Skip to content

Commit 3e75f38

Browse files
jsafranejsafrane
committed
Add missing cases to SELinuxMount tests
1 parent d133742 commit 3e75f38

File tree

2 files changed

+83
-9
lines changed

2 files changed

+83
-9
lines changed

‎test/e2e/storage/csimock/base.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -471,7 +471,7 @@ func (m *mockDriverSetup) createPodWithFSGroup(ctx context.Context, fsGroup *int
471471
return class, claim, pod
472472
}
473473

474-
func (m *mockDriverSetup) createPodWithSELinux(ctx context.Context, accessModes []v1.PersistentVolumeAccessMode, mountOptions []string, seLinuxOpts *v1.SELinuxOptions, policy *v1.PodSELinuxChangePolicy) (*storagev1.StorageClass, *v1.PersistentVolumeClaim, *v1.Pod) {
474+
func (m *mockDriverSetup) createPodWithSELinux(ctx context.Context, accessModes []v1.PersistentVolumeAccessMode, mountOptions []string, seLinuxOpts *v1.SELinuxOptions, policy *v1.PodSELinuxChangePolicy, privileged bool) (*storagev1.StorageClass, *v1.PersistentVolumeClaim, *v1.Pod) {
475475
ginkgo.By("Creating pod with SELinux context")
476476
f := m.f
477477
nodeSelection := m.config.ClientNodeSelection
@@ -488,7 +488,7 @@ func (m *mockDriverSetup) createPodWithSELinux(ctx context.Context, accessModes
488488
ReclaimPolicy: m.tp.reclaimPolicy,
489489
}
490490
class, claim := createClaim(ctx, f.ClientSet, scTest, nodeSelection, m.tp.scName, f.Namespace.Name, accessModes)
491-
pod, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, seLinuxOpts, policy)
491+
pod, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, seLinuxOpts, policy, privileged)
492492
framework.ExpectNoError(err, "Failed to create pause pod with SELinux context %s: %v", seLinuxOpts, err)
493493

494494
if class != nil {
@@ -826,7 +826,7 @@ func startBusyBoxPodWithVolumeSource(cs clientset.Interface, volumeSource v1.Vol
826826
return cs.CoreV1().Pods(ns).Create(context.TODO(), pod, metav1.CreateOptions{})
827827
}
828828

829-
func startPausePodWithSELinuxOptions(cs clientset.Interface, pvc *v1.PersistentVolumeClaim, node e2epod.NodeSelection, ns string, seLinuxOpts *v1.SELinuxOptions, policy *v1.PodSELinuxChangePolicy) (*v1.Pod, error) {
829+
func startPausePodWithSELinuxOptions(cs clientset.Interface, pvc *v1.PersistentVolumeClaim, node e2epod.NodeSelection, ns string, seLinuxOpts *v1.SELinuxOptions, policy *v1.PodSELinuxChangePolicy, privileged bool) (*v1.Pod, error) {
830830
pod := &v1.Pod{
831831
ObjectMeta: metav1.ObjectMeta{
832832
GenerateName: "pvc-volume-tester-",
@@ -840,6 +840,9 @@ func startPausePodWithSELinuxOptions(cs clientset.Interface, pvc *v1.PersistentV
840840
{
841841
Name: "volume-tester",
842842
Image: imageutils.GetE2EImage(imageutils.Pause),
843+
SecurityContext: &v1.SecurityContext{
844+
Privileged: &privileged,
845+
},
843846
VolumeMounts: []v1.VolumeMount{
844847
{
845848
Name: "my-volume",

‎test/e2e/storage/csimock/csi_selinux_mount.go‎

Lines changed: 77 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount", func() {
298298
// Act
299299
ginkgo.By("Starting the initial pod")
300300
accessModes := []v1.PersistentVolumeAccessMode{t.volumeMode}
301-
_, claim, pod := m.createPodWithSELinux(ctx, accessModes, t.mountOptions, t.firstPodSELinuxOpts, t.firstPodChangePolicy)
301+
_, claim, pod := m.createPodWithSELinux(ctx, accessModes, t.mountOptions, t.firstPodSELinuxOpts, t.firstPodChangePolicy, false /* privileged */)
302302
err := e2epod.WaitForPodNameRunningInNamespace(ctx, m.cs, pod.Name, pod.Namespace)
303303
framework.ExpectNoError(err, "starting the initial pod")
304304

