Automate OCP-32383

Author: gangwgr

test/extended/apiserver/qe_apiserver.go

@@ -0,0 +1,72 @@
+package apiserver
+
+import (
+	"context"
+
+	g "github.com/onsi/ginkgo/v2"
+	o "github.com/onsi/gomega"
+
+	exutil "github.com/openshift/origin/test/extended/util"
+	e2e "k8s.io/kubernetes/test/e2e/framework"
+	admissionapi "k8s.io/pod-security-admission/api"
+)
+
+var _ = g.Describe("[sig-api-machinery][E2E-QE-APIServer", func() {
+	defer g.GinkgoRecover()
+	ctx := context.Background()
+	oc := exutil.NewCLIWithPodSecurityLevel("e2e-qe-apiserver", admissionapi.LevelPrivileged)
+
+	// author: [email protected]
+	g.It("Init container setup should have the proper securityContext-[OCP-32383]-bug 1793694", func() {
+		// Skip on Microshift clusters
+		isMicroShift, err := exutil.IsMicroShiftCluster(oc.AdminKubeClient())
+		o.Expect(err).NotTo(o.HaveOccurred())
+		if isMicroShift {
+			g.Skip("MicroShift has different security context requirements and architecture")
+		}
+
+		isHyperShift, err := exutil.IsHypershift(ctx, oc.AdminConfigClient())
+		o.Expect(err).NotTo(o.HaveOccurred())
+		if isHyperShift {
+			g.Skip("HyperShift does not support this test")
+		}
+		checkItems := []struct {
+			namespace string
+			container string
+		}{
+			{
+				namespace: "openshift-kube-apiserver",
+				container: "kube-apiserver",
+			},
+			{
+				namespace: "openshift-apiserver",
+				container: "openshift-apiserver",
+			},
+		}
+
+		for _, checkItem := range checkItems {
+			g.By("Get one pod name of " + checkItem.namespace)
+			e2e.Logf("namespace is :%s", checkItem.namespace)
+			podName, err := oc.AsAdmin().Run("get").Args("-n", checkItem.namespace, "pods", "-l apiserver", "-o=jsonpath={.items[0].metadata.name}").Output()
+			if err != nil {
+				e2e.Failf("Failed to get kube-apiserver pod name and returned error: %v", err)
+			}
+			o.Expect(err).NotTo(o.HaveOccurred())
+			e2e.Logf("Get the kube-apiserver pod name: %s", podName)
+
+			g.By("Get privileged value of container " + checkItem.container + " of pod " + podName)
+			jsonpath := "-o=jsonpath={range .spec.containers[?(@.name==\"" + checkItem.container + "\")]}{.securityContext.privileged}"
+			msg, err := oc.AsAdmin().WithoutNamespace().Run("get").Args("pod", podName, jsonpath, "-n", checkItem.namespace).Output()
+			o.Expect(err).NotTo(o.HaveOccurred())
+			o.Expect(msg).To(o.ContainSubstring("true"))
+			e2e.Logf("#### privileged value: %s ####", msg)
+
+			g.By("Get privileged value of initcontainer of pod " + podName)
+			jsonpath = "-o=jsonpath={.spec.initContainers[].securityContext.privileged}"
+			msg, err = oc.AsAdmin().WithoutNamespace().Run("get").Args("pod", podName, jsonpath, "-n", checkItem.namespace).Output()
+			o.Expect(err).NotTo(o.HaveOccurred())
+			o.Expect(msg).To(o.ContainSubstring("true"))
+			e2e.Logf("#### privileged value: %s ####", msg)
+		}
+	})
+})