scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-01 18:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use seccomp from security context

Browse Source
This commit is contained in:
Pengfei Ni
2017-07-19 16:30:27 +08:00
parent f3150c9c8c
commit bf01fa2f00
6 changed files with 57 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
pkg/kubelet/dockershim/helpers_linux_test.go
View File

@@ -20,51 +20,32 @@ package dockershim
import (
"fmt"
"path"
"testing"
"github.com/stretchr/testify/assert"
"k8s.io/api/core/v1"
runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
)
func TestGetSeccompSecurityOpts(t *testing.T) {
containerName := "bar"
makeConfig := func(annotations map[string]string) *runtimeapi.PodSandboxConfig {
return makeSandboxConfigWithLabelsAndAnnotations("pod", "ns", "1234", 1, nil, annotations)
}
tests := []struct {
msg string
config *runtimeapi.PodSandboxConfig
expectedOpts []string
msg string
seccompProfile string
expectedOpts []string
}{{
msg: "No security annotations",
config: makeConfig(nil),
expectedOpts: []string{"seccomp=unconfined"},
msg: "No security annotations",
seccompProfile: "",
expectedOpts: []string{"seccomp=unconfined"},
}, {
msg: "Seccomp unconfined",
config: makeConfig(map[string]string{
v1.SeccompContainerAnnotationKeyPrefix + containerName: "unconfined",
}),
expectedOpts: []string{"seccomp=unconfined"},
msg: "Seccomp unconfined",
seccompProfile: "unconfined",
expectedOpts: []string{"seccomp=unconfined"},
}, {
msg: "Seccomp default",
config: makeConfig(map[string]string{
v1.SeccompContainerAnnotationKeyPrefix + containerName: "docker/default",
}),
expectedOpts: nil,
}, {
msg: "Seccomp pod default",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "docker/default",
}),
expectedOpts: nil,
msg: "Seccomp default",
seccompProfile: "docker/default",
expectedOpts: nil,
}}
for i, test := range tests {
opts, err := getSeccompSecurityOpts(containerName, test.config, "test/seccomp/profile/root", '=')
opts, err := getSeccompSecurityOpts(test.seccompProfile, '=')
assert.NoError(t, err, "TestCase[%d]: %s", i, test.msg)
assert.Len(t, opts, len(test.expectedOpts), "TestCase[%d]: %s", i, test.msg)
for _, opt := range test.expectedOpts {
@@ -74,42 +55,30 @@ func TestGetSeccompSecurityOpts(t *testing.T) {
}
func TestLoadSeccompLocalhostProfiles(t *testing.T) {
containerName := "bar"
makeConfig := func(annotations map[string]string) *runtimeapi.PodSandboxConfig {
return makeSandboxConfigWithLabelsAndAnnotations("pod", "ns", "1234", 1, nil, annotations)
}
tests := []struct {
msg string
config *runtimeapi.PodSandboxConfig
expectedOpts []string
expectErr bool
msg string
seccompProfile string
expectedOpts []string
expectErr bool
}{{
msg: "Seccomp localhost/test profile",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "localhost/test",
}),
expectedOpts: []string{`seccomp={"foo":"bar"}`},
expectErr: false,
msg: "Seccomp localhost/test profile",
seccompProfile: "localhost/fixtures/seccomp/test",
expectedOpts: []string{`seccomp={"foo":"bar"}`},
expectErr: false,
}, {
msg: "Seccomp localhost/sub/subtest profile",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "localhost/sub/subtest",
}),
expectedOpts: []string{`seccomp={"abc":"def"}`},
expectErr: false,
msg: "Seccomp localhost/sub/subtest profile",
seccompProfile: "localhost/fixtures/seccomp/sub/subtest",
expectedOpts: []string{`seccomp={"abc":"def"}`},
expectErr: false,
}, {
msg: "Seccomp non-existent",
config: makeConfig(map[string]string{
v1.SeccompPodAnnotationKey: "localhost/non-existent",
}),
expectedOpts: nil,
expectErr: true,
msg: "Seccomp non-existent",
seccompProfile: "localhost/fixtures/seccomp/non-existent",
expectedOpts: nil,
expectErr: true,
}}
profileRoot := path.Join("fixtures", "seccomp")
for i, test := range tests {
opts, err := getSeccompSecurityOpts(containerName, test.config, profileRoot, '=')
opts, err := getSeccompSecurityOpts(test.seccompProfile, '=')
if test.expectErr {
assert.Error(t, err, fmt.Sprintf("TestCase[%d]: %s", i, test.msg))
continue