Skip to content
This repository has been archived by the owner on Oct 24, 2023. It is now read-only.

Commit

Permalink
fix: don't wait for pod-security-policy spec if disabled (#3673)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jackfrancis
jackfrancis committed Aug 14, 2020
1 parent 7b13847 commit de3b547
Show file tree
Hide file tree
Showing 5 changed files with 106 additions and 42 deletions.
2 changes: 1 addition & 1 deletion parts/k8s/cloud-init/artifacts/cse_config.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -566,7 +566,7 @@ configAddons() {
{{if IsAzurePolicyAddonEnabled}}
configAzurePolicyAddon
{{end}}
{{- if not HasCustomPodSecurityPolicy}}
{{- if and (not HasCustomPodSecurityPolicy) IsPodSecurityPolicyAddonEnabled}}
wait_for_file 1200 1 $POD_SECURITY_POLICY_SPEC || exit {{GetCSEErrorCode "ERR_FILE_WATCH_TIMEOUT"}}
mkdir -p $ADDONS_DIR/init && cp $POD_SECURITY_POLICY_SPEC $ADDONS_DIR/init/ || exit {{GetCSEErrorCode "ERR_ADDONS_START_FAIL"}}
{{- end}}
Expand Down
15 changes: 14 additions & 1 deletion pkg/engine/armvariables_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,10 @@ func TestK8sVars(t *testing.T) {
Name: common.AADPodIdentityAddonName,
Enabled: to.BoolPtr(true),
},
{
Name: common.PodSecurityPolicyAddonName,
Enabled: to.BoolPtr(true),
},
}
varMap, err = GetKubernetesVariables(cs)
if err != nil {
Expand Down Expand Up @@ -254,7 +258,12 @@ func TestK8sVars(t *testing.T) {
}

// Test with ubuntu 16.04 distro
cs.Properties.OrchestratorProfile.KubernetesConfig.Addons = []api.KubernetesAddon{}
cs.Properties.OrchestratorProfile.KubernetesConfig.Addons = []api.KubernetesAddon{
{
Name: common.PodSecurityPolicyAddonName,
Enabled: to.BoolPtr(true),
},
}
cs.Properties.AgentPoolProfiles[0].Distro = api.Ubuntu
cs.Properties.OrchestratorProfile.KubernetesConfig.UseManagedIdentity = false
varMap, err = GetKubernetesVariables(cs)
Expand Down Expand Up @@ -815,6 +824,10 @@ func TestK8sVars(t *testing.T) {
"appgw-sku": "WAF_v2",
},
},
{
Name: common.PodSecurityPolicyAddonName,
Enabled: to.BoolPtr(true),
},
}

