Skip to content
This repository was archived by the owner on Jun 28, 2024. It is now read-only.

Commit ffa5ce0

Browse files
chavafgchavafg
authored
Merge pull request #977 from GabyCT/topic/k8scredentials
test: K8s test to distribute credentials using secrets
2 parents bdd397e + fb408cd commit ffa5ce0

8 files changed

Lines changed: 185 additions & 0 deletions

File tree

‎integration/kubernetes/k8s-credentials-secrets.bats‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Copyright (c) 2018 Intel Corporation
4+
#
5+
# SPDX-License-Identifier: Apache-2.0
6+
#
7+
8+
load "${BATS_TEST_DIRNAME}/../../.ci/lib.sh"
9+
10+
setup() {
11+
export KUBECONFIG=/etc/kubernetes/admin.conf
12+
if sudo -E kubectl get runtimeclass | grep kata; then
13+
pod_config_dir="${BATS_TEST_DIRNAME}/runtimeclass_workloads"
14+
else
15+
pod_config_dir="${BATS_TEST_DIRNAME}/untrusted_workloads"
16+
fi
17+
}
18+
19+
@test "Credentials using secrets" {
20+
secret_name="test-secret"
21+
pod_name="secret-test-pod"
22+
second_pod_name="secret-envars-test-pod"
23+
24+
# Create the secret
25+
sudo -E kubectl create -f "${pod_config_dir}/inject_secret.yaml"
26+
27+
# View information about the secret
28+
sudo -E kubectl get secret "${secret_name}" -o yaml | grep "type: Opaque"
29+
30+
# Create a pod that has access to the secret through a volume
31+
sudo -E kubectl create -f "${pod_config_dir}/pod-secret.yaml"
32+
33+
# Check pod creation
34+
sudo -E kubectl wait --for=condition=Ready pod "$pod_name"
35+
36+
# List the files
37+
cmd="ls /tmp/secret-volume"
38+
sudo -E kubectl exec $pod_name -- sh -c "$cmd" | grep -w "password"
39+
sudo -E kubectl exec $pod_name -- sh -c "$cmd" | grep -w "username"
40+
41+
# Create a pod that has access to the secret data through environment variables
42+
sudo -E kubectl create -f "${pod_config_dir}/pod-secret-env.yaml"
43+
44+
# Check pod creation
45+
sudo -E kubectl wait --for=condition=Ready pod "$second_pod_name"
46+
47+
# Display environment variables
48+
second_cmd="printenv"
49+
sudo -E kubectl exec $second_pod_name -- sh -c "$second_cmd" | grep -w "SECRET_USERNAME"
50+
sudo -E kubectl exec $second_pod_name -- sh -c "$second_cmd" | grep -w "SECRET_PASSWORD"
51+
}
52+
53+
teardown() {
54+
sudo -E kubectl delete pod "$pod_name" "$second_pod_name"
55+
sudo -E kubectl delete secret "$secret_name"
56+
}

‎integration/kubernetes/run_kubernetes_tests.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ pushd "$kubernetes_dir"
2727
bats nginx.bats
2828
bats k8s-uts+ipc-ns.bats
2929
bats k8s-env.bats
30+
bats k8s-credentials-secrets.bats
3031
bats k8s-pid-ns.bats
3132
bats k8s-cpu-ns.bats
3233
bats k8s-parallel.bats

‎integration/kubernetes/runtimeclass_workloads/inject_secret.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: test-secret
10+
data:
11+
username: bXktYXBw
12+
password: Mzk1MjgkdmRnN0pi

‎integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Pod
8+
metadata:
9+
name: secret-envars-test-pod
10+
spec:
11+
runtimeClassName: kata
12+
containers:
13+
- name: envars-test-container
14+
image: busybox
15+
command: ["/bin/sh", "-c", "tail -f /dev/null"]
16+
env:
17+
- name: SECRET_USERNAME
18+
valueFrom:
19+
secretKeyRef:
20+
name: test-secret
21+
key: username
22+
- name: SECRET_PASSWORD
23+
valueFrom:
24+
secretKeyRef:
25+
name: test-secret
26+
key: password

‎integration/kubernetes/runtimeclass_workloads/pod-secret.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Pod
8+
metadata:
9+
name: secret-test-pod
10+
spec:
11+
runtimeClassName: kata
12+
containers:
13+
- name: test-container
14+
image: busybox
15+
command: ["/bin/sh", "-c", "tail -f /dev/null"]
16+
volumeMounts:
17+
# name must match the volume name below
18+
- name: secret-volume
19+
mountPath: /tmp/secret-volume
20+
# The secret data is exposed to Containers in the Pod through a Volume.
21+
volumes:
22+
- name: secret-volume
23+
secret:
24+
secretName: test-secret

‎integration/kubernetes/untrusted_workloads/inject_secret.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: test-secret
10+
data:
11+
username: bXktYXBw
12+
password: Mzk1MjgkdmRnN0pi

‎integration/kubernetes/untrusted_workloads/pod-secret-env.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Pod
8+
metadata:
9+
name: secret-envars-test-pod
10+
annotations:
11+
io.kubernetes.cri-o.TrustedSandbox: "false"
12+
io.kubernetes.cri.untrusted-workload: "true"
13+
spec:
14+
containers:
15+
- name: envars-test-container
16+
image: busybox
17+
command: ["/bin/sh", "-c", "tail -f /dev/null"]
18+
env:
19+
- name: SECRET_USERNAME
20+
valueFrom:
21+
secretKeyRef:
22+
name: test-secret
23+
key: username
24+
- name: SECRET_PASSWORD
25+
valueFrom:
26+
secretKeyRef:
27+
name: test-secret
28+
key: password

‎integration/kubernetes/untrusted_workloads/pod-secret.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#
2+
# Copyright (c) 2018 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
apiVersion: v1
7+
kind: Pod
8+
metadata:
9+
name: secret-test-pod
10+
annotations:
11+
io.kubernetes.cri-o.TrustedSandbox: "false"
12+
io.kubernetes.cri.untrusted-workload: "true"
13+
spec:
14+
containers:
15+
- name: test-container
16+
image: busybox
17+
command: ["/bin/sh", "-c", "tail -f /dev/null"]
18+
volumeMounts:
19+
# name must match the volume name below
20+
- name: secret-volume
21+
mountPath: /tmp/secret-volume
22+
# The secret data is exposed to Containers in the Pod through a Volume.
23+
volumes:
24+
- name: secret-volume
25+
secret:
26+
secretName: test-secret

0 commit comments

Comments
 (0)