Skip to content

K
k3s
Commit 749e0d0d authored by Random-Liu's avatar Random-Liu
Browse files
Options

Move privileged and kubelet_etc_hosts into common directory.

parent 268f458e
Hide whitespace changes
Inline Side-by-side
Showing with 16 additions and 297 deletions
test/e2e/kubelet_etc_hosts.go → test/e2e/common/kubelet_etc_hosts.go
View file @ 749e0d0d
/*
Copyright 2014 The Kubernetes Authors.
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
......@@ -14,16 +14,13 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e
package common
import (
"fmt"
"strings"
. "github.com/onsi/ginkgo"
api "k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/unversioned"
"k8s.io/kubernetes/pkg/apimachinery/registered"
"k8s.io/kubernetes/test/e2e/framework"
)
......@@ -106,32 +103,13 @@ func assertEtcHostsIsNotKubeletManaged(etcHostsContent string) {
}
func (config *KubeletManagedHostConfig) getEtcHostsContent(podName, containerName string) string {
cmd := framework.KubectlCmd("exec", fmt.Sprintf("--namespace=%v", config.f.Namespace.Name), podName, "-c", containerName, "cat", "/etc/hosts")
stdout, stderr, err := framework.StartCmdAndStreamOutput(cmd)
if err != nil {
framework.Failf("Failed to retrieve /etc/hosts, err: %q", err)
}
defer stdout.Close()
defer stderr.Close()
buf := make([]byte, 1000)
var n int
framework.Logf("reading from `kubectl exec` command's stdout")
if n, err = stdout.Read(buf); err != nil {
framework.Failf("Failed to read from kubectl exec stdout: %v", err)
}
return string(buf[:n])
return config.f.ExecCommandInContainer(podName, containerName, "cat", "/etc/hosts")
}
func (config *KubeletManagedHostConfig) createPodSpec(podName string) *api.Pod {
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: podName,
Namespace: config.f.Namespace.Name,
Name: podName,
},
Spec: api.PodSpec{
Containers: []api.Container{
......@@ -186,13 +164,8 @@ func (config *KubeletManagedHostConfig) createPodSpec(podName string) *api.Pod {
func (config *KubeletManagedHostConfig) createPodSpecWithHostNetwork(podName string) *api.Pod {
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: podName,
Namespace: config.f.Namespace.Name,
Name: podName,
},
Spec: api.PodSpec{
SecurityContext: &api.PodSecurityContext{
......
test/e2e/privileged.go → test/e2e/common/privileged.go
View file @ 749e0d0d
/*
Copyright 2015 The Kubernetes Authors.
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
......@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e
package common
import (
"encoding/json"
......@@ -24,9 +24,6 @@ import (
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/unversioned"
"k8s.io/kubernetes/pkg/apimachinery/registered"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/test/e2e/framework"
)
......@@ -54,7 +51,8 @@ var _ = framework.KubeDescribe("PrivilegedPod", func() {
f: f,
}
It("should test privileged pod", func() {
config.hostExecPod = framework.LaunchHostExecPod(config.f.Client, config.f.Namespace.Name, "hostexec")
By("Creating a hostexec pod")
config.createHostExecPod()
By("Creating a privileged pod")
config.createPrivilegedPod()
......@@ -90,7 +88,7 @@ func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, con
v.Encode())
By(fmt.Sprintf("Exec-ing into container over http. Running command:%s", cmd))
stdout := framework.RunHostCmdOrDie(config.hostExecPod.Namespace, config.hostExecPod.Name, cmd)
stdout := config.f.ExecShellInPod(config.hostExecPod.Name, cmd)
var output map[string]string
err := json.Unmarshal([]byte(stdout), &output)
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Could not unmarshal curl response: %s", stdout))
......@@ -102,10 +100,6 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
isPrivileged := true
notPrivileged := false
pod := &api.Pod{
TypeMeta: unversioned.TypeMeta{
Kind: "Pod",
APIVersion: registered.GroupOrDie(api.GroupName).GroupVersion.String(),
},
ObjectMeta: api.ObjectMeta{
