diff --git a/README.md b/README.md index 1c84946a..0c11ff4b 100644 --- a/README.md +++ b/README.md @@ -56,9 +56,9 @@ kubectl delete -f examples/csi-app.yaml kubectl delete -f examples/csi-pvc.yaml ``` -## Development ### +### Development ### -In order to run the integration tests locally, you need to create to loop devices on your host machine. Make sure the loop device mount paths are not used on your system (default path is `/dev/loop10{1,2}`). +In order to run the integration tests locally, you need to create to loop devices on your host machine. Make sure the loop device mount paths are not used on your system (default path is `/dev/loop10{0,1}`). You can create these loop devices like this: diff --git a/config/kind-pss.yaml b/config/kind-pss.yaml new file mode 100644 index 00000000..297f5eef --- /dev/null +++ b/config/kind-pss.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1 + kind: PodSecurityConfiguration + defaults: + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" + exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system, local-path-storage, csi-driver-lvm] diff --git a/tests/bats/test.bats b/tests/bats/test.bats index 6f4d6845..01eb564a 100644 --- a/tests/bats/test.bats +++ b/tests/bats/test.bats @@ -1,7 +1,8 @@ #!/usr/bin/env bats -p @test "deploy csi-lvm-controller" { - run helm upgrade --install --repo ${HELM_REPO} csi-driver-lvm csi-driver-lvm --values values.yaml --wait --timeout=120s + run kubectl create namespace csi-driver-lvm || true + run helm upgrade --debug --install --repo ${HELM_REPO} --namespace csi-driver-lvm csi-driver-lvm csi-driver-lvm --values values.yaml --wait --timeout=120s [ "$status" -eq 0 ] } @@ -16,7 +17,7 @@ } @test "delete inline linear pod" { - run kubectl delete -f files/pod.inline.vol.yaml --wait --timeout=10s + run kubectl delete -f files/pod.inline.vol.yaml --grace-period=0 --wait --timeout=10s [ "$status" -eq 0 ] } @@ -83,22 +84,22 @@ } @test "delete linear pod" { - run kubectl delete -f files/pod.linear.vol.yaml --wait --timeout=10s + run kubectl delete -f files/pod.linear.vol.yaml --grace-period=0 --wait --timeout=10s [ "$status" -eq 0 ] } @test "delete resized linear pvc" { - run kubectl delete -f files/pvc.linear.resize.yaml --wait --timeout=10s + run kubectl delete -f files/pvc.linear.resize.yaml --grace-period=0 --wait --timeout=10s [ "$status" -eq 0 ] } @test "delete block pod" { - run kubectl delete -f files/pod.block.vol.yaml --wait --timeout=10s + run kubectl delete -f files/pod.block.vol.yaml --grace-period=0 --wait --timeout=10s [ "$status" -eq 0 ] } @test "delete resized block pvc" { - run kubectl delete -f files/pvc.block.resize.yaml --wait --timeout=10s + run kubectl delete -f files/pvc.block.resize.yaml --grace-period=0 --wait --timeout=10s [ "$status" -eq 0 ] } @@ -119,7 +120,7 @@ } @test "delete inline xfs linear pod" { - run kubectl delete -f files/pod.inline.vol.xfs.yaml --wait --timeout=10s + run kubectl delete -f files/pod.inline.vol.xfs.yaml --wait --grace-period=0 --timeout=10s [ "$status" -eq 0 ] } @@ -127,6 +128,6 @@ echo "⏳ Wait 10s for all PVCs to be cleaned up..." >&3 sleep 10 - run helm uninstall csi-driver-lvm --wait --timeout=30s + run helm uninstall --namespace csi-driver-lvm csi-driver-lvm --wait --timeout=30s [ "$status" -eq 0 ] } diff --git a/tests/files/pod.block.vol.yaml b/tests/files/pod.block.vol.yaml index c4d73d82..5732ae27 100644 --- a/tests/files/pod.block.vol.yaml +++ b/tests/files/pod.block.vol.yaml @@ -5,10 +5,21 @@ metadata: spec: containers: - name: volume-test-block - image: nginx:stable-alpine + image: alpine imagePullPolicy: IfNotPresent - ports: - - containerPort: 80 + command: + - tail + - -f + - /etc/hosts + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 10014 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL volumeDevices: - name: block devicePath: /dev/xvda diff --git a/tests/files/pod.inline.vol.xfs.yaml b/tests/files/pod.inline.vol.xfs.yaml index fc339cea..24ed6e6b 100644 --- a/tests/files/pod.inline.vol.xfs.yaml +++ b/tests/files/pod.inline.vol.xfs.yaml @@ -5,8 +5,21 @@ metadata: spec: containers: - name: inline - image: nginx:stable-alpine + image: alpine imagePullPolicy: IfNotPresent + command: + - tail + - -f + - /etc/hosts + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 10014 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL volumeMounts: - mountPath: "/data" name: lvm-pvc-inline-xfs @@ -17,4 +30,4 @@ spec: volumeAttributes: size: "20MB" type: "linear" - fsType: xfs \ No newline at end of file + fsType: xfs diff --git a/tests/files/pod.inline.vol.yaml b/tests/files/pod.inline.vol.yaml index 02f4291f..b62ad703 100644 --- a/tests/files/pod.inline.vol.yaml +++ b/tests/files/pod.inline.vol.yaml @@ -5,8 +5,21 @@ metadata: spec: containers: - name: inline - image: nginx:stable-alpine + image: alpine imagePullPolicy: IfNotPresent + command: + - tail + - -f + - /etc/hosts + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 10014 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL volumeMounts: - mountPath: "/data" name: lvm-pvc-inline diff --git a/tests/files/pod.linear.vol.yaml b/tests/files/pod.linear.vol.yaml index bae07d70..3fe06202 100644 --- a/tests/files/pod.linear.vol.yaml +++ b/tests/files/pod.linear.vol.yaml @@ -5,14 +5,24 @@ metadata: spec: containers: - name: volume-test - image: nginx:stable-alpine + image: alpine imagePullPolicy: IfNotPresent + command: + - tail + - -f + - /etc/hosts + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 10014 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL volumeMounts: - name: linear mountPath: /linear - - ports: - - containerPort: 80 resources: limits: cpu: 100m diff --git a/tests/kind.yaml b/tests/kind.yaml index 6534e839..515c3f5c 100644 --- a/tests/kind.yaml +++ b/tests/kind.yaml @@ -8,3 +8,18 @@ nodes: containerPath: /dev/loop100 - hostPath: /dev/loop101 containerPath: /dev/loop101 + - hostPath: config + containerPath: /etc/config + + kubeadmConfigPatches: + - | + kind: ClusterConfiguration + apiServer: + extraArgs: + admission-control-config-file: /etc/config/kind-pss.yaml + extraVolumes: + - name: accf + hostPath: /etc/config + mountPath: /etc/config + readOnly: true + pathType: "DirectoryOrCreate"