WIP: set "readonly_rootfs" and "privileged" in the right places in tests

[nalind]

The readonly_rootfs and privileged options are part of Linux-specific security context information (definition). Setting them anywhere else doesn't appear to have any effect.

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nalind
To complete the pull request process, please assign giuseppe
You can assign the PR to them by writing /assign @giuseppe in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

Hi @nalind. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

Hi @nalind. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[codecov]

Codecov Report

Merging #2992 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #2992   +/-   ##
=======================================
  Coverage   47.08%   47.08%           
=======================================
  Files          88       88           
  Lines        7155     7155           
=======================================
  Hits         3369     3369           
  Misses       3496     3496           
  Partials      290      290

[haircommander]

/ok-to-test

[haircommander]

/retest

[openshift-ci-robot]

@nalind: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/integration_rhel	cc483bd	link	/test integration_rhel
ci/openshift-jenkins/integration_fedora	cc483bd	link	/test integration_fedora
ci/kata-jenkins	cc483bd	link	/test kata-containers
ci/openshift-jenkins/integration_crun	cc483bd	link	/test integration_crun

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[rhatdan]

@nalind @haircommander Is this still being worked on? Still something we want?

[haircommander]

I think we should drop this one, and see which containers fail from not having priv

[haircommander]

same here, no priv needed methinks

[haircommander]

I started a review, but thinking about it, each of these should have no privilege, with the exception of container_config_privileged.json. All the readonly_rootfs should be moved to make sure we're testing that as expected.

Thanks for the patch @nalind this is very much needed.

[haircommander]

(btw, the ci errors are:
# time="2019-12-04T19:14:40Z" level=fatal msg="Creating container failed: rpc error: code = Unknown desc = no privileged container allowed in sandbox"
which is from the container asking for priv when the sandbox wasn't specified to have it

[haircommander]

I am taking this over here

[rhatdan]

@haircommander You pointed at your self?

[haircommander]

lol here **