Name: privilegedPodName,
Namespace: config.f.Namespace.Name,
......@@ -140,28 +134,12 @@ func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
return pod
}
func (config *PrivilegedPodTestConfig) createPrivilegedPod() {
podSpec := config.createPrivilegedPodSpec()
config.privilegedPod = config.createPod(podSpec)
func (config *PrivilegedPodTestConfig) createHostExecPod() {
podSpec := framework.NewHostExecPodSpec(config.f.Namespace.Name, "hostexec")
config.hostExecPod = config.f.PodClient().CreateSync(podSpec)
}
func (config *PrivilegedPodTestConfig) createPod(pod *api.Pod) *api.Pod {
createdPod, err := config.getPodClient().Create(pod)
if err != nil {
framework.Failf("Failed to create %q pod: %v", pod.Name, err)
}
framework.ExpectNoError(config.f.WaitForPodRunning(pod.Name))
createdPod, err = config.getPodClient().Get(pod.Name)
if err != nil {
framework.Failf("Failed to retrieve %q pod: %v", pod.Name, err)
}
return createdPod
}
func (config *PrivilegedPodTestConfig) getPodClient() client.PodInterface {
return config.f.Client.Pods(config.f.Namespace.Name)
}
func (config *PrivilegedPodTestConfig) getNamespaceClient() client.NamespaceInterface {
return config.f.Client.Namespaces()
func (config *PrivilegedPodTestConfig) createPrivilegedPod() {
podSpec := config.createPrivilegedPodSpec()
config.privilegedPod = config.f.PodClient().CreateSync(podSpec)
}
test/e2e_node/exec_util.go deleted 100644 → 0
View file @ 268f458e
/*
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e_node
import (
"bytes"
"io"
"net/url"
"strings"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/client/restclient"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/pkg/client/unversioned/remotecommand"
remotecommandserver "k8s.io/kubernetes/pkg/kubelet/server/remotecommand"
)
func execute(method string, url *url.URL, config *restclient.Config, stdin io.Reader, stdout, stderr io.Writer, tty bool) error {
exec, err := remotecommand.NewExecutor(config, method, url)
if err != nil {
return err
}
return exec.Stream(remotecommand.StreamOptions{
SupportedProtocols: remotecommandserver.SupportedStreamingProtocols,
Stdin: stdin,
Stdout: stdout,
Stderr: stderr,
Tty: tty,
})
}
func execCommandInContainer(config *restclient.Config, c *client.Client, ns, podName, containerName string, cmd []string) (string, error) {
var stdout, stderr bytes.Buffer
var stdin io.Reader
tty := false
req := c.RESTClient.Post().
Resource("pods").
Name(podName).
Namespace(ns).
SubResource("exec").
Param("container", containerName)
req.VersionedParams(&api.PodExecOptions{
Container: containerName,
Command: cmd,
Stdin: false,
Stdout: true,
Stderr: true,
TTY: tty,
}, api.ParameterCodec)
err := execute("POST", req.URL(), config, stdin, &stdout, &stderr, tty)
if err != nil {
return "", err
}
return strings.TrimSpace(stdout.String()), nil
}
test/e2e_node/privileged_test.go deleted 100644 → 0
View file @ 268f458e
/*
Copyright 2016 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package e2e_node
import (
"encoding/json"
"fmt"
"net/url"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/client/restclient"
client "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/test/e2e/framework"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
)
// TODO: This test was ported from test/e2e/privileged.go. We should
// re-evaluate the need of testing the feature in both suites.
const (
privilegedPodName = "privileged-pod"
privilegedContainerName = "privileged-container"
privilegedHttpPort = 8080
privilegedUdpPort = 8081
notPrivilegedHttpPort = 9090
notPrivilegedUdpPort = 9091
notPrivilegedContainerName = "not-privileged-container"
privilegedCommand = "ip link add dummy1 type dummy"
)
type PrivilegedPodTestConfig struct {
config *restclient.Config
client *client.Client
namespace string
hostExecPod *api.Pod
privilegedPod *api.Pod
}
// TODO(random-liu): Change the test to use framework and framework pod client.
