Add Apparmor Aqua Feature testing for Utility Containers
This covers mysqlclient,openstack and Postgresql UC's. 1)Removed Apparmor validation scripts from Deploy script. 2)This has been added as a part of AVT. Change-Id: I6176b4b46b9add650695c4324bcc9bf65f332eb7
This commit is contained in:
parent
c596a144f1
commit
c19c14b42c
|
@ -37,3 +37,21 @@ class TestMysqlclientUtilityContainer(TestBase):
|
||||||
f" value {expected} set for read_only_root_filesystem"
|
f" value {expected} set for read_only_root_filesystem"
|
||||||
f" in pod {mysqlclient_utility_pod.metadata.name}")
|
f" in pod {mysqlclient_utility_pod.metadata.name}")
|
||||||
self.assertEqual(0, len(failures), failures)
|
self.assertEqual(0, len(failures), failures)
|
||||||
|
|
||||||
|
def test_verify_apparmor(self):
|
||||||
|
"""To verify mysqlclient-utility Apparmor"""
|
||||||
|
failures = []
|
||||||
|
expected = "runtime/default"
|
||||||
|
mysqlclient_utility_pod = \
|
||||||
|
self.client._get_utility_container(self.deployment_name)
|
||||||
|
for container in mysqlclient_utility_pod.spec.containers:
|
||||||
|
annotations_common = \
|
||||||
|
'container.apparmor.security.beta.kubernetes.io/'
|
||||||
|
annotations_key = annotations_common + container.name
|
||||||
|
if expected != mysqlclient_utility_pod.metadata.annotations[
|
||||||
|
annotations_key]:
|
||||||
|
failures.append(
|
||||||
|
f"container {container.name} belongs to pod "
|
||||||
|
f"{mysqlclient_utility_pod.metadata.name} "
|
||||||
|
f"is not having expected apparmor profile set")
|
||||||
|
self.assertEqual(0, len(failures), failures)
|
||||||
|
|
|
@ -37,3 +37,21 @@ class TestOpenstackUtilityContainer(TestBase):
|
||||||
f" value {expected} set for read_only_root_filesystem"
|
f" value {expected} set for read_only_root_filesystem"
|
||||||
f" in pod {openstack_utility_pod.metadata.name}")
|
f" in pod {openstack_utility_pod.metadata.name}")
|
||||||
self.assertEqual(0, len(failures), failures)
|
self.assertEqual(0, len(failures), failures)
|
||||||
|
|
||||||
|
def test_verify_apparmor(self):
|
||||||
|
"""To verify openstack-utility Apparmor"""
|
||||||
|
failures = []
|
||||||
|
expected = "runtime/default"
|
||||||
|
openstack_utility_pod = \
|
||||||
|
self.client._get_utility_container(self.deployment_name)
|
||||||
|
for container in openstack_utility_pod.spec.containers:
|
||||||
|
annotations_common = \
|
||||||
|
'container.apparmor.security.beta.kubernetes.io/'
|
||||||
|
annotations_key = annotations_common + container.name
|
||||||
|
if expected != openstack_utility_pod.metadata.annotations[
|
||||||
|
annotations_key]:
|
||||||
|
failures.append(
|
||||||
|
f"container {container.name} belongs to pod "
|
||||||
|
f"{openstack_utility_pod.metadata.name} "
|
||||||
|
f"is not having expected apparmor profile set")
|
||||||
|
self.assertEqual(0, len(failures), failures)
|
||||||
|
|
|
@ -0,0 +1,41 @@
|
||||||
|
# Copyright 2020 AT&T Intellectual Property. All other rights reserved.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
import unittest
|
||||||
|
|
||||||
|
from kube_utility_container.tests.utility.base import TestBase