varMap, err = GetKubernetesVariables(cs)
Expand Down
3 changes: 3 additions & 0 deletions pkg/engine/template_generator.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -766,6 +766,9 @@ func getContainerServiceFuncMap(cs *api.ContainerService) template.FuncMap {
"IsDashboardAddonEnabled": func() bool {
return cs.Properties.OrchestratorProfile.KubernetesConfig.IsAddonEnabled(common.DashboardAddonName)
},
"IsPodSecurityPolicyAddonEnabled": func() bool {
return cs.Properties.OrchestratorProfile.KubernetesConfig.IsAddonEnabled(common.PodSecurityPolicyAddonName)
},
"GetAADPodIdentityTaintKey": func() string {
return common.AADPodIdentityTaintKey
},
Expand Down
126 changes: 87 additions & 39 deletions pkg/engine/template_generator_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,31 +170,32 @@ func TestGetContainerServiceFuncMap(t *testing.T) {
errorCodeStrings = append(errorCodeStrings, "ERR_HOLD_MY_BEER")
errorCodes = append(errorCodes, -1)
cases := []struct {
name string
cs *api.ContainerService
expectedHasCustomSearchDomain bool
expectedGetSearchDomainName string
expectedGetSearchDomainRealmUser string
expectedGetSearchDomainRealmPassword string
expectedHasCustomNodesDNS bool
expectedGetHyperkubeImageReference string
expectedGetTargetEnvironment string
expectedIsNSeriesSKU bool
expectedIsDockerContainerRuntime bool
expectedHasPrivateAzureRegistryServer bool
expectedGetPrivateAzureRegistryServer string
expectedGetSysctlDConfigKeyVals string
expectedGetCSEErrorCodeVals []int
expectedHasVHDDistroNodes bool
expectedIsVHDDistroForAllNodes bool
expectedHasClusterInitComponent bool
expectedIsVirtualMachineScaleSets bool
expectedUseManagedIdentity bool
expectedHasKubeReservedCgroup bool
expectedGetKubeReservedCgroup string
expectedHasCustomPodSecurityPolicy bool
expectedIsDashboardAddonEnabled bool
expectedGetEtcdStorageLimitGB int
name string
cs *api.ContainerService
expectedHasCustomSearchDomain bool
expectedGetSearchDomainName string
expectedGetSearchDomainRealmUser string
expectedGetSearchDomainRealmPassword string
expectedHasCustomNodesDNS bool
expectedGetHyperkubeImageReference string
expectedGetTargetEnvironment string
expectedIsNSeriesSKU bool
expectedIsDockerContainerRuntime bool
expectedHasPrivateAzureRegistryServer bool
expectedGetPrivateAzureRegistryServer string
expectedGetSysctlDConfigKeyVals string
expectedGetCSEErrorCodeVals []int
expectedHasVHDDistroNodes bool
expectedIsVHDDistroForAllNodes bool
expectedHasClusterInitComponent bool
expectedIsVirtualMachineScaleSets bool
expectedUseManagedIdentity bool
expectedHasKubeReservedCgroup bool
expectedGetKubeReservedCgroup string
expectedHasCustomPodSecurityPolicy bool
expectedIsDashboardAddonEnabled bool
expectedIsPodSecurityPolicyAddonEnabled bool
expectedGetEtcdStorageLimitGB int
}{
{
name: "1.15 release",
Expand Down Expand Up @@ -894,19 +895,20 @@ func TestGetContainerServiceFuncMap(t *testing.T) {
},
},
},
expectedHasCustomSearchDomain: false,
expectedGetSearchDomainName: "",
expectedGetSearchDomainRealmUser: "",
expectedGetSearchDomainRealmPassword: "",
expectedHasCustomNodesDNS: false,
expectedGetHyperkubeImageReference: "hyperkube-amd64:v1.15.4",
expectedGetTargetEnvironment: "AzurePublicCloud",
expectedIsNSeriesSKU: false,
expectedIsDockerContainerRuntime: true,
expectedGetSysctlDConfigKeyVals: "",
expectedGetCSEErrorCodeVals: []int{-1},
expectedIsVirtualMachineScaleSets: true,
expectedHasCustomPodSecurityPolicy: true,
expectedHasCustomSearchDomain: false,
expectedGetSearchDomainName: "",
expectedGetSearchDomainRealmUser: "",
expectedGetSearchDomainRealmPassword: "",
expectedHasCustomNodesDNS: false,
expectedGetHyperkubeImageReference: "hyperkube-amd64:v1.15.4",
expectedGetTargetEnvironment: "AzurePublicCloud",
expectedIsNSeriesSKU: false,
expectedIsDockerContainerRuntime: true,
expectedGetSysctlDConfigKeyVals: "",
expectedGetCSEErrorCodeVals: []int{-1},
expectedIsVirtualMachineScaleSets: true,
expectedHasCustomPodSecurityPolicy: true,
expectedIsPodSecurityPolicyAddonEnabled: true,
},
{
name: "kubernetes-dashboard addon enabled",
Expand Down Expand Up @@ -1023,6 +1025,47 @@ func TestGetContainerServiceFuncMap(t *testing.T) {
expectedIsVirtualMachineScaleSets: true,
expectedGetEtcdStorageLimitGB: 8589934592,
},
{
name: "pod-security-policy addon enabled",
cs: &api.ContainerService{
Properties: &api.Properties{
OrchestratorProfile: &api.OrchestratorProfile{
OrchestratorType: api.Kubernetes,
OrchestratorVersion: "1.15.4",
KubernetesConfig: &api.KubernetesConfig{
ContainerRuntime: api.Docker,
KubernetesImageBaseType: common.KubernetesImageBaseTypeGCR,
Addons: []api.KubernetesAddon{
{
Name: common.PodSecurityPolicyAddonName,
Enabled: to.BoolPtr(true),
},
},
},
},
AgentPoolProfiles: []*api.AgentPoolProfile{
{
Name: "pool1",
Count: 1,
AvailabilityProfile: api.VirtualMachineScaleSets,
},
},
},
},
expectedHasCustomSearchDomain: false,
expectedGetSearchDomainName: "",
expectedGetSearchDomainRealmUser: "",
expectedGetSearchDomainRealmPassword: "",
expectedHasCustomNodesDNS: false,
expectedGetHyperkubeImageReference: "hyperkube-amd64:v1.15.4",
expectedGetTargetEnvironment: "AzurePublicCloud",
expectedIsNSeriesSKU: false,
expectedIsDockerContainerRuntime: true,
expectedGetSysctlDConfigKeyVals: "",
expectedGetCSEErrorCodeVals: []int{-1},
expectedIsVirtualMachineScaleSets: true,
expectedIsPodSecurityPolicyAddonEnabled: true,
},
}

for _, c := range cases {
Expand Down Expand Up @@ -1183,7 +1226,12 @@ func TestGetContainerServiceFuncMap(t *testing.T) {
v = reflect.ValueOf(funcMap["IsDashboardAddonEnabled"])
ret = v.Call(make([]reflect.Value, 0))
if ret[0].Interface() != c.expectedIsDashboardAddonEnabled {
t.Errorf("expected funcMap invocation of HasCustomPodSecurityPolicy to return %t, instead got %t", c.expectedIsDashboardAddonEnabled, ret[0].Interface())
t.Errorf("expected funcMap invocation of IsDashboardAddonEnabled to return %t, instead got %t", c.expectedIsDashboardAddonEnabled, ret[0].Interface())
}
v = reflect.ValueOf(funcMap["IsPodSecurityPolicyAddonEnabled"])
ret = v.Call(make([]reflect.Value, 0))
if ret[0].Interface() != c.expectedIsPodSecurityPolicyAddonEnabled {
t.Errorf("expected funcMap invocation of IsPodSecurityPolicyAddonEnabled to return %t, instead got %t", c.expectedIsPodSecurityPolicyAddonEnabled, ret[0].Interface())
}
v = reflect.ValueOf(funcMap["GetEtcdStorageLimitGB"])
ret = v.Call(make([]reflect.Value, 0))
Expand Down
2 changes: 1 addition & 1 deletion pkg/engine/templates_generated.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit de3b547

Please sign in to comment.