@@ -331,7 +331,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount", func() {
331331
pod, err = m.cs.CoreV1().Pods(pod.Namespace).Get(ctx, pod.Name, metav1.GetOptions{})
332332
framework.ExpectNoError(err, "getting the initial pod")
333333
nodeSelection := e2epod.NodeSelection{Name: pod.Spec.NodeName}
334-
pod2, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, t.secondPodSELinuxOpts, t.secondPodChangePolicy)
334+
pod2, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, t.secondPodSELinuxOpts, t.secondPodChangePolicy, false /* privileged */)
335335
framework.ExpectNoError(err, "creating second pod with SELinux context %s", t.secondPodSELinuxOpts)
336336
m.pods = append(m.pods, pod2)
337337

@@ -453,8 +453,10 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
453453
csiDriverSELinuxEnabled bool
454454
firstPodSELinuxOpts *v1.SELinuxOptions
455455
firstPodChangePolicy *v1.PodSELinuxChangePolicy
456+
firstPodPrivileged bool
456457
secondPodSELinuxOpts *v1.SELinuxOptions
457458
secondPodChangePolicy *v1.PodSELinuxChangePolicy
459+
secondPodPrivileged bool
458460
volumeMode v1.PersistentVolumeAccessMode
459461
waitForSecondPodStart bool
460462
secondPodFailureEvent string
@@ -599,7 +601,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
599601
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
600602
},
601603
{
602-
name: "error is not bumped on two Pods with a different policy RWX volume (nil + MountOption)",
604+
name: "error is not bumped on two Pods with the same policy RWX volume (nil + MountOption)",
603605
csiDriverSELinuxEnabled: true,
604606
firstPodSELinuxOpts: &seLinuxOpts1,
605607
firstPodChangePolicy: &mount,
@@ -611,7 +613,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
611613
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
612614
},
613615
{
614-
name: "error is not bumped on two Pods with a different policy RWX volume (MountOption + MountOption)",
616+
name: "error is not bumped on two Pods with the same policy RWX volume (MountOption + MountOption)",
615617
csiDriverSELinuxEnabled: true,
616618
firstPodSELinuxOpts: &seLinuxOpts1,
617619
firstPodChangePolicy: &mount,
@@ -648,6 +650,75 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
648650
expectControllerConflictProperty: "SELinuxLabel",
649651
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
650652
},
653+
{
654+
name: "error is not bumped on two privileged Pods with mount policy RWO volume",
655+
csiDriverSELinuxEnabled: true,
656+
firstPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
657+
firstPodPrivileged: true,
658+
firstPodChangePolicy: &recursive,
659+
secondPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
660+
secondPodPrivileged: true,
661+
secondPodChangePolicy: &recursive,
662+
volumeMode: v1.ReadWriteOnce,
663+
waitForSecondPodStart: true,
664+
expectNodeIncreases: sets.New[string]( /* no metric is increased, admitted_total was already increased when the first pod started */ ),
665+
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
666+
},
667+
{
668+
name: "error is not bumped on two privileged Pods with recursive policy RWO volume",
669+
csiDriverSELinuxEnabled: true,
670+
firstPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
671+
firstPodPrivileged: true,
672+
firstPodChangePolicy: &mount,
673+
secondPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
674+
secondPodPrivileged: true,
675+
secondPodChangePolicy: &mount,
676+
volumeMode: v1.ReadWriteOnce,
677+
waitForSecondPodStart: true,
678+
expectNodeIncreases: sets.New[string]( /* no metric is increased, admitted_total was already increased when the first pod started */ ),
679+
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
680+
},
681+
{
682+
name: "error is not bumped on a privileged and unprivileged Pod with given SELinux context and recursive policy",
683+
csiDriverSELinuxEnabled: true,
684+
firstPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
685+
firstPodPrivileged: true,
686+
secondPodSELinuxOpts: &seLinuxOpts1,
687+
secondPodChangePolicy: &recursive,
688+
secondPodPrivileged: false,
689+
volumeMode: v1.ReadWriteMany,
690+
waitForSecondPodStart: true,
691+
expectNodeIncreases: sets.New[string]( /* no metric is increased, admitted_total was already increased when the first pod started */ ),
692+
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
693+
},
694+
{
695+
name: "error is bumped on a privileged and unprivileged Pod with given SELinux with MountOption policy",
696+
csiDriverSELinuxEnabled: true,
697+
firstPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
698+
firstPodPrivileged: true,
699+
secondPodSELinuxOpts: &seLinuxOpts1,
700+
secondPodChangePolicy: &mount,
701+
secondPodFailureEvent: "conflicting SELinux labels of volume",
702+
volumeMode: v1.ReadWriteOncePod,
703+
waitForSecondPodStart: false,
704+
expectNodeIncreases: sets.New[string]("volume_manager_selinux_volume_context_mismatch_errors_total"),
705+
expectControllerConflictProperty: "SELinuxLabel",
706+
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
707+
},
708+
{
709+
name: "error is bumped on an unprivileged and privileged Pod with given SELinux with MountOption policy",
710+
csiDriverSELinuxEnabled: true,
711+
firstPodSELinuxOpts: &seLinuxOpts1,
712+
firstPodChangePolicy: &mount,
713+
secondPodSELinuxOpts: nil, /* privileged Pods are typically without SELinux context */
714+
secondPodPrivileged: true,
715+
secondPodFailureEvent: "conflicting SELinux labels of volume",
716+
volumeMode: v1.ReadWriteOncePod,
717+
waitForSecondPodStart: false,
718+
expectNodeIncreases: sets.New[string]("volume_manager_selinux_volume_context_mismatch_errors_total"),
719+
expectControllerConflictProperty: "SELinuxLabel",
720+
testTags: []interface{}{framework.WithFeatureGate(features.SELinuxMount)},
721+
},
651722
}
652723
for _, t := range tests {
653724
t := t
@@ -673,7 +744,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
673744