|
||||||
|
|
||||||
|
class TestPostgresqlUtilityContainer(TestBase):
|
||||||
|
@classmethod
|
||||||
|
def setUpClass(cls):
|
||||||
|
cls.deployment_name = 'postgresql-utility'
|
||||||
|
super(TestPostgresqlUtilityContainer, cls).setUpClass()
|
||||||
|
|
||||||
|
def test_verify_apparmor(self):
|
||||||
|
"""To verify postgresql-utility Apparmor"""
|
||||||
|
failures = []
|
||||||
|
expected = "runtime/default"
|
||||||
|
postgresql_utility_pod = \
|
||||||
|
self.client._get_utility_container(self.deployment_name)
|
||||||
|
for container in postgresql_utility_pod.spec.containers:
|
||||||
|
annotations_common = \
|
||||||
|
'container.apparmor.security.beta.kubernetes.io/'
|
||||||
|
annotations_key = annotations_common + container.name
|
||||||
|
if expected != postgresql_utility_pod.metadata.annotations[
|
||||||
|
annotations_key]:
|
||||||
|
failures.append(
|
||||||
|
f"container {container.name} belongs to pod "
|
||||||
|
f"{postgresql_utility_pod.metadata.name} "
|
||||||
|
f"is not having expected apparmor profile set")
|
||||||
|
self.assertEqual(0, len(failures), failures)
|
|
@ -20,19 +20,3 @@ helm upgrade --install mysqlclient-utility ./charts/mysqlclient-utility --namesp
|
||||||
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
||||||
cd "${OSH_INFRA_PATH}"
|
cd "${OSH_INFRA_PATH}"
|
||||||
./tools/deployment/common/wait-for-pods.sh $namespace
|
./tools/deployment/common/wait-for-pods.sh $namespace
|
||||||
|
|
||||||
#Validate Apparmor
|
|
||||||
mysql_pod=$(kubectl get pods --namespace=$namespace -o wide | grep mysqlclient | awk '{print $1}')
|
|
||||||
expected_profile="docker-default (enforce)"
|
|
||||||
profile=`kubectl -n $namespace exec $mysql_pod -- cat /proc/1/attr/current`
|
|
||||||
echo "Profile running: $profile"
|
|
||||||
if test "$profile" != "$expected_profile"
|
|
||||||
then
|
|
||||||
if test "$proc_name" == "pause"
|
|
||||||
then
|
|
||||||
echo "Root process (pause) can run docker-default, it's ok."
|
|
||||||
else
|
|
||||||
echo "$profile is the WRONG PROFILE!!"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
fi
|
|
|
@ -20,49 +20,3 @@ helm upgrade --install openstack-utility ./charts/openstack-utility --namespace=
|
||||||
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
||||||
cd "${OSH_INFRA_PATH}"
|
cd "${OSH_INFRA_PATH}"
|
||||||
./tools/deployment/common/wait-for-pods.sh $namespace
|
./tools/deployment/common/wait-for-pods.sh $namespace
|
||||||
|
|
||||||
#Validate Apparmor
|
|
||||||
ouc_pod=$(kubectl get pods --namespace=$namespace -o wide | grep openstack | awk '{print $1}')
|
|
||||||
expected_profile="docker-default (enforce)"
|
|
||||||
|
|
||||||
#Below can be used for multiple Processes.Grab the processes (numbered directories) from the /proc directory,
|
|
||||||
# and then sort them. Highest proc number indicates most recent process.
|
|
||||||
#unsorted_process_file="/tmp/unsorted_proc_list"
|
|
||||||
#sorted_process_file="/tmp/proc_list"
|
|
||||||
#kubectl -n $namespace exec $ouc_pod -- ls -1 /proc | grep -e "^[0-9]*$" > $unsorted_process_file
|
|
||||||
#sort --numeric-sort $unsorted_process_file > $sorted_process_file
|
|
||||||
|
|
||||||
# The last/latest process in the list will actually be the "ls" command above,
|
|
||||||
# which isn't running any more, so remove it.
|
|
||||||
#sed -i '$ d' $sorted_process_file
|
|
||||||
|
|
||||||
#while IFS='' read -r process || [[ -n "$process" ]]; do
|
|
||||||
#echo "Process ID: $process"
|
|
||||||
#proc_name=`kubectl -n $namespace exec $ouc_pod -- cat /proc/$process/status | grep "Name:" | awk -F' ' '{print $2}'`
|
|
||||||
#echo "Process Name: $proc_name"
|
|
||||||
# profile=`kubectl -n $namespace exec $ouc_pod -- cat /proc/1/attr/current`
|
|
||||||
# echo "Profile running: $profile"
|
|
||||||
# if test "$profile" != "$expected_profile"
|
|
||||||
# then
|
|
||||||
# if test "$proc_name" == "pause"
|
|
||||||
# then
|
|
||||||
# echo "Root process (pause) can run docker-default, it's ok."
|
|
||||||
# else
|
|
||||||
# echo "$profile is the WRONG PROFILE!!"
|
|
||||||
# return 1
|
|
||||||
# fi
|
|
||||||
# fi
|
|
||||||
#done < $sorted_process_file
|
|
||||||
|
|
||||||
profile=`kubectl -n $namespace exec $ouc_pod -- cat /proc/1/attr/current`
|
|
||||||
echo "Profile running: $profile"
|
|
||||||
if test "$profile" != "$expected_profile"
|
|
||||||
then
|
|
||||||
if test "$proc_name" == "pause"
|
|
||||||
then
|
|
||||||
echo "Root process (pause) can run docker-default, it's ok."
|
|
||||||
else
|
|
||||||
echo "$profile is the WRONG PROFILE!!"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
|
@ -19,19 +19,3 @@ helm upgrade --install postgresql-utility ./charts/postgresql-utility --namespac
|
||||||
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
: "${OSH_INFRA_PATH:="../openstack-helm-infra"}"
|
||||||
cd "${OSH_INFRA_PATH}"
|
cd "${OSH_INFRA_PATH}"
|
||||||
./tools/deployment/common/wait-for-pods.sh $namespace
|
./tools/deployment/common/wait-for-pods.sh $namespace
|
||||||
|
|
||||||
#Validate Apparmor
|
|
||||||
pos_pod=$(kubectl get pods --namespace=$namespace -o wide | grep postgresql | awk '{print $1}')
|
|
||||||
expected_profile="docker-default (enforce)"
|
|
||||||
profile=`kubectl -n $namespace exec $pos_pod -- cat /proc/1/attr/current`
|
|
||||||
echo "Profile running: $profile"
|
|
||||||
if test "$profile" != "$expected_profile"
|
|
||||||
then
|
|
||||||
if test "$proc_name" == "pause"
|
|
||||||
then
|
|
||||||
echo "Root process (pause) can run docker-default, it's ok."
|
|
||||||
else
|
|
||||||
echo "$profile is the WRONG PROFILE!!"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
fi
|
|
|
@ -51,6 +51,7 @@ function run_feature_tests() {
|
||||||
python -m unittest discover -s ${PLUGINS}/tests/utility/ceph -v
|
python -m unittest discover -s ${PLUGINS}/tests/utility/ceph -v
|
||||||
python -m unittest discover -s ${PLUGINS}/tests/utility/mysqlclient -v
|
python -m unittest discover -s ${PLUGINS}/tests/utility/mysqlclient -v
|
||||||
python -m unittest discover -s ${PLUGINS}/tests/utility/openstack -v
|
python -m unittest discover -s ${PLUGINS}/tests/utility/openstack -v
|
||||||
|
python -m unittest discover -s ${PLUGINS}/tests/utility/postgresql -v
|
||||||
}
|
}
|
||||||
|
|
||||||
function run_unit_tests() {
|
function run_unit_tests() {
|
||||||
|
|
Loading…
Reference in New Issue