660 lines
17 KiB
YAML
660 lines
17 KiB
YAML
suite: pod securityContext test
|
|
templates:
|
|
- common.yaml
|
|
release:
|
|
name: test-release-name
|
|
namespace: test-release-namespace
|
|
tests:
|
|
- it: should pass with securityContext from "global"
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 1001
|
|
sysctls:
|
|
- name: some_name
|
|
value: "some_value"
|
|
- name: some_other_name
|
|
value: "some_other_value"
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- documentIndex: &statefulSetDoc 0
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 1001
|
|
- 568
|
|
sysctls:
|
|
- name: some_name
|
|
value: "some_value"
|
|
- name: some_other_name
|
|
value: "some_other_value"
|
|
|
|
- it: should pass with securityContext from "global" and partial override with "pod"
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 1001
|
|
sysctls:
|
|
- name: some_name
|
|
value: "some_value"
|
|
- name: some_other_name
|
|
value: "some_other_value"
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec:
|
|
securityContext:
|
|
fsGroup: 1001
|
|
asserts:
|
|
- documentIndex: *statefulSetDoc
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 1001
|
|
- 568
|
|
sysctls:
|
|
- name: some_name
|
|
value: "some_value"
|
|
- name: some_other_name
|
|
value: "some_other_value"
|
|
|
|
- it: should pass with securityContext from "global" and full override with "pod"
|
|
set:
|
|
some_sysctl_name: some_name
|
|
some_sysctl_value: 2
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 1001
|
|
sysctls:
|
|
- name: some_name
|
|
value: "some_value"
|
|
- name: some_other_name
|
|
value: "some_other_value"
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec:
|
|
securityContext:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 1003
|
|
sysctls:
|
|
- name: "{{ .Values.some_sysctl_name }}"
|
|
value: "{{ .Values.some_sysctl_value }}"
|
|
- name: some_other_name
|
|
value: "some_different_value"
|
|
asserts:
|
|
- documentIndex: *statefulSetDoc
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 1003
|
|
- 568
|
|
sysctls:
|
|
- name: some_name
|
|
value: "2"
|
|
- name: some_other_name
|
|
value: "some_different_value"
|
|
|
|
- it: should pass with fsGroup and supplementalGroups with long int
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
securityContext:
|
|
fsGroup: 100000514
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 100000514
|
|
asserts:
|
|
- documentIndex: *statefulSetDoc
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 100000514
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 100000514
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with sysctls automatically appended based on services
|
|
set:
|
|
some_sysctl_name: some_name
|
|
some_sysctl_value: 2
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec:
|
|
securityContext:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 1003
|
|
sysctls:
|
|
- name: "{{ .Values.some_sysctl_name }}"
|
|
value: "{{ .Values.some_sysctl_value }}"
|
|
- name: some_other_name
|
|
value: "some_different_value"
|
|
workload-name2:
|
|
enabled: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
service:
|
|
service-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: ClusterIP
|
|
ports:
|
|
port-name:
|
|
enabled: true
|
|
primary: true
|
|
port: 80
|
|
service-name2:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
port-name:
|
|
enabled: true
|
|
primary: true
|
|
port: 53
|
|
service-name3:
|
|
enabled: true
|
|
type: ClusterIP
|
|
targetSelector: workload-name2
|
|
ports:
|
|
port-name:
|
|
enabled: true
|
|
primary: true
|
|
port: 443
|
|
asserts:
|
|
- documentIndex: *statefulSetDoc
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups:
|
|
- 1002
|
|
- 1003
|
|
- 568
|
|
sysctls:
|
|
- name: some_name
|
|
value: "2"
|
|
- name: some_other_name
|
|
value: "some_different_value"
|
|
- name: net.ipv4.ip_unprivileged_port_start
|
|
value: "53"
|
|
- documentIndex: &otherStatefulSetDoc 1
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *otherStatefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls:
|
|
- name: net.ipv4.ip_unprivileged_port_start
|
|
value: "443"
|
|
|
|
- it: should pass with sysctls net.ipv4.ip_unprivileged_port_start NOT appended with hostnet
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
hostNetwork: true
|
|
workload-name2:
|
|
enabled: true
|
|
type: Deployment
|
|
podSpec: {}
|
|
service:
|
|
service-name:
|
|
enabled: true
|
|
primary: true
|
|
type: ClusterIP
|
|
targetSelector: workload-name2
|
|
ports:
|
|
port-name:
|
|
enabled: true
|
|
primary: true
|
|
port: 443
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with fsGroup 0
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 0
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- documentIndex: &statefulSetDoc 0
