privileged.go

Documentation: k8s.io/kubernetes/test/e2e/common/node

     1  /*
     2  Copyright 2016 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package node
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  
    23  	"github.com/onsi/ginkgo/v2"
    24  	"github.com/onsi/gomega"
    25  	v1 "k8s.io/api/core/v1"
    26  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    27  	"k8s.io/kubernetes/test/e2e/framework"
    28  	e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
    29  	imageutils "k8s.io/kubernetes/test/utils/image"
    30  	admissionapi "k8s.io/pod-security-admission/api"
    31  )
    32  
    33  // PrivilegedPodTestConfig is configuration struct for privileged pod test
    34  // TODO: Merge with tests in security_context.go
    35  type PrivilegedPodTestConfig struct {
    36  	f *framework.Framework
    37  
    38  	privilegedPod          string
    39  	privilegedContainer    string
    40  	notPrivilegedContainer string
    41  
    42  	pod *v1.Pod
    43  }
    44  
    45  var _ = SIGDescribe("PrivilegedPod", framework.WithNodeConformance(), func() {
    46  	f := framework.NewDefaultFramework("e2e-privileged-pod")
    47  	f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
    48  	config := &PrivilegedPodTestConfig{
    49  		f:                      f,
    50  		privilegedPod:          "privileged-pod",
    51  		privilegedContainer:    "privileged-container",
    52  		notPrivilegedContainer: "not-privileged-container",
    53  	}
    54  
    55  	ginkgo.It("should enable privileged commands [LinuxOnly]", func(ctx context.Context) {
    56  		// Windows does not support privileged containers.
    57  		ginkgo.By("Creating a pod with a privileged container")
    58  		config.createPods(ctx)
    59  
    60  		ginkgo.By("Executing in the privileged container")
    61  		config.run(config.privilegedContainer, true)
    62  
    63  		ginkgo.By("Executing in the non-privileged container")
    64  		config.run(config.notPrivilegedContainer, false)
    65  	})
    66  })
    67  
    68  func (c *PrivilegedPodTestConfig) run(containerName string, expectSuccess bool) {
    69  	cmd := []string{"ip", "link", "add", "dummy1", "type", "dummy"}
    70  	reverseCmd := []string{"ip", "link", "del", "dummy1"}
    71  
    72  	stdout, stderr, err := e2epod.ExecCommandInContainerWithFullOutput(
    73  		c.f, c.privilegedPod, containerName, cmd...)
    74  	msg := fmt.Sprintf("cmd %v, stdout %q, stderr %q", cmd, stdout, stderr)
    75  
    76  	if expectSuccess {
    77  		framework.ExpectNoError(err, msg)
    78  		// We need to clean up the dummy link that was created, as it
    79  		// leaks out into the node level -- yuck.
    80  		_, _, err := e2epod.ExecCommandInContainerWithFullOutput(
    81  			c.f, c.privilegedPod, containerName, reverseCmd...)
    82  		framework.ExpectNoError(err,
    83  			fmt.Sprintf("could not remove dummy1 link: %v", err))
    84  	} else {
    85  		gomega.Expect(err).To(gomega.HaveOccurred(), msg)
    86  	}
    87  }
    88  
    89  func (c *PrivilegedPodTestConfig) createPodsSpec() *v1.Pod {
    90  	isPrivileged := true
    91  	notPrivileged := false
    92  
    93  	return &v1.Pod{
    94  		ObjectMeta: metav1.ObjectMeta{
    95  			Name:      c.privilegedPod,
    96  			Namespace: c.f.Namespace.Name,
    97  		},
    98  		Spec: v1.PodSpec{
    99  			Containers: []v1.Container{
   100  				{
   101  					Name:            c.privilegedContainer,
   102  					Image:           imageutils.GetE2EImage(imageutils.BusyBox),
   103  					ImagePullPolicy: v1.PullIfNotPresent,
   104  					SecurityContext: &v1.SecurityContext{Privileged: &isPrivileged},
   105  					Command:         []string{"/bin/sleep", "10000"},
   106  				},
   107  				{
   108  					Name:            c.notPrivilegedContainer,
   109  					Image:           imageutils.GetE2EImage(imageutils.BusyBox),
   110  					ImagePullPolicy: v1.PullIfNotPresent,
   111  					SecurityContext: &v1.SecurityContext{Privileged: &notPrivileged},
   112  					Command:         []string{"/bin/sleep", "10000"},
   113  				},
   114  			},
   115  		},
   116  	}
   117  }
   118  
   119  func (c *PrivilegedPodTestConfig) createPods(ctx context.Context) {
   120  	podSpec := c.createPodsSpec()
   121  	c.pod = e2epod.NewPodClient(c.f).CreateSync(ctx, podSpec)
   122  }
   123
View as plain text