From d288bc0368975df69940a105bc44d9f7783cc511 Mon Sep 17 00:00:00 2001 From: WanLinghao Date: Fri, 26 Jul 2019 19:09:20 +0800 Subject: [PATCH] Refactor and clean up e2e framework utils, this patch handles test/e2e/framework/psp_util.go file --- test/e2e/auth/BUILD | 1 + test/e2e/auth/pod_security_policy.go | 3 +- test/e2e/framework/BUILD | 7 +--- test/e2e/framework/framework.go | 3 +- test/e2e/framework/psp/BUILD | 37 +++++++++++++++++++ .../e2e/framework/{psp_util.go => psp/psp.go} | 33 +++++++++++------ 6 files changed, 66 insertions(+), 18 deletions(-) create mode 100644 test/e2e/framework/psp/BUILD rename test/e2e/framework/{psp_util.go => psp/psp.go} (79%) diff --git a/test/e2e/auth/BUILD b/test/e2e/auth/BUILD index 5afa5d6bb29a4..dd884877dad57 100644 --- a/test/e2e/auth/BUILD +++ b/test/e2e/auth/BUILD @@ -59,6 +59,7 @@ go_library( "//test/e2e/framework/log:go_default_library", "//test/e2e/framework/node:go_default_library", "//test/e2e/framework/pod:go_default_library", + "//test/e2e/framework/psp:go_default_library", "//test/utils:go_default_library", "//test/utils/image:go_default_library", "//vendor/github.com/evanphx/json-patch:go_default_library", diff --git a/test/e2e/auth/pod_security_policy.go b/test/e2e/auth/pod_security_policy.go index d86c619c1910e..d5890f62c5423 100644 --- a/test/e2e/auth/pod_security_policy.go +++ b/test/e2e/auth/pod_security_policy.go @@ -35,6 +35,7 @@ import ( "k8s.io/kubernetes/test/e2e/framework" "k8s.io/kubernetes/test/e2e/framework/auth" e2epod "k8s.io/kubernetes/test/e2e/framework/pod" + e2epsp "k8s.io/kubernetes/test/e2e/framework/psp" imageutils "k8s.io/kubernetes/test/utils/image" utilpointer "k8s.io/utils/pointer" @@ -53,7 +54,7 @@ var _ = SIGDescribe("PodSecurityPolicy", func() { var c clientset.Interface var ns string // Test namespace, for convenience ginkgo.BeforeEach(func() { - if !framework.IsPodSecurityPolicyEnabled(f) { + if !e2epsp.IsPodSecurityPolicyEnabled(f.ClientSet) { framework.Skipf("PodSecurityPolicy not enabled") } if !auth.IsRBACEnabled(f.ClientSet.RbacV1()) { diff --git a/test/e2e/framework/BUILD b/test/e2e/framework/BUILD index b851e6e99be54..52f33411442c8 100644 --- a/test/e2e/framework/BUILD +++ b/test/e2e/framework/BUILD @@ -19,7 +19,6 @@ go_library( "pods.go", "profile_gatherer.go", "provider.go", - "psp_util.go", "pv_util.go", "rc_util.go", "resource_usage_gatherer.go", @@ -45,13 +44,11 @@ go_library( "//pkg/master/ports:go_default_library", "//pkg/scheduler/algorithm/predicates:go_default_library", "//pkg/scheduler/nodeinfo:go_default_library", - "//pkg/security/podsecuritypolicy/seccomp:go_default_library", "//pkg/util/system:go_default_library", "//pkg/util/taints:go_default_library", "//pkg/volume/util:go_default_library", "//staging/src/k8s.io/api/apps/v1:go_default_library", "//staging/src/k8s.io/api/core/v1:go_default_library", - "//staging/src/k8s.io/api/policy/v1beta1:go_default_library", "//staging/src/k8s.io/api/rbac/v1:go_default_library", "//staging/src/k8s.io/api/storage/v1:go_default_library", "//staging/src/k8s.io/api/storage/v1beta1:go_default_library", @@ -74,7 +71,6 @@ go_library( "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/util/yaml:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/watch:go_default_library", - "//staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library", "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library", "//staging/src/k8s.io/client-go/discovery:go_default_library", "//staging/src/k8s.io/client-go/discovery/cached/memory:go_default_library", @@ -91,7 +87,6 @@ go_library( "//staging/src/k8s.io/client-go/tools/remotecommand:go_default_library", "//staging/src/k8s.io/client-go/tools/watch:go_default_library", "//staging/src/k8s.io/component-base/cli/flag:go_default_library", - "//test/e2e/framework/auth:go_default_library", "//test/e2e/framework/config:go_default_library", "//test/e2e/framework/ginkgowrapper:go_default_library", "//test/e2e/framework/kubelet:go_default_library", @@ -99,6 +94,7 @@ go_library( "//test/e2e/framework/metrics:go_default_library", "//test/e2e/framework/node:go_default_library", "//test/e2e/framework/pod:go_default_library", + "//test/e2e/framework/psp:go_default_library", "//test/e2e/framework/resource:go_default_library", "//test/e2e/framework/ssh:go_default_library", "//test/e2e/framework/testfiles:go_default_library", @@ -151,6 +147,7 @@ filegroup( "//test/e2e/framework/providers/kubemark:all-srcs", "//test/e2e/framework/providers/openstack:all-srcs", "//test/e2e/framework/providers/vsphere:all-srcs", + "//test/e2e/framework/psp:all-srcs", "//test/e2e/framework/replicaset:all-srcs", "//test/e2e/framework/resource:all-srcs", "//test/e2e/framework/service:all-srcs", diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index 16b086fc25285..0515c460b3ca0 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -49,6 +49,7 @@ import ( e2elog "k8s.io/kubernetes/test/e2e/framework/log" e2emetrics "k8s.io/kubernetes/test/e2e/framework/metrics" e2epod "k8s.io/kubernetes/test/e2e/framework/pod" + e2epsp "k8s.io/kubernetes/test/e2e/framework/psp" testutils "k8s.io/kubernetes/test/utils" "github.com/onsi/ginkgo" @@ -406,7 +407,7 @@ func (f *Framework) CreateNamespace(baseName string, labels map[string]string) ( f.AddNamespacesToDelete(ns) if err == nil && !f.SkipPrivilegedPSPBinding { - createPrivilegedPSPBinding(f, ns.Name) + e2epsp.CreatePrivilegedPSPBinding(f.ClientSet, ns.Name) } return ns, err diff --git a/test/e2e/framework/psp/BUILD b/test/e2e/framework/psp/BUILD new file mode 100644 index 0000000000000..07aeb21c902bc --- /dev/null +++ b/test/e2e/framework/psp/BUILD @@ -0,0 +1,37 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["psp.go"], + importpath = "k8s.io/kubernetes/test/e2e/framework/psp", + visibility = ["//visibility:public"], + deps = [ + "//pkg/security/podsecuritypolicy/seccomp:go_default_library", + "//staging/src/k8s.io/api/core/v1:go_default_library", + "//staging/src/k8s.io/api/policy/v1beta1:go_default_library", + "//staging/src/k8s.io/api/rbac/v1:go_default_library", + "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library", + "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", + "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library", + "//staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library", + "//staging/src/k8s.io/client-go/kubernetes:go_default_library", + "//test/e2e/framework/auth:go_default_library", + "//test/e2e/framework/log:go_default_library", + "//vendor/github.com/onsi/ginkgo:go_default_library", + "//vendor/github.com/onsi/gomega:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/framework/psp_util.go b/test/e2e/framework/psp/psp.go similarity index 79% rename from test/e2e/framework/psp_util.go rename to test/e2e/framework/psp/psp.go index c4fa5a76c74d1..18c9b192e8f91 100644 --- a/test/e2e/framework/psp_util.go +++ b/test/e2e/framework/psp/psp.go @@ -27,11 +27,13 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/authentication/serviceaccount" + clientset "k8s.io/client-go/kubernetes" "k8s.io/kubernetes/pkg/security/podsecuritypolicy/seccomp" "k8s.io/kubernetes/test/e2e/framework/auth" e2elog "k8s.io/kubernetes/test/e2e/framework/log" "github.com/onsi/ginkgo" + "github.com/onsi/gomega" ) const ( @@ -79,9 +81,9 @@ func privilegedPSP(name string) *policyv1beta1.PodSecurityPolicy { } // IsPodSecurityPolicyEnabled returns true if PodSecurityPolicy is enabled. Otherwise false. -func IsPodSecurityPolicyEnabled(f *Framework) bool { +func IsPodSecurityPolicyEnabled(kubeClient clientset.Interface) bool { isPSPEnabledOnce.Do(func() { - psps, err := f.ClientSet.PolicyV1beta1().PodSecurityPolicies().List(metav1.ListOptions{}) + psps, err := kubeClient.PolicyV1beta1().PodSecurityPolicies().List(metav1.ListOptions{}) if err != nil { e2elog.Logf("Error listing PodSecurityPolicies; assuming PodSecurityPolicy is disabled: %v", err) isPSPEnabled = false @@ -100,13 +102,14 @@ var ( privilegedPSPOnce sync.Once ) -func createPrivilegedPSPBinding(f *Framework, namespace string) { - if !IsPodSecurityPolicyEnabled(f) { +// CreatePrivilegedPSPBinding creates the privileged PSP & role +func CreatePrivilegedPSPBinding(kubeClient clientset.Interface, namespace string) { + if !IsPodSecurityPolicyEnabled(kubeClient) { return } // Create the privileged PSP & role privilegedPSPOnce.Do(func() { - _, err := f.ClientSet.PolicyV1beta1().PodSecurityPolicies().Get( + _, err := kubeClient.PolicyV1beta1().PodSecurityPolicies().Get( podSecurityPolicyPrivileged, metav1.GetOptions{}) if !apierrs.IsNotFound(err) { // Privileged PSP was already created. @@ -115,14 +118,14 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) { } psp := privilegedPSP(podSecurityPolicyPrivileged) - psp, err = f.ClientSet.PolicyV1beta1().PodSecurityPolicies().Create(psp) + psp, err = kubeClient.PolicyV1beta1().PodSecurityPolicies().Create(psp) if !apierrs.IsAlreadyExists(err) { ExpectNoError(err, "Failed to create PSP %s", podSecurityPolicyPrivileged) } - if auth.IsRBACEnabled(f.ClientSet.RbacV1()) { + if auth.IsRBACEnabled(kubeClient.RbacV1()) { // Create the Role to bind it to the namespace. - _, err = f.ClientSet.RbacV1().ClusterRoles().Create(&rbacv1.ClusterRole{ + _, err = kubeClient.RbacV1().ClusterRoles().Create(&rbacv1.ClusterRole{ ObjectMeta: metav1.ObjectMeta{Name: podSecurityPolicyPrivileged}, Rules: []rbacv1.PolicyRule{{ APIGroups: []string{"extensions"}, @@ -137,10 +140,10 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) { } }) - if auth.IsRBACEnabled(f.ClientSet.RbacV1()) { + if auth.IsRBACEnabled(kubeClient.RbacV1()) { ginkgo.By(fmt.Sprintf("Binding the %s PodSecurityPolicy to the default service account in %s", podSecurityPolicyPrivileged, namespace)) - err := auth.BindClusterRoleInNamespace(f.ClientSet.RbacV1(), + err := auth.BindClusterRoleInNamespace(kubeClient.RbacV1(), podSecurityPolicyPrivileged, namespace, rbacv1.Subject{ @@ -149,8 +152,16 @@ func createPrivilegedPSPBinding(f *Framework, namespace string) { Name: "default", }) ExpectNoError(err) - ExpectNoError(auth.WaitForNamedAuthorizationUpdate(f.ClientSet.AuthorizationV1(), + ExpectNoError(auth.WaitForNamedAuthorizationUpdate(kubeClient.AuthorizationV1(), serviceaccount.MakeUsername(namespace, "default"), namespace, "use", podSecurityPolicyPrivileged, schema.GroupResource{Group: "extensions", Resource: "podsecuritypolicies"}, true)) } } + +// ExpectNoError is a copy from the same name function in file test/e2e/framework.go +func ExpectNoError(err error, explain ...interface{}) { + if err != nil { + e2elog.Logf("Unexpected error occurred: %v", err) + } + gomega.ExpectWithOffset(2, err).NotTo(gomega.HaveOccurred(), explain...) +}