Add Apparmor Aqua Feature testing for Utility Containers

This covers mysqlclient,openstack and Postgresql UC's.

  1)Removed Apparmor validation scripts from Deploy script.
  2)This has been added as a part of AVT.

Change-Id: I6176b4b46b9add650695c4324bcc9bf65f332eb7

kube_utility_container/tests/utility/mysqlclient/test_mysqlclient_utility_container.py

@@ -37,3 +37,21 @@ class TestMysqlclientUtilityContainer(TestBase):
                     f" value {expected} set for read_only_root_filesystem"
                     f" in pod {mysqlclient_utility_pod.metadata.name}")
         self.assertEqual(0, len(failures), failures)
+
+    def test_verify_apparmor(self):
+        """To verify mysqlclient-utility Apparmor"""
+        failures = []
+        expected = "runtime/default"
+        mysqlclient_utility_pod = \
+            self.client._get_utility_container(self.deployment_name)
+        for container in mysqlclient_utility_pod.spec.containers:
+            annotations_common = \
+                'container.apparmor.security.beta.kubernetes.io/'
+            annotations_key = annotations_common + container.name
+            if expected != mysqlclient_utility_pod.metadata.annotations[
+                    annotations_key]:
+                failures.append(
+                    f"container {container.name} belongs to pod "
+                    f"{mysqlclient_utility_pod.metadata.name} "
+                    f"is not having expected apparmor profile set")
+        self.assertEqual(0, len(failures), failures)

kube_utility_container/tests/utility/openstack/test_openstack_utility_container.py

@@ -37,3 +37,21 @@ class TestOpenstackUtilityContainer(TestBase):
                     f" value {expected} set for read_only_root_filesystem"
                     f" in pod {openstack_utility_pod.metadata.name}")
         self.assertEqual(0, len(failures), failures)
+
+    def test_verify_apparmor(self):
+        """To verify openstack-utility Apparmor"""
+        failures = []
+        expected = "runtime/default"
+        openstack_utility_pod = \
+            self.client._get_utility_container(self.deployment_name)
+        for container in openstack_utility_pod.spec.containers:
+            annotations_common = \
+                'container.apparmor.security.beta.kubernetes.io/'
+            annotations_key = annotations_common + container.name
+            if expected != openstack_utility_pod.metadata.annotations[
+                    annotations_key]:
+                failures.append(
+                    f"container {container.name} belongs to pod "
+                    f"{openstack_utility_pod.metadata.name} "
+                    f"is not having expected apparmor profile set")
+        self.assertEqual(0, len(failures), failures)

kube_utility_container/tests/utility/postgresql/test_postgresql_utility_container.py

@@ -0,0 +1,41 @@
+# Copyright 2020 AT&T Intellectual Property.  All other rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+
+from kube_utility_container.tests.utility.base import TestBase
+
+class TestPostgresqlUtilityContainer(TestBase):
+    @classmethod
+    def setUpClass(cls):
+        cls.deployment_name = 'postgresql-utility'
+        super(TestPostgresqlUtilityContainer, cls).setUpClass()
+
+    def test_verify_apparmor(self):
+        """To verify postgresql-utility Apparmor"""
+        failures = []
+        expected = "runtime/default"
+        postgresql_utility_pod = \
+            self.client._get_utility_container(self.deployment_name)
+        for container in postgresql_utility_pod.spec.containers:
+            annotations_common = \
+                'container.apparmor.security.beta.kubernetes.io/'
+            annotations_key = annotations_common + container.name
+            if expected != postgresql_utility_pod.metadata.annotations[
+                    annotations_key]:
+                failures.append(
+                    f"container {container.name} belongs to pod "
+                    f"{postgresql_utility_pod.metadata.name} "
+                    f"is not having expected apparmor profile set")
+        self.assertEqual(0, len(failures), failures)

