diff options
Diffstat (limited to 'test')
70 files changed, 6920 insertions, 0 deletions
diff --git a/test/README.md b/test/README.md new file mode 100644 index 000000000..1dd2e3c76 --- /dev/null +++ b/test/README.md @@ -0,0 +1,106 @@ +# CRIO Integration Tests + +Integration tests provide end-to-end testing of CRIO. + +Note that integration tests do **not** replace unit tests. + +As a rule of thumb, code should be tested thoroughly with unit tests. +Integration tests on the other hand are meant to test a specific feature end +to end. + +Integration tests are written in *bash* using the +[bats](https://github.com/sstephenson/bats) framework. + +## Running integration tests + +### Containerized tests + +The easiest way to run integration tests is with Docker: +``` +$ make integration +``` + +To run a single test bucket: +``` +$ make integration TESTFLAGS="runtimeversion.bats" +``` + +### On your host + +To run the integration tests on your host, you will first need to setup a development environment plus +[bats](https://github.com/sstephenson/bats#installing-bats-from-source) +For example: +``` +$ cd ~/go/src/github.com +$ git clone https://github.com/sstephenson/bats.git +$ cd bats +$ ./install.sh /usr/local +``` + +You will also need to install the [CNI](https://github.com/containernetworking/cni) plugins as +the the default pod test template runs without host networking: + +``` +$ go get github.com/containernetworking/cni +$ cd "$GOPATH/src/github.com/containernetworking/cni" +$ git checkout -q d4bbce1865270cd2d2be558d6a23e63d314fe769 +$ ./build.sh \ +$ mkdir -p /opt/cni/bin \ +$ cp bin/* /opt/cni/bin/ +``` + +Then you can run the tests on your host: +``` +$ sudo make localintegration +``` + +To run a single test bucket: +``` +$ make localintegration TESTFLAGS="runtimeversion.bats" +``` + +Or you can just run them directly using bats +``` +$ sudo bats test +``` + +#### Runtime selection +Tests on the host will run with `runc` as the default runtime. +However you can select other OCI compatible runtimes by setting +the `RUNTIME` environment variable. + +For example one could use the [Clear Containers](https://github.com/01org/cc-oci-runtime/wiki/Installation) +runtime instead of `runc`: + +``` +make localintegration RUNTIME=cc-oci-runtime +``` + +## Writing integration tests + +[Helper functions] +(https://github.com/kubernetes-incubator/crio/blob/master/test/helpers.bash) +are provided in order to facilitate writing tests. + +```sh +#!/usr/bin/env bats + +# This will load the helpers. +load helpers + +# setup is called at the beginning of every test. +function setup() { +} + +# teardown is called at the end of every test. +function teardown() { + cleanup_test +} + +@test "crioctl runtimeversion" { + start_crio + crioctl runtimeversion + [ "$status" -eq 0 ] +} + +``` diff --git a/test/apparmor.bats b/test/apparmor.bats new file mode 100644 index 000000000..e5c89bf0a --- /dev/null +++ b/test/apparmor.bats @@ -0,0 +1,164 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +# 1. test running with loading the default apparmor profile. +# test that we can run with the default apparmor profile which will not block touching a file in `.` +@test "load default apparmor profile and run a container with it" { + # this test requires apparmor, so skip this test if apparmor is not enabled. + enabled=$(is_apparmor_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since apparmor is not enabled." + fi + + start_crio + + sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname1": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor1.json + + run crioctl pod run --name apparmor1 --config "$TESTDIR"/apparmor1.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname1 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" touch test.txt + echo "$output" + [ "$status" -eq 0 ] + + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 2. test running with loading a specific apparmor profile as crio default apparmor profile. +# test that we can run with a specific apparmor profile which will block touching a file in `.` as crio default apparmor profile. +@test "load a specific apparmor profile as default apparmor and run a container with it" { + # this test requires apparmor, so skip this test if apparmor is not enabled. + enabled=$(is_apparmor_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since apparmor is not enabled." + fi + + load_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH" + start_crio "" "$APPARMOR_TEST_PROFILE_NAME" + + sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname2": "apparmor-test-deny-write"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor2.json + + run crioctl pod run --name apparmor2 --config "$TESTDIR"/apparmor2.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname2 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" touch test.txt + echo "$output" + [ "$status" -ne 0 ] + [[ "$output" =~ "Permission denied" ]] + + cleanup_ctrs + cleanup_pods + stop_crio + remove_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH" +} + +# 3. test running with loading a specific apparmor profile but not as crio default apparmor profile. +# test that we can run with a specific apparmor profile which will block touching a file in `.` +@test "load default apparmor profile and run a container with another apparmor profile" { + # this test requires apparmor, so skip this test if apparmor is not enabled. + enabled=$(is_apparmor_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since apparmor is not enabled." + fi + + load_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH" + start_crio + + sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname3": "apparmor-test-deny-write"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor3.json + + run crioctl pod run --name apparmor3 --config "$TESTDIR"/apparmor3.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname3 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" touch test.txt + echo "$output" + [ "$status" -ne 0 ] + [[ "$output" =~ "Permission denied" ]] + + cleanup_ctrs + cleanup_pods + stop_crio + remove_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH" +} + +# 4. test running with wrong apparmor profile name. +# test that we can will fail when running a ctr with rong apparmor profile name. +@test "run a container with wrong apparmor profile name" { + # this test requires apparmor, so skip this test if apparmor is not enabled. + enabled=$(is_apparmor_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since apparmor is not enabled." + fi + + start_crio + + sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname4": "not-exists"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor4.json + + run crioctl pod run --name apparmor4 --config "$TESTDIR"/apparmor4.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname4 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -ne 0 ] + [[ "$output" =~ "Creating container failed" ]] + + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 5. test running with default apparmor profile unloaded. +# test that we can will fail when running a ctr with rong apparmor profile name. +@test "run a container after unloading default apparmor profile" { + # this test requires apparmor, so skip this test if apparmor is not enabled. + enabled=$(is_apparmor_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since apparmor is not enabled." + fi + + start_crio + remove_apparmor_profile "$FAKE_CRIO_DEFAULT_PROFILE_PATH" + + sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname5": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor5.json + + run crioctl pod run --name apparmor5 --config "$TESTDIR"/apparmor5.