var _ = Describe("PrivilegedPod", func() {
f := framework.NewDefaultFramework("privileged-pod")
It("should test privileged pod", func() {
config := &PrivilegedPodTestConfig{
client: f.Client,
config: &restclient.Config{Host: framework.TestContext.Host},
namespace: f.Namespace.Name,
}
By("Creating a host exec pod")
config.hostExecPod = f.PodClient().CreateSync(newHostExecPodSpec("hostexec"))
By("Creating a privileged pod")
config.privilegedPod = f.PodClient().CreateSync(config.createPrivilegedPodSpec())
By("Executing privileged command on privileged container")
config.runPrivilegedCommandOnPrivilegedContainer()
By("Executing privileged command on non-privileged container")
config.runPrivilegedCommandOnNonPrivilegedContainer()
})
})
func (config *PrivilegedPodTestConfig) createPrivilegedPodSpec() *api.Pod {
isPrivileged := true
notPrivileged := false
pod := &api.Pod{
ObjectMeta: api.ObjectMeta{
Name: privilegedPodName,
},
Spec: api.PodSpec{
Containers: []api.Container{
{
Name: privilegedContainerName,
Image: ImageRegistry[netExecImage],
ImagePullPolicy: api.PullIfNotPresent,
SecurityContext: &api.SecurityContext{Privileged: &isPrivileged},
Command: []string{
"/netexec",
fmt.Sprintf("--http-port=%d", privilegedHttpPort),
fmt.Sprintf("--udp-port=%d", privilegedUdpPort),
},
},
{
Name: notPrivilegedContainerName,
Image: ImageRegistry[netExecImage],
ImagePullPolicy: api.PullIfNotPresent,
SecurityContext: &api.SecurityContext{Privileged: &notPrivileged},
Command: []string{
"/netexec",
fmt.Sprintf("--http-port=%d", notPrivilegedHttpPort),
fmt.Sprintf("--udp-port=%d", notPrivilegedUdpPort),
},
},
},
},
}
return pod
}
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnPrivilegedContainer() {
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, privilegedHttpPort)
Expect(len(outputMap["error"]) == 0).To(BeTrue(), fmt.Sprintf("Privileged command failed unexpectedly on privileged container, output: %v", outputMap))
}
func (config *PrivilegedPodTestConfig) runPrivilegedCommandOnNonPrivilegedContainer() {
outputMap := config.dialFromContainer(config.privilegedPod.Status.PodIP, notPrivilegedHttpPort)
Expect(len(outputMap["error"]) > 0).To(BeTrue(), fmt.Sprintf("Privileged command should have failed on non-privileged container, output: %v", outputMap))
}
func (config *PrivilegedPodTestConfig) dialFromContainer(containerIP string, containerHttpPort int) map[string]string {
v := url.Values{}
v.Set("shellCommand", "ip link add dummy1 type dummy")
cmd := fmt.Sprintf("curl -q 'http://%s:%d/shell?%s'",
containerIP,
containerHttpPort,
v.Encode())
By(fmt.Sprintf("Exec-ing into container over http. Running command: %s", cmd))
stdout, err := execCommandInContainer(config.config, config.client, config.namespace, config.hostExecPod.Name, config.hostExecPod.Spec.Containers[0].Name,
[]string{"/bin/sh", "-c", cmd})
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Error running command %q: %v", cmd, err))
var output map[string]string
err = json.Unmarshal([]byte(stdout), &output)
Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("Could not unmarshal curl response: %s", stdout))
return output
}
// newHostExecPodSpec returns the pod spec of hostexec pod
func newHostExecPodSpec(name string) *api.Pod {
return &api.Pod{
ObjectMeta: api.ObjectMeta{
Name: name,
},
Spec: api.PodSpec{
Containers: []api.Container{
{
Name: "hostexec",
Image: ImageRegistry[hostExecImage],
ImagePullPolicy: api.PullIfNotPresent,
},
},
SecurityContext: &api.PodSecurityContext{
HostNetwork: true,
},
},
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment