Skip to content

util/client.go: add method to specify pod security admission level #26938

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 2 commits into from
Apr 9, 2022
Merged

util/client.go: add method to specify pod security admission level #26938

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e10df4d
util/client.go: add method to specify pod security admission level
s-urbaniak Mar 29, 2022
2d3a370
go mod tidy, go mod vendor
s-urbaniak Apr 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ require (
k8s.io/kubelet v0.23.0
k8s.io/kubernetes v1.23.0
k8s.io/legacy-cloud-providers v0.23.0
k8s.io/pod-security-admission v0.23.0
k8s.io/utils v0.0.0-20211208161948-7d6a63dca704
sigs.k8s.io/kustomize/kyaml v0.13.0
sigs.k8s.io/yaml v1.2.0
Expand Down
36 changes: 36 additions & 0 deletions test/extended/util/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"fmt"
"io"
"io/ioutil"
"k8s.io/client-go/util/retry"
Copy link
Contributor

@stlaz stlaz Apr 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

order!

Copy link
Contributor Author

@s-urbaniak s-urbaniak Apr 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's see how CI goes, i don't want to risk another e2e failure rush. i'll address in a followup

"net"
"net/http"
"os"
Expand Down Expand Up @@ -62,6 +63,7 @@ import (
watchtools "k8s.io/client-go/tools/watch"
"k8s.io/client-go/util/flowcontrol"
"k8s.io/kubernetes/test/e2e/framework"
admissionapi "k8s.io/pod-security-admission/api"
)

// CLI provides function to call the OpenShift CLI and Kubernetes and OpenShift
Expand Down Expand Up @@ -105,8 +107,17 @@ func NewCLIWithFramework(kubeFramework *framework.Framework) *CLI {
return cli
}

// NewCLIWithPodSecurityLevel initializes the CLI the same way as `NewCLI()`
// but the given pod security level is applied to the created e2e test namespace.
func NewCLIWithPodSecurityLevel(project string, level admissionapi.Level) *CLI {
cli := NewCLI(project)
cli.kubeFramework.NamespacePodSecurityEnforceLevel = level
return cli
}

// NewCLI initializes the CLI and Kube framework helpers with the provided
// namespace. Should be called outside of a Ginkgo .It() function.
// This will apply the `restricted` pod security level to the given underlying namespace.
func NewCLI(project string) *CLI {
cli := NewCLIWithoutNamespace(project)
cli.withoutNamespace = false
Expand Down Expand Up @@ -288,6 +299,31 @@ func (c *CLI) SetupProject() string {
})
o.Expect(err).NotTo(o.HaveOccurred())

err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
// once permissions are settled the underlying namespace must have been created.
ns, err := c.AdminKubeClient().CoreV1().Namespaces().Get(context.Background(), newNamespace, metav1.GetOptions{})
if err != nil {
return err
}

if c.kubeFramework.NamespacePodSecurityEnforceLevel != "" {
// TODO(sur): set to restricted in a separate PR and fix failing tests
c.kubeFramework.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
}
if ns.Labels == nil {
ns.Labels = make(map[string]string)
}
ns.Labels[admissionapi.EnforceLevelLabel] = string(c.kubeFramework.NamespacePodSecurityEnforceLevel)
// In contrast to upstream, OpenShift sets a global default on warn and audit pod security levels.
// Since this would cause unwanted audit log and warning entries, we are setting the same level as for enforcement.
ns.Labels[admissionapi.WarnLevelLabel] = string(c.kubeFramework.NamespacePodSecurityEnforceLevel)
ns.Labels[admissionapi.AuditLevelLabel] = string(c.kubeFramework.NamespacePodSecurityEnforceLevel)

_, err = c.AdminKubeClient().CoreV1().Namespaces().Update(context.Background(), ns, metav1.UpdateOptions{})
return err
})
o.Expect(err).NotTo(o.HaveOccurred())

// Wait for SAs and default dockercfg Secret to be injected
// TODO: it would be nice to have a shared list but it is defined in at least 3 place,
// TODO: some of them not even using the constants
Expand Down
3 changes: 2 additions & 1 deletion vendor/modules.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3103,7 +3103,8 @@ k8s.io/metrics/pkg/client/custom_metrics/scheme
k8s.io/metrics/pkg/client/external_metrics
# k8s.io/mount-utils v0.0.0 => github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20220405131139-37c5e75b4e1e
k8s.io/mount-utils
# k8s.io/pod-security-admission v0.0.0 => github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20220405131139-37c5e75b4e1e
# k8s.io/pod-security-admission v0.23.0 => github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20220405131139-37c5e75b4e1e
## explicit
k8s.io/pod-security-admission/admission
k8s.io/pod-security-admission/admission/api
k8s.io/pod-security-admission/admission/api/load
Expand Down