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname5 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" touch test.txt + echo "$output" + [ "$status" -eq 0 ] + + + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/bin2img/bin2img.go b/test/bin2img/bin2img.go new file mode 100644 index 000000000..b75289458 --- /dev/null +++ b/test/bin2img/bin2img.go @@ -0,0 +1,226 @@ +package main + +import ( + "archive/tar" + "bytes" + "encoding/json" + "io" + "os" + "runtime" + + "github.com/containers/image/storage" + "github.com/containers/image/types" + sstorage "github.com/containers/storage" + "github.com/containers/storage/pkg/reexec" + digest "github.com/opencontainers/go-digest" + specs "github.com/opencontainers/image-spec/specs-go" + "github.com/opencontainers/image-spec/specs-go/v1" + "github.com/sirupsen/logrus" + "github.com/urfave/cli" +) + +func main() { + if reexec.Init() { + return + } + + app := cli.NewApp() + app.Name = "bin2img" + app.Usage = "barebones image builder" + app.Version = "0.0.1" + + app.Flags = []cli.Flag{ + cli.BoolFlag{ + Name: "debug", + Usage: "turn on debug logging", + }, + cli.StringFlag{ + Name: "root", + Usage: "graph root directory", + }, + cli.StringFlag{ + Name: "runroot", + Usage: "run root directory", + }, + cli.StringFlag{ + Name: "storage-driver", + Usage: "storage driver", + }, + cli.StringSliceFlag{ + Name: "storage-opt", + Usage: "storage option", + }, + cli.StringFlag{ + Name: "image-name", + Usage: "set image name", + Value: "kubernetes/pause", + }, + cli.StringFlag{ + Name: "source-binary", + Usage: "source binary", + Value: "../../pause/pause", + }, + cli.StringFlag{ + Name: "image-binary", + Usage: "image binary", + Value: "/pause", + }, + } + + app.Action = func(c *cli.Context) error { + debug := c.GlobalBool("debug") + rootDir := c.GlobalString("root") + runrootDir := c.GlobalString("runroot") + storageDriver := c.GlobalString("storage-driver") + storageOptions := c.GlobalStringSlice("storage-opt") + imageName := c.GlobalString("image-name") + sourceBinary := c.GlobalString("source-binary") + imageBinary := c.GlobalString("image-binary") + + if debug { + logrus.SetLevel(logrus.DebugLevel) + } else { + logrus.SetLevel(logrus.ErrorLevel) + } + if rootDir == "" && runrootDir != "" { + logrus.Errorf("must set --root and --runroot, or neither") + os.Exit(1) + } + if rootDir != "" && runrootDir == "" { + logrus.Errorf("must set --root and --runroot, or neither") + os.Exit(1) + } + storeOptions := sstorage.DefaultStoreOptions + if rootDir != "" && runrootDir != "" { + storeOptions.GraphDriverName = storageDriver + storeOptions.GraphDriverOptions = storageOptions + storeOptions.GraphRoot = rootDir + storeOptions.RunRoot = runrootDir + } + store, err := sstorage.GetStore(storeOptions) + if err != nil { + logrus.Errorf("error opening storage: %v", err) + os.Exit(1) + } + defer func() { + _, _ = store.Shutdown(false) + }() + + layerBuffer := &bytes.Buffer{} + binary, err := os.Open(sourceBinary) + if err != nil { + logrus.Errorf("error opening image binary: %v", err) + os.Exit(1) + } + binInfo, err := binary.Stat() + if err != nil { + logrus.Errorf("error statting image binary: %v", err) + os.Exit(1) + } + archive := tar.NewWriter(layerBuffer) + err = archive.WriteHeader(&tar.Header{ + Name: imageBinary, + Size: binInfo.Size(), + Mode: 0555, + ModTime: binInfo.ModTime(), + Typeflag: tar.TypeReg, + Uname: "root", + Gname: "root", + }) + if err != nil { + logrus.Errorf("error writing archive header: %v", err) + os.Exit(1) + } + _, err = io.Copy(archive, binary) + if err != nil { + logrus.Errorf("error archiving image binary: %v", err) + os.Exit(1) + } + archive.Close() + binary.Close() + layerInfo := types.BlobInfo{ + Digest: digest.Canonical.FromBytes(layerBuffer.Bytes()), + Size: int64(layerBuffer.Len()), + } + + ref, err := storage.Transport.ParseStoreReference(store, imageName) + if err != nil { + logrus.Errorf("error parsing image name: %v", err) + os.Exit(1) + } + img, err := ref.NewImageDestination(nil) + if err != nil { + logrus.Errorf("error preparing to write image: %v", err) + os.Exit(1) + } + defer img.Close() + layer, err := img.PutBlob(layerBuffer, layerInfo) + if err != nil { + logrus.Errorf("error preparing to write image: %v", err) + os.Exit(1) + } + config := &v1.Image{ + Architecture: runtime.GOARCH, + OS: runtime.GOOS, + Config: v1.ImageConfig{ + User: "root", + Entrypoint: []string{imageBinary}, + }, + RootFS: v1.RootFS{ + Type: "layers", + DiffIDs: []digest.Digest{ + layer.Digest, + }, + }, + } + cbytes, err := json.Marshal(config) + if err != nil { + logrus.Errorf("error encoding configuration: %v", err) + os.Exit(1) + } + configInfo := types.BlobInfo{ + Digest: digest.Canonical.FromBytes(cbytes), + Size: int64(len(cbytes)), + } + configInfo, err = img.PutBlob(bytes.NewBuffer(cbytes), configInfo) + if err != nil { + logrus.Errorf("error saving configuration: %v", err) + os.Exit(1) + } + manifest := &v1.Manifest{ + Versioned: specs.Versioned{ + SchemaVersion: 2, + }, + Config: v1.Descriptor{ + MediaType: v1.MediaTypeImageConfig, + Digest: configInfo.Digest, + Size: int64(len(cbytes)), + }, + Layers: []v1.Descriptor{{ + MediaType: v1.MediaTypeImageLayer, + Digest: layer.Digest, + Size: layer.Size, + }}, + } + mbytes, err := json.Marshal(manifest) + if err != nil { + logrus.Errorf("error encoding manifest: %v", err) + os.Exit(1) + } + err = img.PutManifest(mbytes) + if err != nil { + logrus.Errorf("error saving manifest: %v", err) + os.Exit(1) + } + err = img.Commit() + if err != nil { + logrus.Errorf("error committing image: %v", err) + os.Exit(1) + } + return nil + } + + if err := app.Run(os.Args); err != nil { + logrus.Fatal(err) + } +} diff --git a/test/cgroups.bats b/test/cgroups.bats new file mode 100644 index 000000000..cbe27be41 --- /dev/null +++ b/test/cgroups.bats @@ -0,0 +1,40 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "pids limit" { + if ! grep pids /proc/self/cgroup; then + skip "pids cgroup controller is not mounted" + fi + PIDS_LIMIT=1234 start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + pids_limit_config=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin); obj["command"] = ["/bin/sleep", "600"]; json.dump(obj, sys.stdout)') + echo "$pids_limit_config" > "$TESTDIR"/container_pids_limit.json + run crioctl ctr create --config "$TESTDIR"/container_pids_limit.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" cat /sys/fs/cgroup/pids/pids.max + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "1234" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/checkseccomp/checkseccomp.go b/test/checkseccomp/checkseccomp.go new file mode 100644 index 000000000..ec7ee1020 --- /dev/null +++ b/test/checkseccomp/checkseccomp.go @@ -0,0 +1,18 @@ +package main + +import ( + "os" + + "golang.org/x/sys/unix" +) + +func main() { + // Check if Seccomp is supported, via CONFIG_SECCOMP. + if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL { + // Make sure the kernel has CONFIG_SECCOMP_FILTER. + if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL { + os.Exit(0) + } + } + os.Exit(1) +} diff --git a/test/command.bats b/test/command.bats new file mode 100644 index 000000000..86e58f9db --- /dev/null +++ b/test/command.bats @@ -0,0 +1,12 @@ +#!/usr/bin/env bats + +load helpers + +@test "crio commands" { + run ${CRIO_BINARY} --config /dev/null config > /dev/null + echo "$output" + [ "$status" -eq 0 ] + run ${CRIO_BINARY} badoption > /dev/null + echo "$output" + [ "$status" -ne 0 ] +} diff --git a/test/copyimg/copyimg.go b/test/copyimg/copyimg.go new file mode 100644 index 000000000..f83f92766 --- /dev/null +++ b/test/copyimg/copyimg.go @@ -0,0 +1,202 @@ +package main + +import ( + "os" + + "github.com/containers/image/copy" + "github.com/containers/image/signature" + "github.com/containers/image/storage" + "github.com/containers/image/transports/alltransports" + "github.com/containers/image/types" + sstorage "github.com/containers/storage" + "github.com/containers/storage/pkg/reexec" + "github.com/sirupsen/logrus" + "github.com/urfave/cli" +) + +func main() { + if reexec.Init() { + return + } + + app := cli.NewApp() + app.Name = "copyimg" + app.Usage = "barebones image copier" + app.Version = "0.0.1" + + app.Flags = []cli.Flag{ + cli.BoolFlag{ + Name: "debug", + Usage: "turn on debug logging", + }, + cli.StringFlag{ + Name: "root", + Usage: "graph root directory", + }, + cli.StringFlag{ + Name: "runroot", + Usage: "run root directory", + }, + cli.StringFlag{ + Name: "storage-driver", + Usage: "storage driver", + }, + cli.StringSliceFlag{ + Name: "storage-opt", + Usage: "storage option", + }, + cli.StringFlag{ + Name: "signature-policy", + Usage: "signature policy", + }, + cli.StringFlag{ + Name: "image-name", + Usage: "set image name", + }, + cli.StringFlag{ + Name: "add-name", + Usage: "name to add to image", + }, + cli.StringFlag{ + Name: "import-from", + Usage: "import source", + }, + cli.StringFlag{ + Name: "export-to", + Usage: "export target", + }, + } + + app.Action = func(c *cli.Context) error { + var store sstorage.Store + var ref, importRef, exportRef types.ImageReference + var err error + + debug := c.GlobalBool("debug") + rootDir := c.GlobalString("root") + runrootDir := c.GlobalString("runroot") + storageDriver := c.GlobalString("storage-driver") + storageOptions := c.GlobalStringSlice("storage-opt") + signaturePolicy := c.GlobalString("signature-policy") + imageName := c.GlobalString("image-name") + addName := c.GlobalString("add-name") + importFrom := c.GlobalString("import-from") + exportTo := c.GlobalString("export-to") + + if debug { + logrus.SetLevel(logrus.DebugLevel) + } else { + logrus.SetLevel(logrus.ErrorLevel) + } + + if imageName != "" { + if rootDir == "" && runrootDir != "" { + logrus.Errorf("must set --root and --runroot, or neither") + os.Exit(1) + } + if rootDir != "" && runrootDir == "" { + logrus.Errorf("must set --root and --runroot, or neither") + os.Exit(1) + } + storeOptions := sstorage.DefaultStoreOptions + if rootDir != "" && runrootDir != "" { + storeOptions.GraphDriverName = storageDriver + storeOptions.GraphDriverOptions = storageOptions + storeOptions.GraphRoot = rootDir + storeOptions.RunRoot = runrootDir + } + store, err = sstorage.GetStore(storeOptions) + if err != nil { + logrus.Errorf("error opening storage: %v", err) + os.Exit(1) + } + defer func() { + _, _ = store.Shutdown(false) + }() + + storage.Transport.SetStore(store) + ref, err = storage.Transport.ParseStoreReference(store, imageName) + if err != nil { + logrus.Errorf("error parsing image name: %v", err) + os.Exit(1) + } + } + + systemContext := types.SystemContext{ + SignaturePolicyPath: signaturePolicy, + } + policy, err := signature.DefaultPolicy(&systemContext) + if err != nil { + logrus.Errorf("error loading signature policy: %v", err) + os.Exit(1) + } + policyContext, err := signature.NewPolicyContext(policy) + if err != nil { + logrus.Errorf("error loading signature policy: %v", err) + os.Exit(1) + } + defer func() { + _ = policyContext.Destroy() + }() + options := ©.Options{} + + if importFrom != "" { + importRef, err = alltransports.ParseImageName(importFrom) + if err != nil { + logrus.Errorf("error parsing image name %v: %v", importFrom, err) + os.Exit(1) + } + } + + if exportTo != "" { + exportRef, err = alltransports.ParseImageName(exportTo) + if err != nil { + logrus.Errorf("error parsing image name %v: %v", exportTo, err) + os.Exit(1) + } + } + + if imageName != "" { + if importFrom != "" { + err = copy.Image(policyContext, ref, importRef, options) + if err != nil { + logrus.Errorf("error importing %s: %v", importFrom, err) + os.Exit(1) + } + } + if addName != "" { + destImage, err1 := storage.Transport.GetStoreImage(store, ref) + if err1 != nil { + logrus.Errorf("error finding image: %v", err1) + os.Exit(1) + } + names := append(destImage.Names, imageName, addName) + err = store.SetNames(destImage.ID, names) + if err != nil { + logrus.Errorf("error adding name to %s: %v", imageName, err) + os.Exit(1) + } + } + if exportTo != "" { + err = copy.Image(policyContext, exportRef, ref, options) + if err != nil { + logrus.Errorf("error exporting %s: %v", exportTo, err) + os.Exit(1) + } + } + } else { + if importFrom != "" && exportTo != "" { + err = copy.Image(policyContext, exportRef, importRef, options) + if err != nil { + logrus.Errorf("error copying %s to %s: %v", importFrom, exportTo, err) + os.Exit(1) + } + } + } + return nil + } + + if err := app.Run(os.Args); err != nil { + logrus.Fatal(err) + } +} diff --git a/test/ctr.bats b/test/ctr.bats new file mode 100644 index 000000000..90f42b687 --- /dev/null +++ b/test/ctr.bats @@ -0,0 +1,873 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "ctr not found correct error message" { + start_crio + run crioctl ctr status --id randomid + echo "$output" + [ "$status" -eq 1 ] + [[ "$output" =~ "container with ID starting with randomid not found" ]] + + stop_crio +} + +@test "ctr termination reason Completed" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Reason: Completed" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr termination reason Error" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + errorconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["command"] = ["false"]; json.dump(obj, sys.stdout)') + echo "$errorconfig" > "$TESTDIR"/container_config_error.json + run crioctl ctr create --config "$TESTDIR"/container_config_error.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Reason: Error" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr remove" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr lifecycle" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr logging" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + + # Create a new container. + newconfig=$(mktemp --tmpdir crio-config.XXXXXX.json) + cp "$TESTDATA"/container_config_logging.json "$newconfig" + sed -i 's|"%shellcommand%"|"echo here is some output \&\& echo and some from stderr >\&2"|' "$newconfig" + run crioctl ctr create --config "$newconfig" --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + # Ignore errors on stop. + run crioctl ctr status --id "$ctr_id" + [ "$status" -eq 0 ] + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + # Check that the output is what we expect. + logpath="$DEFAULT_LOG_PATH/$pod_id/$ctr_id.log" + [ -f "$logpath" ] + echo "$logpath :: $(cat "$logpath")" + grep -E "^[^\n]+ stdout here is some output$" "$logpath" + grep -E "^[^\n]+ stderr and some from stderr$" "$logpath" + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr logging [tty=true]" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + + # Create a new container. + newconfig=$(mktemp --tmpdir crio-config.XXXXXX.json) + cp "$TESTDATA"/container_config_logging.json "$newconfig" + sed -i 's|"%shellcommand%"|"echo here is some output"|' "$newconfig" + sed -i 's|"tty": false,|"tty": true,|' "$newconfig" + run crioctl ctr create --config "$newconfig" --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + # Ignore errors on stop. + run crioctl ctr status --id "$ctr_id" + [ "$status" -eq 0 ] + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + # Check that the output is what we expect. + logpath="$DEFAULT_LOG_PATH/$pod_id/$ctr_id.log" + [ -f "$logpath" ] + echo "$logpath :: $(cat "$logpath")" + grep --binary -P "^[^\n]+ stdout here is some output\x0d$" "$logpath" + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr log max" { + LOG_SIZE_MAX_LIMIT=10000 start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + + # Create a new container. + newconfig=$(mktemp --tmpdir crio-config.XXXXXX.json) + cp "$TESTDATA"/container_config_logging.json "$newconfig" + sed -i 's|"%shellcommand%"|"for i in $(seq 250); do echo $i; done"|' "$newconfig" + run crioctl ctr create --config "$newconfig" --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + sleep 6 + run crioctl ctr status --id "$ctr_id" + [ "$status" -eq 0 ] + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + # Check that the output is what we expect. + logpath="$DEFAULT_LOG_PATH/$pod_id/$ctr_id.log" + [ -f "$logpath" ] + echo "$logpath :: $(cat "$logpath")" + len=$(wc -l "$logpath" | awk '{print $1}') + [ $len -lt 250 ] + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# regression test for #127 +@test "ctrs status for a pod" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr list --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" != "" ]] + + printf '%s\n' "$output" | while IFS= read -r id + do + run crioctl ctr status --id "$id" + echo "$output" + [ "$status" -eq 0 ] + done + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr list filtering" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json --name pod1 + echo "$output" + [ "$status" -eq 0 ] + pod1_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + ctr1_id="$output" + run crioctl ctr start --id "$ctr1_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod run --config "$TESTDATA"/sandbox_config.json --name pod2 + echo "$output" + [ "$status" -eq 0 ] + pod2_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + ctr2_id="$output" + run crioctl pod run --config "$TESTDATA"/sandbox_config.json --name pod3 + echo "$output" + [ "$status" -eq 0 ] + pod3_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + ctr3_id="$output" + run crioctl ctr start --id "$ctr3_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr3_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr list --id "$ctr1_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + run crioctl ctr list --id "${ctr1_id:0:4}" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + run crioctl ctr list --id "$ctr2_id" --pod "$pod2_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr2_id" ]] + run crioctl ctr list --id "$ctr2_id" --pod "$pod3_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == "" ]] + run crioctl ctr list --state created --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr2_id" ]] + run crioctl ctr list --state running --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + run crioctl ctr list --state stopped --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr3_id" ]] + run crioctl ctr list --pod "$pod1_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + