Exemple #1
0
func TestDefaultErrorFunc(t *testing.T) {
	testPod := &v1.Pod{
		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: "bar"},
		Spec:       apitesting.V1DeepEqualSafePodSpec(),
	}
	handler := utiltesting.FakeHandler{
		StatusCode:   200,
		ResponseBody: runtime.EncodeOrDie(testapi.Default.Codec(), testPod),
		T:            t,
	}
	mux := http.NewServeMux()

	// FakeHandler musn't be sent requests other than the one you want to test.
	mux.Handle(testapi.Default.ResourcePath("pods", "bar", "foo"), &handler)
	server := httptest.NewServer(mux)
	defer server.Close()
	factory := NewConfigFactory(clientset.NewForConfigOrDie(&restclient.Config{Host: server.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &registered.GroupOrDie(v1.GroupName).GroupVersion}}), v1.DefaultSchedulerName, v1.DefaultHardPodAffinitySymmetricWeight, v1.DefaultFailureDomains)
	queue := cache.NewFIFO(cache.MetaNamespaceKeyFunc)
	podBackoff := podBackoff{
		perPodBackoff:   map[types.NamespacedName]*backoffEntry{},
		clock:           &fakeClock{},
		defaultDuration: 1 * time.Millisecond,
		maxDuration:     1 * time.Second,
	}
	errFunc := factory.makeDefaultErrorFunc(&podBackoff, queue)

	errFunc(testPod, nil)
	for {
		// This is a terrible way to do this but I plan on replacing this
		// whole error handling system in the future. The test will time
		// out if something doesn't work.
		time.Sleep(10 * time.Millisecond)
		got, exists, _ := queue.Get(testPod)
		if !exists {
			continue
		}
		handler.ValidateRequest(t, testapi.Default.ResourcePath("pods", "bar", "foo"), "GET", nil)
		if e, a := testPod, got; !reflect.DeepEqual(e, a) {
			t.Errorf("Expected %v, got %v", e, a)
		}
		break
	}
}
func TestModifyHostConfigPodSecurityContext(t *testing.T) {
	supplementalGroupsSC := &v1.PodSecurityContext{}
	supplementalGroupsSC.SupplementalGroups = []int64{2222}
	supplementalGroupHC := fullValidHostConfig()
	supplementalGroupHC.GroupAdd = []string{"2222"}
	fsGroupHC := fullValidHostConfig()
	fsGroupHC.GroupAdd = []string{"1234"}
	extraSupplementalGroupHC := fullValidHostConfig()
	extraSupplementalGroupHC.GroupAdd = []string{"1234"}
	bothHC := fullValidHostConfig()
	bothHC.GroupAdd = []string{"2222", "1234"}
	fsGroup := int64(1234)
	extraSupplementalGroup := []int64{1234}

	testCases := map[string]struct {
		securityContext         *v1.PodSecurityContext
		expected                *dockercontainer.HostConfig
		extraSupplementalGroups []int64
	}{
		"nil": {
			securityContext:         nil,
			expected:                fullValidHostConfig(),
			extraSupplementalGroups: nil,
		},
		"SupplementalGroup": {
			securityContext:         supplementalGroupsSC,
			expected:                supplementalGroupHC,
			extraSupplementalGroups: nil,
		},
		"FSGroup": {
			securityContext:         &v1.PodSecurityContext{FSGroup: &fsGroup},
			expected:                fsGroupHC,
			extraSupplementalGroups: nil,
		},
		"FSGroup + SupplementalGroups": {
			securityContext: &v1.PodSecurityContext{
				SupplementalGroups: []int64{2222},
				FSGroup:            &fsGroup,
			},
			expected:                bothHC,
			extraSupplementalGroups: nil,
		},
		"ExtraSupplementalGroup": {
			securityContext:         nil,
			expected:                extraSupplementalGroupHC,
			extraSupplementalGroups: extraSupplementalGroup,
		},
		"ExtraSupplementalGroup + SupplementalGroups": {
			securityContext:         supplementalGroupsSC,
			expected:                bothHC,
			extraSupplementalGroups: extraSupplementalGroup,
		},
	}

	provider := NewSimpleSecurityContextProvider()
	dummyContainer := &v1.Container{}
	dummyContainer.SecurityContext = fullValidSecurityContext()
	dummyPod := &v1.Pod{
		Spec: apitesting.V1DeepEqualSafePodSpec(),
	}

	for k, v := range testCases {
		dummyPod.Spec.SecurityContext = v.securityContext
		dockerCfg := &dockercontainer.HostConfig{}
		provider.ModifyHostConfig(dummyPod, dummyContainer, dockerCfg, v.extraSupplementalGroups)
		if !reflect.DeepEqual(v.expected, dockerCfg) {
			t.Errorf("unexpected modification of host config for %s.  Expected: %#v Got: %#v", k, v.expected, dockerCfg)
		}
	}
}