674745
ginkgo.By("Starting the first pod")
675746
accessModes := []v1.PersistentVolumeAccessMode{t.volumeMode}
676-
_, claim, pod := m.createPodWithSELinux(ctx, accessModes, []string{}, t.firstPodSELinuxOpts, t.firstPodChangePolicy)
747+
_, claim, pod := m.createPodWithSELinux(ctx, accessModes, []string{}, t.firstPodSELinuxOpts, t.firstPodChangePolicy, t.firstPodPrivileged)
677748
err = e2epod.WaitForPodNameRunningInNamespace(ctx, m.cs, pod.Name, pod.Namespace)
678749
framework.ExpectNoError(err, "starting the initial pod")
679750

@@ -688,7 +759,7 @@ var _ = utils.SIGDescribe("CSI Mock selinux on mount metrics and SELinuxWarningC
688759
ginkgo.By("Starting the second pod")
689760
// Skip scheduler, it would block scheduling the second pod with ReadWriteOncePod PV.
690761
nodeSelection := e2epod.NodeSelection{Name: pod.Spec.NodeName}
691-
pod2, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, t.secondPodSELinuxOpts, t.secondPodChangePolicy)
762+
pod2, err := startPausePodWithSELinuxOptions(f.ClientSet, claim, nodeSelection, f.Namespace.Name, t.secondPodSELinuxOpts, t.secondPodChangePolicy, t.secondPodPrivileged)
692763
framework.ExpectNoError(err, "creating second pod with SELinux context %s", t.secondPodSELinuxOpts)
693764
m.pods = append(m.pods, pod2)
694765

0 commit comments

Comments
 (0)