run crioctl ctr list --pod "$pod2_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr2_id" ]] + run crioctl ctr list --pod "$pod3_id" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr3_id" ]] + run crioctl pod stop --id "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr list label filtering" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" --name ctr1 --label "a=b" --label "c=d" --label "e=f" + echo "$output" + [ "$status" -eq 0 ] + ctr1_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" --name ctr2 --label "a=b" --label "c=d" + echo "$output" + [ "$status" -eq 0 ] + ctr2_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" --name ctr3 --label "a=b" + echo "$output" + [ "$status" -eq 0 ] + ctr3_id="$output" + run crioctl ctr list --label "tier=backend" --label "a=b" --label "c=d" --label "e=f" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + run crioctl ctr list --label "tier=frontend" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == "" ]] + run crioctl ctr list --label "a=b" --label "c=d" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + [[ "$output" =~ "$ctr2_id" ]] + run crioctl ctr list --label "a=b" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$ctr1_id" ]] + [[ "$output" =~ "$ctr2_id" ]] + [[ "$output" =~ "$ctr3_id" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr metadata in list & status" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr list --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + # TODO: expected value should not hard coded here + [[ "$output" =~ "Name: container1" ]] + [[ "$output" =~ "Attempt: 1" ]] + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + # TODO: expected value should not hard coded here + [[ "$output" =~ "Name: container1" ]] + [[ "$output" =~ "Attempt: 1" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr execsync conflicting with conmon flags parsing" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" sh -c "echo hello world" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "hello world" ]] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr execsync" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" echo HELLO + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "HELLO" ]] + run crioctl ctr execsync --id "$ctr_id" --timeout 1 sleep 10 + echo "$output" + [[ "$output" =~ "command timed out" ]] + [ "$status" -ne 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr device add" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis_device.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" ls /dev/mynull + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "/dev/mynull" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr execsync failure" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" doesnotexist + echo "$output" + [ "$status" -ne 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr execsync exit code" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" false + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr execsync std{out,err}" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" echo hello0 stdout + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == *"$(printf "Stdout:\nhello0 stdout")"* ]] + + stderrconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["image"]["image"] = "runcom/stderr-test"; obj["command"] = ["/bin/sleep", "600"]; json.dump(obj, sys.stdout)') + echo "$stderrconfig" > "$TESTDIR"/container_config_stderr.json + run crioctl ctr create --config "$TESTDIR"/container_config_stderr.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" stderr + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == *"$(printf "Stderr:\nthis goes to stderr")"* ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr stop idempotent" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr caps drop" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + capsconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["linux"]["security_context"]["capabilities"] = {u"add_capabilities": [], u"drop_capabilities": [u"mknod", u"kill", u"sys_chroot", u"setuid", u"setgid"]}; json.dump(obj, sys.stdout)') + echo "$capsconfig" > "$TESTDIR"/container_config_caps.json + run crioctl ctr create --config "$TESTDIR"/container_config_caps.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "run ctr with image with Config.Volumes" { + start_crio + run crioctl image pull gcr.io/k8s-testimages/redis:e2e + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + volumesconfig=$(cat "$TESTDATA"/container_redis.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["image"]["image"] = "gcr.io/k8s-testimages/redis:e2e"; obj["args"] = []; json.dump(obj, sys.stdout)') + echo "$volumesconfig" > "$TESTDIR"/container_config_volumes.json + run crioctl ctr create --config "$TESTDIR"/container_config_volumes.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr oom" { + if [[ "$TRAVIS" == "true" ]]; then + skip "travis container tests don't support testing OOM" + fi + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + oomconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["image"]["image"] = "mrunalp/oom"; obj["linux"]["resources"]["memory_limit_in_bytes"] = 5120000; obj["command"] = ["/oom"]; json.dump(obj, sys.stdout)') + echo "$oomconfig" > "$TESTDIR"/container_config_oom.json + run crioctl ctr create --config "$TESTDIR"/container_config_oom.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + # Wait for container to OOM + attempt=0 + while [ $attempt -le 100 ]; do + attempt=$((attempt+1)) + run crioctl ctr status --id "$ctr_id" + echo "$output" + if [[ "$output" =~ "OOMKilled" ]]; then + break + fi + sleep 10 + done + [[ "$output" =~ "OOMKilled" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr /etc/resolv.conf rw/ro mode" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config_resolvconf.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Status: CONTAINER_EXITED" ]] + [[ "$output" =~ "Exit Code: 0" ]] + [[ "$output" =~ "Reason: Completed" ]] + + run crioctl ctr create --name roctr --config "$TESTDATA"/container_config_resolvconf_ro.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Status: CONTAINER_EXITED" ]] + [[ "$output" =~ "Exit Code: 1" ]] + [[ "$output" =~ "Reason: Error" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr create with non-existent command" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + newconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["command"] = ["nonexistent"]; json.dump(obj, sys.stdout)') + echo "$newconfig" > "$TESTDIR"/container_nonexistent.json + run crioctl ctr create --config "$TESTDIR"/container_nonexistent.json --pod "$pod_id" + [ "$status" -ne 0 ] + [[ "$output" =~ "executable file not found" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr create with non-existent command [tty]" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + newconfig=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["command"] = ["nonexistent"]; obj["tty"] = True; json.dump(obj, sys.stdout)') + echo "$newconfig" > "$TESTDIR"/container_nonexistent.json + run crioctl ctr create --config "$TESTDIR"/container_nonexistent.json --pod "$pod_id" + [ "$status" -ne 0 ] + [[ "$output" =~ "executable file not found" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/default_mounts.bats b/test/default_mounts.bats new file mode 100644 index 000000000..8e727085e --- /dev/null +++ b/test/default_mounts.bats @@ -0,0 +1,69 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "bind secrets mounts to container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" cat /proc/mounts + echo "$output" + [ "$status" -eq 0 ] + mount_info="$output" + run grep /container/path1 <<< "$mount_info" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "default mounts correctly sorted with other mounts" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + host_path="$TESTDIR"/clash + mkdir "$host_path" + echo "clashing..." > "$host_path"/clashing.txt + sed -e "s,%HPATH%,$host_path,g" "$TESTDATA"/container_redis_default_mounts.json > "$TESTDIR"/defmounts_pre.json + sed -e 's,%CPATH%,\/container\/path1\/clash,g' "$TESTDIR"/defmounts_pre.json > "$TESTDIR"/defmounts.json + run crioctl ctr create --config "$TESTDIR"/defmounts.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr execsync --id "$ctr_id" ls -la /container/path1/clash + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" cat /container/path1/clash/clashing.txt + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "clashing..." ]] + run crioctl ctr execsync --id "$ctr_id" ls -la /container/path1 + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" cat /container/path1/test.txt + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Testing secrets mounts!" ]] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/helpers.bash b/test/helpers.bash new file mode 100644 index 000000000..22955d333 --- /dev/null +++ b/test/helpers.bash @@ -0,0 +1,493 @@ +#!