tools/deployment/040-mysqlclient-utility.sh

@@ -20,19 +20,3 @@ helm upgrade --install mysqlclient-utility ./charts/mysqlclient-utility --namesp
 : "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
 cd "${OSH_INFRA_PATH}"
 ./tools/deployment/common/wait-for-pods.sh $namespace
-
-#Validate Apparmor
-mysql_pod=$(kubectl get pods --namespace=$namespace  -o wide | grep mysqlclient | awk '{print $1}')
-expected_profile="docker-default (enforce)"
-profile=`kubectl -n $namespace exec $mysql_pod -- cat /proc/1/attr/current`
-echo "Profile running: $profile"
-  if test "$profile" != "$expected_profile"
-  then
-    if test "$proc_name" == "pause"
-    then
-      echo "Root process (pause) can run docker-default, it's ok."
-    else
-      echo "$profile is the WRONG PROFILE!!"
-      return 1
-    fi
-  fi

tools/deployment/050-openstack-utility.sh

@@ -20,49 +20,3 @@ helm upgrade --install openstack-utility ./charts/openstack-utility --namespace=
 : "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
 cd "${OSH_INFRA_PATH}"
 ./tools/deployment/common/wait-for-pods.sh $namespace
-
-#Validate Apparmor
-ouc_pod=$(kubectl get pods --namespace=$namespace -o wide | grep openstack | awk '{print $1}')
-expected_profile="docker-default (enforce)"
-
-#Below can be used for multiple Processes.Grab the processes (numbered directories) from the /proc directory,
-# and then sort them. Highest proc number indicates most recent process.
-#unsorted_process_file="/tmp/unsorted_proc_list"
-#sorted_process_file="/tmp/proc_list"
-#kubectl -n $namespace exec $ouc_pod -- ls -1 /proc | grep -e "^[0-9]*$" > $unsorted_process_file
-#sort --numeric-sort $unsorted_process_file > $sorted_process_file
-
-# The last/latest process in the list will actually be the "ls" command above,
-# which isn't running any more, so remove it.
-#sed -i '$ d' $sorted_process_file
-
-#while IFS='' read -r process || [[ -n "$process" ]]; do
-  #echo "Process ID: $process"
-  #proc_name=`kubectl -n $namespace exec $ouc_pod -- cat /proc/$process/status | grep "Name:" | awk -F' ' '{print $2}'`
-  #echo "Process Name: $proc_name"
-#  profile=`kubectl -n $namespace exec $ouc_pod -- cat /proc/1/attr/current`
-#  echo "Profile running: $profile"
-#  if test "$profile" != "$expected_profile"
-#  then
-#    if test "$proc_name" == "pause"
-#    then
-#      echo "Root process (pause) can run docker-default, it's ok."
-#    else
-#      echo "$profile is the WRONG PROFILE!!"
-#      return 1
-#    fi
-#  fi
-#done < $sorted_process_file
-
-profile=`kubectl -n $namespace exec $ouc_pod -- cat /proc/1/attr/current`
-echo "Profile running: $profile"
-  if test "$profile" != "$expected_profile"
-  then
-    if test "$proc_name" == "pause"
-    then
-      echo "Root process (pause) can run docker-default, it's ok."
-    else
-      echo "$profile is the WRONG PROFILE!!"
-      return 1
-    fi
-  fi

tools/deployment/060-postgresql-utility.sh

@@ -19,19 +19,3 @@ helm upgrade --install postgresql-utility ./charts/postgresql-utility --namespac
 : "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
 cd "${OSH_INFRA_PATH}"
 ./tools/deployment/common/wait-for-pods.sh $namespace
-
-#Validate Apparmor
-pos_pod=$(kubectl get pods --namespace=$namespace  -o wide | grep postgresql | awk '{print $1}')
-expected_profile="docker-default (enforce)"
-profile=`kubectl -n $namespace exec $pos_pod -- cat /proc/1/attr/current`
-echo "Profile running: $profile"
-  if test "$profile" != "$expected_profile"
-  then
-    if test "$proc_name" == "pause"
-    then
-      echo "Root process (pause) can run docker-default, it's ok."
-    else
-      echo "$profile is the WRONG PROFILE!!"
-      return 1
-    fi
-  fi

tools/run_avt.sh

@@ -51,6 +51,7 @@ function run_feature_tests() {
       python -m unittest discover -s ${PLUGINS}/tests/utility/ceph -v
       python -m unittest discover -s ${PLUGINS}/tests/utility/mysqlclient -v
       python -m unittest discover -s ${PLUGINS}/tests/utility/openstack -v
+      python -m unittest discover -s ${PLUGINS}/tests/utility/postgresql -v
 }
 
 function run_unit_tests() {