialFromContainer(config *restclient.Config, f *framework.Framework, hostExecPod *api.Pod, containerIP string, containerHttpPort int) map[string]string { | ||||||
| 	outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, privilegedHttpPort) |  | ||||||
| 	Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap)) |  | ||||||
| } |  | ||||||
|  |  | ||||||
| func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnNonPrivilegedContainer() { |  | ||||||
| 	outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, notPrivilegedHttpPort) |  | ||||||
| 	Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap)) |  | ||||||
| } |  | ||||||
|  |  | ||||||
| func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, containerHttpPort int) map[string]string { |  | ||||||
| 	v := url.Values{} | 	v := url.Values{} | ||||||
| 	v.Set("shellCommand", "ip link add dummy1 type dummy") | 	v.Set("shellCommand", "ip link add dummy1 type dummy") | ||||||
| 	cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'", | 	cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'", | ||||||
| @@ -142,8 +137,7 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con | |||||||
| 		v.Encode()) | 		v.Encode()) | ||||||
| 	By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd)) | 	By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd)) | ||||||
|  |  | ||||||
| 	stdout, err := execCommandInContainer(config.config, config.client, config.hostExecPod.Namespace, config.hostExecPod.Name, config.hostExecPod.Spec.Containers[0].Name, | 	stdout, err := execCommandInContainer(config, f, f.Namespace.Name, hostExecPod.Name, hostExecPod.Spec.Containers[0].Name, []string{"/bin/sh", "-c", cmd}) | ||||||
| 		[]string{"/bin/sh", "-c", cmd}) |  | ||||||
| 	Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err)) | 	Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err)) | ||||||
|  |  | ||||||
| 	var output map[string]string | 	var output map[string]string | ||||||
| @@ -153,17 +147,17 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con | |||||||
| } | } | ||||||
|  |  | ||||||
| // newHostExecPodSpec returns the pod spec of hostexec pod | // newHostExecPodSpec returns the pod spec of hostexec pod | ||||||
| func newHostExecPodSpec(ns, name string) *api.Pod { | func newHostExecPodSpec(name string) *api.Pod { | ||||||
| 	return &api.Pod{ | 	return &api.Pod{ | ||||||
| 		TypeMeta: unversioned.TypeMeta{ | 		TypeMeta: unversioned.TypeMeta{ | ||||||
| 			Kind:       "Pod", | 			Kind:       "Pod", | ||||||
| 			APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(), | 			APIVersion: "v1", | ||||||
| 		}, | 		}, | ||||||
| 		ObjectMeta: api.ObjectMeta{ | 		ObjectMeta: api.ObjectMeta{ | ||||||
| 			Name: name, | 			Name: name, | ||||||
| 			Namespace: ns, |  | ||||||
| 		}, | 		}, | ||||||
| 		Spec: api.PodSpec{ | 		Spec: api.PodSpec{ | ||||||
|  | 			NodeName: *nodeName, | ||||||
| 			Containers: []api.Container{ | 			Containers: []api.Container{ | ||||||
| 				{ | 				{ | ||||||
| 					Name:            "hostexec", | 					Name:            "hostexec", | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user
	 Vishnu kannan
					Vishnu kannan