Automate OCP-32383

Author: gangwgr

test/extended/apiserver/security_context.go

@@ -0,0 +1,112 @@
+package apiserver
+
+import (
+	"context"
+
+	g "github.com/onsi/ginkgo/v2"
+	o "github.com/onsi/gomega"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	e2e "k8s.io/kubernetes/test/e2e/framework"
+	admissionapi "k8s.io/pod-security-admission/api"
+
+	exutil "github.com/openshift/origin/test/extended/util"
+)
+
+var _ = g.Describe("[sig-auth][Feature:ControlPlaneSecurity]", func() {
+	defer g.GinkgoRecover()
+	ctx := context.Background()
+	oc := exutil.NewCLIWithPodSecurityLevel("control-plane-security", admissionapi.LevelPrivileged)
+
+	// Verifies that control plane containers have proper securityContext.privileged settings
+	// This ensures the control plane components can perform necessary privileged operations
+	// Related issues:
+	// OCP-32383: Control plane security context verification
+	//bug 1793694: Init container security context
+	g.It("should have privileged securityContext for control plane init and main containers", func() {
+		// Skip on MicroShift clusters
+		isMicroShift, err := exutil.IsMicroShiftCluster(oc.AdminKubeClient())
+		o.Expect(err).NotTo(o.HaveOccurred())
+		if isMicroShift {
+			g.Skip("MicroShift has different security context requirements and architecture")
+		}
+
+		// Skip on Hypershift clusters (control plane pods run in management cluster)
+		isHyperShift, err := exutil.IsHypershift(ctx, oc.AdminConfigClient())
+		o.Expect(err).NotTo(o.HaveOccurred())
+		if isHyperShift {
+			g.Skip("Hypershift control plane pods are not accessible from hosted cluster")
+		}
+
+		checkItems := []struct {
+			namespace     string
+			containerName string
+		}{
+			{
+				namespace:     "openshift-kube-apiserver",
+				containerName: "kube-apiserver",
+			},
+			{
+				namespace:     "openshift-apiserver",
+				containerName: "openshift-apiserver",
+			},
+		}
+
+		for _, checkItem := range checkItems {
+			g.By("Getting pods in " + checkItem.namespace)
+			e2e.Logf("Checking namespace: %s", checkItem.namespace)
+
+			// Use client-go to list pods with label selector
+			podList, err := oc.AdminKubeClient().CoreV1().Pods(checkItem.namespace).List(ctx, metav1.ListOptions{
+				LabelSelector: "apiserver",
+			})
+			o.Expect(err).NotTo(o.HaveOccurred())
+			o.Expect(podList.Items).NotTo(o.BeEmpty(), "Expected to find at least one pod in %s", checkItem.namespace)
+
+			pod := podList.Items[0]
+			e2e.Logf("Found pod: %s in namespace %s", pod.Name, checkItem.namespace)
+
+			g.By("Verifying container securityContext.privileged for " + checkItem.containerName)
+
+			// Find the specified container
+			var targetContainer *corev1.Container
+			for i := range pod.Spec.Containers {
+				if pod.Spec.Containers[i].Name == checkItem.containerName {
+					targetContainer = &pod.Spec.Containers[i]
+					break
+				}
+			}
+			o.Expect(targetContainer).NotTo(o.BeNil(), "Container %s not found in pod %s", checkItem.containerName, pod.Name)
+
+			// Verify the container has securityContext
+			o.Expect(targetContainer.SecurityContext).NotTo(o.BeNil(),
+				"Container %s in pod %s does not have securityContext", checkItem.containerName, pod.Name)
+
+			// Verify privileged is set to true
+			o.Expect(targetContainer.SecurityContext.Privileged).NotTo(o.BeNil(),
+				"Container %s in pod %s does not have securityContext.privileged set", checkItem.containerName, pod.Name)
+			o.Expect(*targetContainer.SecurityContext.Privileged).To(o.BeTrue(),
+				"Container %s in pod %s should have securityContext.privileged=true", checkItem.containerName, pod.Name)
+
+			e2e.Logf("Container %s has securityContext.privileged=true", checkItem.containerName)
+
+			g.By("Verifying init container securityContext.privileged")
+
+			// Verify all init containers have privileged=true
+			o.Expect(pod.Spec.InitContainers).NotTo(o.BeEmpty(),
+				"Expected to find at least one init container in pod %s", pod.Name)
+
+			for _, initContainer := range pod.Spec.InitContainers {
+				o.Expect(initContainer.SecurityContext).NotTo(o.BeNil(),
+					"Init container %s in pod %s does not have securityContext", initContainer.Name, pod.Name)
+				o.Expect(initContainer.SecurityContext.Privileged).NotTo(o.BeNil(),
+					"Init container %s in pod %s does not have securityContext.privileged set", initContainer.Name, pod.Name)
+				o.Expect(*initContainer.SecurityContext.Privileged).To(o.BeTrue(),
+					"Init container %s in pod %s should have securityContext.privileged=true", initContainer.Name, pod.Name)
+
+				e2e.Logf("Init container %s has securityContext.privileged=true", initContainer.Name)
+			}
+		}
+	})
+})