Allow privilege escalation #3342
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
size/L
| }) | ||
| }) | ||
|
|
||
| func createPodSecurityPolicty() *extensions.PodSecurityPolicy { |
| Expect(err).NotTo(HaveOccurred(), "updating ingress controller cluster role to use a pod security policy") | ||
| }) | ||
|
|
||
| It("should be running with a Pod Security Policy", func() { |
There was a problem hiding this comment.
Should we move most of the main logic in here instead of in the setup function?
aledbf
force-pushed
the
allowPrivilegeEscalation
branch
from
22a2aec
to
4c0b7e3
Compare
aledbf
force-pushed
the
allowPrivilegeEscalation
branch
from
4c0b7e3
to
caeba1c
Compare
| f.NewEchoDeployment() | ||
| }) | ||
|
|
||
| // running tests in parallel can update the cluster roles, which introduce a failure |
There was a problem hiding this comment.
I will add additional tags like [Serial] and run one test at the time, running ginkgo again
| It("should be running with a Pod Security Policy", func() { | ||
| f.WaitForNginxConfiguration( | ||
| func(cfg string) bool { | ||
| return strings.Contains(cfg, "server_tokens on") |
There was a problem hiding this comment.
does server_tokens matter? or is this here to make sure nginx configuration is generated? maybe send a request and assert 404 instead?
aledbf
force-pushed
the
allowPrivilegeEscalation
branch
2 times, most recently
from
8596141
to
69dfd98
Compare
|
@ElvinEfendi ready for review |
|
|
||
| role.Rules = append(role.Rules[:index], role.Rules[index+1:]...) | ||
| _, err = f.KubeClientSet.RbacV1().ClusterRoles().Update(role) | ||
| Expect(err).NotTo(HaveOccurred(), "updating ingress controller cluster role to use a pod security policy") |
There was a problem hiding this comment.
this should be ... to use without a pod security policy .., no?
| err = framework.UpdateDeployment(f.KubeClientSet, f.IngressController.Namespace, "nginx-ingress-controller", 1, | ||
| func(deployment *appsv1beta1.Deployment) error { | ||
| args := deployment.Spec.Template.Spec.Containers[0].Args | ||
| args = append(args, "--v=2") |
There was a problem hiding this comment.
Just to trigger an update to the deployment and make sure the new pod uses the PodSecurityPolicy
aledbf
force-pushed
the
allowPrivilegeEscalation
branch
from
69dfd98
to
09e2466
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aledbf, ElvinEfendi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Since the above it not true, the addition of EDIT: I see, its explained in the comment on the other PR, for ssl passthrough. #3225 (comment) |
replaces #3225