Merge pull request #105 from prietyc123/podaccessiblewithoutreadonly

BUILD-478: Validate resource admission smoke test

Author: openshift-ci[bot]

smoke/features/csi-driver-e2e.feature

@@ -41,7 +41,7 @@ Feature: SharedSecrets and SharedConfigMap
             | "openshift_csi_share_mount_failures_total" |
             | "openshift_csi_share_mount_requests_total" |
         Then the metrics value for configured resources should be "1"
-    
+
     @automated @slowest
     Scenario: shared resource data gets removed if permission removed : CSI-01-TC03
         Given user has created resource type with shared resource
@@ -65,9 +65,19 @@ Feature: SharedSecrets and SharedConfigMap
         And creates a pod "my-csi-app-check" with a CSI volume citing the shared resource csi driver with read only true and requesting the previously defined "sharedsecret" in the Pod CSI volume's volume attributes
         And edits secret "my-secret" data from the first project
         Then pod "my-csi-app-check" in the second project should mount the data "hostpath" available in the "my-secret"
-    
+
+    @automated
+    Scenario: Pod does not create if readonly set to false : CSI-01-TC05
+        Given user has cluster scoped level permission to create CRD "sharedsecrets.sharedresource.openshift.io"
+        When user creates the secret "my-secret" in a given namespace 
+        And defines shared secret "my-shared-secret" that references the "my-secret" secret from the first project to share across all namespace
+        And creates another project that will access the cluster scoped shared secret that references the "my-secret" created in the first project
+        And RBAC for the service account to use the "sharedsecret" in its pod
+        And creates a pod "my-csi-app-check" with a CSI volume citing the shared resource csi driver with read only false and requesting the previously defined "sharedsecret" in the Pod CSI volume's volume attributes
+        Then pod should not get created
+
     @manual
-    Scenario: Openshift buildconfig uses shared resource for rhel entitlement subscription : CSI-01-TC05
+    Scenario: Openshift buildconfig uses shared resource for rhel entitlement subscription : CSI-01-TC06
         Given user has created openshift cluster using pull secret that has valid Red Hat subscription which helps in installing Red Hat RPMs
         Then log onto openshift console of the created cluster
         And click on "Openshift Cluster Manager" link

smoke/features/steps/openshift.py

@@ -55,7 +55,7 @@ def search_resource_in_namespace(self, resource_plural, name_pattern, namespace)
     def is_resource_in(self, resource_type):
         output, exit_code = self.cmd.run(f'oc get {resource_type}')
         if exit_code != 0:
-            print("Resource not found")
+            print(f"Resource not found")
             return False
         return True
 
@@ -311,5 +311,6 @@ def execute_command(self, cmd):
 
     def shell_cmd(self, cmd, param):
         output, exit_status = self.cmd.run(f'sh {cmd} {param}')
-        exit_status | should.be_equal_to(0)
+        if exit_status != 0:
+            print(f"Error occured please look into the response")
         return output

smoke/features/steps/steps.py

@@ -119,9 +119,12 @@ def create_rbac(context, shared_resource):
 @when(u'creates a pod {pod_name} with a CSI volume citing the shared resource csi driver with read only {permission} and requesting the previously defined {shared_resource} in the Pod CSI volume\'s volume attributes')
 def create_pod(context, pod_name, shared_resource, permission):
     namespace = Project().current_project()
+    expOut = "pod with ReadOnly false"
     print(f"creating pod {pod_name} within namespace: {namespace}")
     podFile = "./smoke/features/data/pod.sh"
-    oc.shell_cmd(podFile, shared_resource + " " + permission)
+    output = oc.shell_cmd(podFile, shared_resource + permission)
+    if expOut in output:
+        print(f"ERROR: server not allowed to schedule a pod with ReadOnly false SharedResourceCSIVolume, ensure to set readonly to true")
 
 @when(u'edits configMap {share_config} data {value} from the first project')
 def edit_configmap_with_data(context, share_config, value):
@@ -211,3 +214,7 @@ def remove_data_with_permission_removal(context, pod_name):
     output = oc.exec_not_in_pod(pod_name, cmd, True, 60)
     if not output:
         print(f"mounted data removed successfully.")
+
+@then(u'pod should not get created')
+def get_pod(context):
+    oc.is_resource_in("pod")