/bin/bash + +# Root directory of integration tests. +INTEGRATION_ROOT=$(dirname "$(readlink -f "$BASH_SOURCE")") + +# Test data path. +TESTDATA="${INTEGRATION_ROOT}/testdata" + +# Root directory of the repository. +CRIO_ROOT=${CRIO_ROOT:-$(cd "$INTEGRATION_ROOT/../.."; pwd -P)} + +# Path of the crio binary. +CRIO_BINARY=${CRIO_BINARY:-${CRIO_ROOT}/cri-o/bin/crio} +# Path of the crictl binary. +CRICTL_PATH=$(command -v crictl || true) +CRICTL_BINARY=${CRICTL_PATH:-/usr/bin/crictl} +# Path to kpod binary. +KPOD_BINARY=${KPOD_BINARY:-${CRIO_ROOT}/cri-o/bin/kpod} +# Path of the conmon binary. +CONMON_BINARY=${CONMON_BINARY:-${CRIO_ROOT}/cri-o/bin/conmon} +# Path of the pause binary. +PAUSE_BINARY=${PAUSE_BINARY:-${CRIO_ROOT}/cri-o/bin/pause} +# Path of the default seccomp profile. +SECCOMP_PROFILE=${SECCOMP_PROFILE:-${CRIO_ROOT}/cri-o/seccomp.json} +# Name of the default apparmor profile. +APPARMOR_PROFILE=${APPARMOR_PROFILE:-crio-default} +# Runtime +RUNTIME=${RUNTIME:-runc} +RUNTIME_PATH=$(command -v $RUNTIME || true) +RUNTIME_BINARY=${RUNTIME_PATH:-/usr/local/sbin/runc} +# Path of the apparmor_parser binary. +APPARMOR_PARSER_BINARY=${APPARMOR_PARSER_BINARY:-/sbin/apparmor_parser} +# Path of the apparmor profile for test. +APPARMOR_TEST_PROFILE_PATH=${APPARMOR_TEST_PROFILE_PATH:-${TESTDATA}/apparmor_test_deny_write} +# Path of the apparmor profile for unloading crio-default. +FAKE_CRIO_DEFAULT_PROFILE_PATH=${FAKE_CRIO_DEFAULT_PROFILE_PATH:-${TESTDATA}/fake_crio_default} +# Name of the apparmor profile for test. +APPARMOR_TEST_PROFILE_NAME=${APPARMOR_TEST_PROFILE_NAME:-apparmor-test-deny-write} +# Path of boot config. +BOOT_CONFIG_FILE_PATH=${BOOT_CONFIG_FILE_PATH:-/boot/config-`uname -r`} +# Path of apparmor parameters file. +APPARMOR_PARAMETERS_FILE_PATH=${APPARMOR_PARAMETERS_FILE_PATH:-/sys/module/apparmor/parameters/enabled} +# Path of the bin2img binary. +BIN2IMG_BINARY=${BIN2IMG_BINARY:-${CRIO_ROOT}/cri-o/test/bin2img/bin2img} +# Path of the copyimg binary. +COPYIMG_BINARY=${COPYIMG_BINARY:-${CRIO_ROOT}/cri-o/test/copyimg/copyimg} +# Path of tests artifacts. +ARTIFACTS_PATH=${ARTIFACTS_PATH:-${CRIO_ROOT}/cri-o/.artifacts} +# Path of the checkseccomp binary. +CHECKSECCOMP_BINARY=${CHECKSECCOMP_BINARY:-${CRIO_ROOT}/cri-o/test/checkseccomp/checkseccomp} +# XXX: This is hardcoded inside cri-o at the moment. +DEFAULT_LOG_PATH=/var/log/crio/pods +# Cgroup manager to be used +CGROUP_MANAGER=${CGROUP_MANAGER:-cgroupfs} +# Image volumes handling +IMAGE_VOLUMES=${IMAGE_VOLUMES:-mkdir} +# Container pids limit +PIDS_LIMIT=${PIDS_LIMIT:-1024} +# Log size max limit +LOG_SIZE_MAX_LIMIT=${LOG_SIZE_MAX_LIMIT:--1} + +TESTDIR=$(mktemp -d) + +# kpod pull needs a configuration file for shortname pulls +export REGISTRIES_CONFIG_PATH="$INTEGRATION_ROOT/registries.conf" + +# Setup default hooks dir +HOOKSDIR=$TESTDIR/hooks +mkdir ${HOOKSDIR} +HOOKS_OPTS="--hooks-dir-path=$HOOKSDIR" + +# Setup default secrets mounts +MOUNT_PATH="$TESTDIR/secrets" +mkdir ${MOUNT_PATH} +MOUNT_FILE="${MOUNT_PATH}/test.txt" +touch ${MOUNT_FILE} +echo "Testing secrets mounts!" > ${MOUNT_FILE} + +DEFAULT_MOUNTS_OPTS="--default-mounts=${MOUNT_PATH}:/container/path1" + +# We may need to set some default storage options. +case "$(stat -f -c %T ${TESTDIR})" in + aufs) + # None of device mapper, overlay, or aufs can be used dependably over aufs, and of course btrfs and zfs can't, + # and we have to explicitly specify the "vfs" driver in order to use it, so do that now. + STORAGE_OPTIONS=${STORAGE_OPTIONS:---storage-driver vfs} + ;; +esac + +if [ -e /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then + . /etc/selinux/config + filelabel=$(awk -F'"' '/^file.*=.*/ {print $2}' /etc/selinux/${SELINUXTYPE}/contexts/lxc_contexts) + chcon -R ${filelabel} $TESTDIR +fi +CRIO_SOCKET="$TESTDIR/crio.sock" +CRIO_CONFIG="$TESTDIR/crio.conf" +CRIO_CNI_CONFIG="$TESTDIR/cni/net.d/" +CRIO_CNI_PLUGIN=${CRIO_CNI_PLUGIN:-/opt/cni/bin/} +POD_CIDR="10.88.0.0/16" +POD_CIDR_MASK="10.88.*.*" + +KPOD_OPTIONS="--root $TESTDIR/crio $STORAGE_OPTIONS --runroot $TESTDIR/crio-run --runtime ${RUNTIME_BINARY}" + +cp "$CONMON_BINARY" "$TESTDIR/conmon" + +PATH=$PATH:$TESTDIR + +# Make sure we have a copy of the redis:alpine image. +if ! [ -d "$ARTIFACTS_PATH"/redis-image ]; then + mkdir -p "$ARTIFACTS_PATH"/redis-image + if ! "$COPYIMG_BINARY" --import-from=docker://redis:alpine --export-to=dir:"$ARTIFACTS_PATH"/redis-image --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://redis" + rm -fr "$ARTIFACTS_PATH"/redis-image + exit 1 + fi +fi + +# TODO: remove the code below for pulling redis:alpine using a canonical reference once +# https://github.com/kubernetes-incubator/cri-o/issues/531 is complete and we can +# pull the image using a tagged reference and then subsequently find the image without +# having to explicitly record the canonical reference as one of the image's names +if ! [ -d "$ARTIFACTS_PATH"/redis-image-digest ]; then + mkdir -p "$ARTIFACTS_PATH"/redis-image-digest + if ! "$COPYIMG_BINARY" --import-from=docker://redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b --export-to=dir:"$ARTIFACTS_PATH"/redis-image-digest --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b" + rm -fr "$ARTIFACTS_PATH"/redis-image-digest + exit 1 + fi +fi + +# Make sure we have a copy of the runcom/stderr-test image. +if ! [ -d "$ARTIFACTS_PATH"/stderr-test ]; then + mkdir -p "$ARTIFACTS_PATH"/stderr-test + if ! "$COPYIMG_BINARY" --import-from=docker://runcom/stderr-test:latest --export-to=dir:"$ARTIFACTS_PATH"/stderr-test --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://stderr-test" + rm -fr "$ARTIFACTS_PATH"/stderr-test + exit 1 + fi +fi + +# Make sure we have a copy of the busybox:latest image. +if ! [ -d "$ARTIFACTS_PATH"/busybox-image ]; then + mkdir -p "$ARTIFACTS_PATH"/busybox-image + if ! "$COPYIMG_BINARY" --import-from=docker://busybox --export-to=dir:"$ARTIFACTS_PATH"/busybox-image --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://busybox" + rm -fr "$ARTIFACTS_PATH"/busybox-image + exit 1 + fi +fi + +# Make sure we have a copy of the mrunalp/oom:latest image. +if ! [ -d "$ARTIFACTS_PATH"/oom-image ]; then + mkdir -p "$ARTIFACTS_PATH"/oom-image + if ! "$COPYIMG_BINARY" --import-from=docker://mrunalp/oom --export-to=dir:"$ARTIFACTS_PATH"/oom-image --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://mrunalp/oom" + rm -fr "$ARTIFACTS_PATH"/oom-image + exit 1 + fi +fi + +# Make sure we have a copy of the mrunalp/image-volume-test:latest image. +if ! [ -d "$ARTIFACTS_PATH"/image-volume-test-image ]; then + mkdir -p "$ARTIFACTS_PATH"/image-volume-test-image + if ! "$COPYIMG_BINARY" --import-from=docker://mrunalp/image-volume-test --export-to=dir:"$ARTIFACTS_PATH"/image-volume-test-image --signature-policy="$INTEGRATION_ROOT"/policy.json ; then + echo "Error pulling docker://mrunalp/image-volume-test-image" + rm -fr "$ARTIFACTS_PATH"/image-volume-test-image + exit 1 + fi +fi +# Run crio using the binary specified by $CRIO_BINARY. +# This must ONLY be run on engines created with `start_crio`. +function crio() { + "$CRIO_BINARY" --listen "$CRIO_SOCKET" "$@" +} + +# DEPRECATED +OCIC_BINARY=${OCIC_BINARY:-${CRIO_ROOT}/cri-o/bin/crioctl} +# Run crioctl using the binary specified by $OCIC_BINARY. +function crioctl() { + "$OCIC_BINARY" --connect "$CRIO_SOCKET" "$@" +} + +# Run crictl using the binary specified by $CRICTL_BINARY. +function crictl() { + "$CRICTL_BINARY" -r "$CRIO_SOCKET" -i "$CRIO_SOCKET" "$@" +} + +# Communicate with Docker on the host machine. +# Should rarely use this. +function docker_host() { + command docker "$@" +} + +# Retry a command $1 times until it succeeds. Wait $2 seconds between retries. +function retry() { + local attempts=$1 + shift + local delay=$1 + shift + local i + + for ((i=0; i < attempts; i++)); do + run "$@" + if [[ "$status" -eq 0 ]] ; then + return 0 + fi + sleep $delay + done + + echo "Command \"$@\" failed $attempts times. Output: $output" + false +} + +# Waits until the given crio becomes reachable. +function wait_until_reachable() { + retry 15 1 crictl status +} + +# Start crio. +function start_crio() { + if [[ -n "$1" ]]; then + seccomp="$1" + else + seccomp="$SECCOMP_PROFILE" + fi + + if [[ -n "$2" ]]; then + apparmor="$2" + else + apparmor="$APPARMOR_PROFILE" + fi + + # Don't forget: bin2img, copyimg, and crio have their own default