|
|
isKind:
|
|
of: StatefulSet
|
|
- documentIndex: *statefulSetDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 0
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with no sysctls port_start automatically appended based on services when port is higher than 1024
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec: {}
|
|
service:
|
|
service-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: ClusterIP
|
|
ports:
|
|
port-name:
|
|
enabled: true
|
|
primary: true
|
|
port: 25000
|
|
targetPort: 3000
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with with gpu assigned to single container
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
securityContext:
|
|
supplementalGroups:
|
|
- 1000
|
|
containers:
|
|
container1:
|
|
enabled: true
|
|
primary: true
|
|
probes:
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
nvidia.com/gpu: 1
|
|
workload-name2:
|
|
enabled: true
|
|
primary: false
|
|
type: Deployment
|
|
podSpec: {}
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 44
|
|
- 107
|
|
- 568
|
|
sysctls: []
|
|
- documentIndex: &otherDeploymentDoc 1
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *otherDeploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with with gpu assigned to multiple pods
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
securityContext:
|
|
supplementalGroups:
|
|
- 1000
|
|
containers:
|
|
container1:
|
|
enabled: true
|
|
primary: true
|
|
probes:
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
nvidia.com/gpu: 1
|
|
workload-name2:
|
|
enabled: true
|
|
primary: false
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
container1:
|
|
enabled: true
|
|
primary: true
|
|
probes:
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
nvidia.com/gpu: 1
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 1000
|
|
- 44
|
|
- 107
|
|
- 568
|
|
sysctls: []
|
|
- documentIndex: &otherDeploymentDoc 1
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *otherDeploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 44
|
|
- 107
|
|
- 568
|
|
sysctls: []
|
|
|
|
- it: should pass with with device assigned to selected pod
|
|
set:
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec: {}
|
|
workload-name2:
|
|
enabled: true
|
|
primary: false
|
|
type: Deployment
|
|
podSpec: {}
|
|
persistence:
|
|
dev01:
|
|
enabled: true
|
|
type: device
|
|
hostPath: /dev/sda
|
|
mountPath: /test
|
|
targetSelector:
|
|
workload-name2:
|
|
asserts:
|
|
- documentIndex: &deploymentDoc 0
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *deploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 568
|
|
sysctls: []
|
|
- documentIndex: &otherDeploymentDoc 1
|
|
isKind:
|
|
of: Deployment
|
|
- documentIndex: *otherDeploymentDoc
|
|
equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
supplementalGroups:
|
|
- 5
|
|
- 10
|
|
- 20
|
|
- 24
|
|
- 568
|
|
sysctls: []
|
|
|
|
# Failures
|
|
- it: should fail with empty securityContext from "global"
|
|
set:
|
|
securityContext:
|
|
pod: null
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected non-empty [securityContext.pod]
|
|
|
|
- it: should fail with empty fsGroup
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: ""
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected non-empty [fsGroup]
|
|
|
|
- it: should fail with empty fsGroupChangePolicy
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: ""
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected non-empty [fsGroupChangePolicy]
|
|
|
|
- it: should fail with invalid fsGroupChangePolicy
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: invalid
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected [fsGroupChangePolicy] to be one of [Always, OnRootMismatch], but got [invalid]
|
|
|
|
- it: should fail with empty name in sysctls
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
sysctls:
|
|
- name: ""
|
|
value: "some_value"
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected non-empty [name] in [sysctls]
|
|
|
|
- it: should fail with empty value in sysctls
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 568
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
sysctls:
|
|
- name: some_name
|
|
value: ""
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: StatefulSet
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected non-empty [value] in [sysctls]
|
|
|
|
- it: should fail with non unique supplementalGroups
|
|
set:
|
|
securityContext:
|
|
pod:
|
|
supplementalGroups:
|
|
- 1000
|
|
- 44
|
|
- 107
|
|
- 44
|
|
workload:
|
|
workload-name1:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec: {}
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: Pod - Expected [supplementalGroups] to have only unique values, but got [1000, 44, 107, 44, 568]
|