drivers, so if you override any, you probably need to override them all + if ! [ "$3" = "--no-pause-image" ] ; then + "$BIN2IMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --source-binary "$PAUSE_BINARY" + fi + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=docker.io/library/redis:alpine --import-from=dir:"$ARTIFACTS_PATH"/redis-image --signature-policy="$INTEGRATION_ROOT"/policy.json +# TODO: remove the code below for copying redis:alpine in using a canonical reference once +# https://github.com/kubernetes-incubator/cri-o/issues/531 is complete and we can +# copy the image using a tagged reference and then subsequently find the image without +# having to explicitly record the canonical reference as one of the image's names + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=docker.io/library/redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b --import-from=dir:"$ARTIFACTS_PATH"/redis-image-digest --signature-policy="$INTEGRATION_ROOT"/policy.json + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=mrunalp/oom --import-from=dir:"$ARTIFACTS_PATH"/oom-image --signature-policy="$INTEGRATION_ROOT"/policy.json + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=docker.io/library/mrunalp/image-volume-test --import-from=dir:"$ARTIFACTS_PATH"/image-volume-test-image --signature-policy="$INTEGRATION_ROOT"/policy.json + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=docker.io/library/busybox:latest --import-from=dir:"$ARTIFACTS_PATH"/busybox-image --signature-policy="$INTEGRATION_ROOT"/policy.json + "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name=docker.io/library/runcom/stderr-test:latest --import-from=dir:"$ARTIFACTS_PATH"/stderr-test --signature-policy="$INTEGRATION_ROOT"/policy.json + "$CRIO_BINARY" ${DEFAULT_MOUNTS_OPTS} ${HOOKS_OPTS} --conmon "$CONMON_BINARY" --listen "$CRIO_SOCKET" --cgroup-manager "$CGROUP_MANAGER" --registry "docker.io" --runtime "$RUNTIME_BINARY" --root "$TESTDIR/crio" --runroot "$TESTDIR/crio-run" $STORAGE_OPTIONS --seccomp-profile "$seccomp" --apparmor-profile "$apparmor" --cni-config-dir "$CRIO_CNI_CONFIG" --cni-plugin-dir "$CRIO_CNI_PLUGIN" --signature-policy "$INTEGRATION_ROOT"/policy.json --image-volumes "$IMAGE_VOLUMES" --pids-limit "$PIDS_LIMIT" --log-size-max "$LOG_SIZE_MAX_LIMIT" --config /dev/null config >$CRIO_CONFIG + + # Prepare the CNI configuration files, we're running with non host networking by default + if [[ -n "$4" ]]; then + netfunc="$4" + else + netfunc="prepare_network_conf" + fi + ${netfunc} $POD_CIDR + + "$CRIO_BINARY" --log-level debug --config "$CRIO_CONFIG" & CRIO_PID=$! + wait_until_reachable + + run crictl inspecti redis:alpine + if [ "$status" -ne 0 ] ; then + crictl pull redis:alpine + fi + REDIS_IMAGEID=$(crictl inspecti redis:alpine | head -1 | sed -e "s/ID: //g") + run crictl inspecti redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b + if [ "$status" -ne 0 ] ; then + crictl pull redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b + fi + REDIS_IMAGEID_DIGESTED=$(crictl inspecti redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b | head -1 | sed -e "s/ID: //g") + run crictl inspecti mrunalp/oom + if [ "$status" -ne 0 ] ; then + crictl pull mrunalp/oom + fi + OOM_IMAGEID=$(crictl inspecti mrunalp/oom | head -1 | sed -e "s/ID: //g") + run crioctl image status --id=runcom/stderr-test + if [ "$status" -ne 0 ] ; then + crictl pull runcom/stderr-test:latest + fi + STDERR_IMAGEID=$(crictl inspecti runcom/stderr-test | head -1 | sed -e "s/ID: //g") + run crictl inspecti busybox + if [ "$status" -ne 0 ] ; then + crictl pull busybox:latest + fi + BUSYBOX_IMAGEID=$(crictl inspecti busybox | head -1 | sed -e "s/ID: //g") + run crictl inspecti mrunalp/image-volume-test + if [ "$status" -ne 0 ] ; then + crictl pull mrunalp/image-volume-test:latest + fi + VOLUME_IMAGEID=$(crictl inspecti mrunalp/image-volume-test | head -1 | sed -e "s/ID: //g") +} + +function cleanup_ctrs() { + run crictl ps --quiet + if [ "$status" -eq 0 ]; then + if [ "$output" != "" ]; then + printf '%s\n' "$output" | while IFS= read -r line + do + crictl stop "$line" + crictl rm "$line" + done + fi + fi + rm -f /run/hookscheck +} + +function cleanup_images() { + run crictl images --quiet + if [ "$status" -eq 0 ]; then + if [ "$output" != "" ]; then + printf '%s\n' "$output" | while IFS= read -r line + do + crictl rmi "$line" + done + fi + fi +} + +function cleanup_pods() { + run crictl sandboxes --quiet + if [ "$status" -eq 0 ]; then + if [ "$output" != "" ]; then + printf '%s\n' "$output" | while IFS= read -r line + do + crictl stops "$line" + crictl rms "$line" + done + fi + fi +} + +# Stop crio. +function stop_crio() { + if [ "$CRIO_PID" != "" ]; then + kill "$CRIO_PID" >/dev/null 2>&1 + wait "$CRIO_PID" + rm -f "$CRIO_CONFIG" + fi + + cleanup_network_conf +} + +function restart_crio() { + if [ "$CRIO_PID" != "" ]; then + kill "$CRIO_PID" >/dev/null 2>&1 + wait "$CRIO_PID" + start_crio + else + echo "you must start crio first" + exit 1 + fi +} + +function cleanup_test() { + rm -rf "$TESTDIR" +} + + +function load_apparmor_profile() { + "$APPARMOR_PARSER_BINARY" -r "$1" +} + +function remove_apparmor_profile() { + "$APPARMOR_PARSER_BINARY" -R "$1" +} + +function is_seccomp_enabled() { + if ! "$CHECKSECCOMP_BINARY" ; then + echo 0 + return + fi + echo 1 +} + +function is_apparmor_enabled() { + if [[ -f "$APPARMOR_PARAMETERS_FILE_PATH" ]]; then + out=$(cat "$APPARMOR_PARAMETERS_FILE_PATH") + if [[ "$out" =~ "Y" ]]; then + echo 1 + return + fi + fi + echo 0 +} + +function prepare_network_conf() { + mkdir -p $CRIO_CNI_CONFIG + cat >$CRIO_CNI_CONFIG/10-crio.conf <<-EOF +{ + "cniVersion": "0.2.0", + "name": "crionet", + "type": "bridge", + "bridge": "cni0", + "isGateway": true, + "ipMasq": true, + "ipam": { + "type": "host-local", + "subnet": "$1", + "routes": [ + { "dst": "0.0.0.0/0" } + ] + } +} +EOF + + cat >$CRIO_CNI_CONFIG/99-loopback.conf <<-EOF +{ + "cniVersion": "0.2.0", + "type": "loopback" +} +EOF + + echo 0 +} + +function prepare_plugin_test_args_network_conf() { + mkdir -p $CRIO_CNI_CONFIG + cat >$CRIO_CNI_CONFIG/10-plugin-test-args.conf <<-EOF +{ + "cniVersion": "0.2.0", + "name": "crionet_test_args", + "type": "bridge-custom", + "bridge": "cni0", + "isGateway": true, + "ipMasq": true, + "ipam": { + "type": "host-local", + "subnet": "$1", + "routes": [ + { "dst": "0.0.0.0/0" } + ] + } +} +EOF + + echo 0 +} + +function check_pod_cidr() { + run crioctl ctr execsync --id $1 ip addr show dev eth0 scope global 2>&1 + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ $POD_CIDR_MASK ]] +} + +function parse_pod_ip() { + for arg + do + cidr=`echo "$arg" | grep $POD_CIDR_MASK` + if [ "$cidr" == "$arg" ] + then + echo `echo "$arg" | sed "s/\/[0-9][0-9]//"` + fi + done +} + +function get_host_ip() { + gateway_dev=`ip -o route show default 0.0.0.0/0 | sed 's/.*dev \([^[:space:]]*\).*/\1/'` + [ "$gateway_dev" ] + host_ip=`ip -o -4 addr show dev $gateway_dev scope global | sed 's/.*inet \([0-9.]*\).*/\1/'` +} + +function ping_pod() { + inet=`crioctl ctr execsync --id $1 ip addr show dev eth0 scope global 2>&1 | grep inet` + + IFS=" " + ip=`parse_pod_ip $inet` + + ping -W 1 -c 5 $ip + + echo $? +} + +function ping_pod_from_pod() { + inet=`crioctl ctr execsync --id $1 ip addr show dev eth0 scope global 2>&1 | grep inet` + + IFS=" " + ip=`parse_pod_ip $inet` + + run crioctl ctr execsync --id $2 ping -W 1 -c 2 $ip + echo "$output" + [ "$status" -eq 0 ] +} + + +function cleanup_network_conf() { + rm -rf $CRIO_CNI_CONFIG + + echo 0 +} + +function temp_sandbox_conf() { + sed -e s/\"namespace\":.*/\"namespace\":\ \"$1\",/g "$TESTDATA"/sandbox_config.json > $TESTDIR/sandbox_config_$1.json +} diff --git a/test/hooks.bats b/test/hooks.bats new file mode 100644 index 000000000..92aa725fc --- /dev/null +++ b/test/hooks.bats @@ -0,0 +1,38 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +cp hooks/checkhook.sh ${HOOKSDIR} +sed "s|HOOKSDIR|${HOOKSDIR}|" hooks/checkhook.json > ${HOOKSDIR}/checkhook.json + +@test "pod test hooks" { + rm -f /run/hookscheck + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run cat /run/hookscheck + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/hooks/checkhook.json b/test/hooks/checkhook.json new file mode 100644 index 000000000..50ff23727 --- /dev/null +++ b/test/hooks/checkhook.json @@ -0,0 +1,5 @@ +{ + "cmd" : [".*"], + "hook" : "HOOKSDIR/checkhook.sh", + "stage" : [ "prestart" ] +} diff --git a/test/hooks/checkhook.sh b/test/hooks/checkhook.sh new file mode 100755 index 000000000..8b755cb40 --- /dev/null +++ b/test/hooks/checkhook.sh @@ -0,0 +1,4 @@ +#!/bin/sh +echo $@ >> /run/hookscheck +read line +echo $line >> /run/hookscheck diff --git a/test/image.bats b/test/image.bats new file mode 100644 index 000000000..5458fe134 --- /dev/null +++ b/test/image.bats @@ -0,0 +1,250 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE=kubernetes/pause +SIGNED_IMAGE=registry.access.redhat.com/rhel7-atomic:latest +UNSIGNED_IMAGE=docker.io/library/hello-world:latest + +function teardown() { + cleanup_test +} + +@test "run container in pod with image ID" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + sed -e "s/%VALUE%/$REDIS_IMAGEID/g" "$TESTDATA"/container_config_by_imageid.json > "$TESTDIR"/ctr_by_imageid.json + run crioctl ctr create --config "$TESTDIR"/ctr_by_imageid.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "container status return image:tag if created by image ID" { + start_crio + + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + sed -e "s/%VALUE%/$REDIS_IMAGEID/g" "$TESTDATA"/container_config_by_imageid.json > "$TESTDIR"/ctr_by_imageid.json + + run crioctl ctr create --config "$TESTDIR"/ctr_by_imageid.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Image: redis:alpine" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "container status return image@digest if created by image ID" { + start_crio + + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + sed -e "s/%VALUE%/$REDIS_IMAGEID_DIGESTED/g" "$TESTDATA"/container_config_by_imageid.json > "$TESTDIR"/ctr_by_imageid.json + + run crioctl ctr create --config "$TESTDIR"/ctr_by_imageid.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "ImageRef: redis@sha256:03789f402b2ecfb98184bf128d180f398f81c63364948ff1454583b02442f73b" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "image pull and list" { + start_crio "" "" --no-pause-image + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl image list --quiet "$IMAGE" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + imageid="$output" + + run crioctl image list --quiet @"$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + + run crioctl image list --quiet "$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + cleanup_images + stop_crio +} + +@test "image pull with signature" { + start_crio "" "" --no-pause-image + run crioctl image pull "$SIGNED_IMAGE" + echo "$output" + [ "$status" -eq 0 ] + cleanup_images + stop_crio +} + +@test "image pull without signature" { + start_crio "" "" --no-pause-image + run crioctl image pull "$UNSIGNED_IMAGE" + echo "$output" + [ "$status" -ne 0 ] + cleanup_images + stop_crio +} + +@test "image pull and list by tag and ID" { + start_crio "" "" --no-pause-image + run crioctl image pull "$IMAGE:go" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl image list --quiet "$IMAGE:go" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + imageid="$output" + + run crioctl image list --quiet @"$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + + run crioctl image list --quiet "$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + cleanup_images + stop_crio +} + +@test "image pull and list by digest and ID" { + start_crio "" "" --no-pause-image + run crioctl image pull nginx@sha256:33eb1ed1e802d4f71e52421f56af028cdf12bb3bfff5affeaf5bf0e328ffa1bc + echo "$output" + [ "$status" -eq 0 ] + + run crioctl image list --quiet nginx@sha256:33eb1ed1e802d4f71e52421f56af028cdf12bb3bfff5affeaf5bf0e328ffa1bc + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + imageid="$output" + + run crioctl image list --quiet @"$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + + run crioctl image list --quiet "$imageid" + [ "$status" -eq 0 ] + echo "$output" + [ "$output" != "" ] + + cleanup_images + stop_crio +} + +@test "image list with filter" { + start_crio "" "" --no-pause-image + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl image list --quiet "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + printf '%s\n' "$output" | while IFS= read -r id; do + run crioctl image remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + done + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + printf '%s\n' "$output" | while IFS= read -r id; do + echo "$id" + status=1 + done + cleanup_images + stop_crio +} + +@test "image list/remove" { + start_crio "" "" --no-pause-image + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + printf '%s\n' "$output" | while IFS= read -r id; do + run crioctl image remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + done + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + [ "$output" = "" ] + printf '%s\n' "$output" | while IFS= read -r id; do + echo "$id" + status=1 + done + cleanup_images + stop_crio +} + +@test "image status/remove" { + start_crio "" "" --no-pause-image + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + printf '%s\n' "$output" | while IFS= read -r id; do + run crioctl image status --id "$id" + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + run crioctl image remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + done + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + [ "$output" = "" ] + printf '%s\n' "$output" | while IFS= read -r id; do + echo "$id" + status=1 + done + cleanup_images + stop_crio +} diff --git a/test/image_remove.bats b/test/image_remove.bats new file mode 100644 index 000000000..ca2017d00 --- /dev/null +++ b/test/image_remove.bats @@ -0,0 +1,74 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE=docker.io/kubernetes/pause + +function teardown() { + cleanup_test +} + +@test "image remove with multiple names, by name" { + start_crio "" "" --no-pause-image + # Pull the image, giving it one name. + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + # Add a second name to the image. + run "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name="$IMAGE":latest --add-name="$IMAGE":othertag --signature-policy="$INTEGRATION_ROOT"/policy.json + echo "$output" + [ "$status" -eq 0 ] + # Get the list of image names and IDs. + run crioctl image list + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + # Cycle through each name, removing it by name. The image that we assigned a second + # name to should still be around when we get to removing its second name. + grep ^Tag: <<< "$output" | while read -r header tag ; do + run crioctl image remove --id "$tag" + echo "$output" + [ "$status" -eq 0 ] + done + # List all images and their names. There should be none now. + run crioctl image list --quiet + echo "$output" + [ "$status" -eq 0 ] + [ "$output" = "" ] + printf '%s\n' "$output" | while IFS= read -r id; do + echo "$id" + done + # All done. + cleanup_images + stop_crio +} + +@test "image remove with multiple names, by ID" { + start_crio "" "" --no-pause-image + # Pull the image, giving it one name. + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + # Add a second name to the image. + run "$COPYIMG_BINARY" --root "$TESTDIR/crio" $STORAGE_OPTIONS --runroot "$TESTDIR/crio-run" --image-name="$IMAGE":latest --add-name="$IMAGE":othertag --signature-policy="$INTEGRATION_ROOT"/policy.json + echo "$output" + [ "$status" -eq 0 ] + # Get the image ID of the image we just saved. + run crioctl image status --id="$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + # Try to remove the image using its ID. That should succeed because removing by ID always works. + grep ^ID: <<< "$output" | while read -r header id ; do + run crioctl image remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + done + # The image should be gone. + run crioctl image status --id="$IMAGE" + echo "$output" + [ "$status" -ne 0 ] + # All done. + cleanup_images + stop_crio +} diff --git a/test/image_volume.bats b/test/image_volume.bats new file mode 100644 index 000000000..ff05e9cda --- /dev/null +++ b/test/image_volume.bats @@ -0,0 +1,68 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "image volume ignore" { + IMAGE_VOLUMES=ignore start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + image_volume_config=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["image"]["image"] = "mrunalp/image-volume-test"; obj["command"] = ["/bin/sleep", "600"]; json.dump(obj, sys.stdout)') + echo "$image_volume_config" > "$TESTDIR"/container_image_volume.json + run crioctl ctr create --config "$TESTDIR"/container_image_volume.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" ls /imagevolume + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + [[ "$output" =~ "ls: /imagevolume: No such file or directory" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "image volume bind" { + IMAGE_VOLUMES=bind start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + image_volume_config=$(cat "$TESTDATA"/container_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["image"]["image"] = "mrunalp/image-volume-test"; obj["command"] = ["/bin/sleep", "600"]; json.dump(obj, sys.stdout)') + echo "$image_volume_config" > "$TESTDIR"/container_image_volume.json + run crioctl ctr create --config "$TESTDIR"/container_image_volume.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" touch /imagevolume/test_file + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 0" ]] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/inspect.bats b/test/inspect.bats new file mode 100644 index 000000000..c63a688e3 --- /dev/null +++ b/test/inspect.bats @@ -0,0 +1,72 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "info inspect" { + start_crio + out=`echo -e "GET /info HTTP/1.1\r\nHost: crio\r\n" | socat - UNIX-CONNECT:$CRIO_SOCKET` + echo "$out" + [[ "$out" =~ "\"cgroup_driver\":\"$CGROUP_MANAGER\"" ]] + [[ "$out" =~ "\"storage_root\":\"$TESTDIR/crio\"" ]] + run crioctl info + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "\"cgroup_driver\": \"$CGROUP_MANAGER\"" ]] + [[ "$output" =~ "\"storage_root\": \"$TESTDIR/crio\"" ]] + + stop_crio +} + +@test "ctr inspect" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + out=`echo -e "GET /containers/$ctr_id HTTP/1.1\r\nHost: crio\r\n" | socat - UNIX-CONNECT:$CRIO_SOCKET` + echo "$out" + [[ "$out" =~ "\"sandbox\":\"$pod_id\"" ]] + [[ "$out" =~ "\"image\":\"redis:alpine\"" ]] + + run crioctl ctr inspect --id $ctr_id + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "\"sandbox\": \"$pod_id\"" ]] + [[ "$output" =~ "\"image\": \"redis:alpine\"" ]] + + inet=`crioctl ctr execsync --id $ctr_id ip addr show dev eth0 scope global 2>&1 | grep inet` + + IFS=" " + ip=`parse_pod_ip $inet` + [[ "$out" =~ "\"ip_address\":\"$ip\"" ]] + [[ "$out" =~ "\"name\":\"k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1\"" ]] + [[ "$output" =~ "\"ip_address\": \"$ip\"" ]] + [[ "$output" =~ "\"name\": \"k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1\"" ]] + + +# TODO: add some other check based on the json below: +# +# {"name":"k8s_container1_podsandbox1_redhat.test.crio_redhat-test-crio_1","pid":27477,"image":"redis:alpine","created_time":1505223601111546169,"labels":{"batch":"no","type":"small"},"annotations":{"daemon":"crio","owner":"dragon"},"log_path":"/var/log/crio/pods/297d014ba2c54236779da0c2f80dfba45dc31b106e4cd126a1c3c6d78edc2201/81567e9573ea798d6494c9aab156103ee91b72180fd3841a7c24d2ca39886ba2.log","root":"/tmp/tmp.0bkjphWudF/crio/overlay/d7cfc1de83cab9f377a4a1542427d2a019e85a70c1c660a9e6cf9e254df68873/merged","sandbox":"297d014ba2c54236779da0c2f80dfba45dc31b106e4cd126a1c3c6d78edc2201","ip_address":"10.88.9.153"} + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ctr inspect not found" { + start_crio + out=`echo -e "GET /containers/notexists HTTP/1.1\r\nHost: crio\r\n" | socat - UNIX-CONNECT:$CRIO_SOCKET` + echo "$out" + [[ "$out" =~ "can't find the container with id notexists" ]] + + stop_crio +} diff --git a/test/kpod_diff.bats b/test/kpod_diff.bats new file mode 100644 index 000000000..53a94d01e --- /dev/null +++ b/test/kpod_diff.bats @@ -0,0 +1,40 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "test diff of image and parent" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS diff $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "test diff on non-existent layer" { + run ${KPOD_BINARY} $KPOD_OPTIONS diff "abc123" + echo "$output" + [ "$status" -ne 0 ] +} + +@test "test diff with json output" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + # run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} diff --format json $IMAGE | python -m json.tool" + run ${KPOD_BINARY} $KPOD_OPTIONS diff --format json $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_export.bats b/test/kpod_export.bats new file mode 100644 index 000000000..9454db399 --- /dev/null +++ b/test/kpod_export.bats @@ -0,0 +1,31 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "kpod export output flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} export -o container.tar "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio + rm -f container.tar +} diff --git a/test/kpod_history.bats b/test/kpod_history.bats new file mode 100644 index 000000000..aa89cfe65 --- /dev/null +++ b/test/kpod_history.bats @@ -0,0 +1,80 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod history default" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} history $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod history with Go template format" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} history --format "{{.ID}} {{.Created}}" $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod history human flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} history --human=false $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod history quiet flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} history -q $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod history no-trunc flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} history --no-trunc $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod history json flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} history --format json $IMAGE | python -m json.tool" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_images.bats b/test/kpod_images.bats new file mode 100644 index 000000000..0448d61b2 --- /dev/null +++ b/test/kpod_images.bats @@ -0,0 +1,47 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="debian:6.0.10" + +function teardown() { + cleanup_test +} + +@test "kpod images" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} images + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod images test valid json" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} images --format json + echo "$output" | python -m json.tool + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod images check name json output" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} images --format json + echo "$output" + [ "$status" -eq 0 ] + name=$(echo $output | python -c 'import sys; import json; print(json.loads(sys.stdin.read())[0])["names"][0]') + [ "$name" = "docker.io/library/${IMAGE}" ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_inspect.bats b/test/kpod_inspect.bats new file mode 100644 index 000000000..ca4b7c8eb --- /dev/null +++ b/test/kpod_inspect.bats @@ -0,0 +1,58 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "kpod inspect image" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} $KPOD_OPTIONS inspect ${IMAGE} | python -m json.tool" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} + + +@test "kpod inspect non-existent container" { + run ${KPOD_BINARY} $KPOD_OPTIONS inspect 14rcole/non-existent + echo "$output" + [ "$status" -ne 0 ] +} + +@test "kpod inspect with format" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS inspect --format {{.ID}} ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + inspectOutput="$output" + run ${KPOD_BINARY} $KPOD_OPTIONS images --no-trunc --quiet ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + [ "$output" = "$inspectOutput" ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod inspect specified type" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} $KPOD_OPTIONS inspect --type image ${IMAGE} | python -m json.tool" + echo "$output" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi ${IMAGE} + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_kill.bats b/test/kpod_kill.bats new file mode 100644 index 000000000..154875145 --- /dev/null +++ b/test/kpod_kill.bats @@ -0,0 +1,83 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +function start_sleep_container () { + pod_id=$(crioctl pod run --config "$TESTDATA"/sandbox_config.json) + ctr_id=$(crioctl ctr create --config "$TESTDATA"/container_config_sleep.json --pod "$pod_id") + crioctl ctr start --id "$ctr_id" +} + +@test "kill a bogus container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} kill foobar + echo "$output" + [ "$status" -ne 0 ] +} + +@test "kill a running container by id" { + start_crio + ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + ctr_id=$( start_sleep_container ) + crioctl ctr status --id "$ctr_id" + ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a + ${KPOD_BINARY} ${KPOD_OPTIONS} logs "$ctr_id" + crioctl ctr status --id "$ctr_id" + run ${KPOD_BINARY} ${KPOD_OPTIONS} kill "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kill a running container by id with TERM" { + start_crio + ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + ctr_id=$( start_sleep_container ) + crioctl ctr status --id "$ctr_id" + ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a + ${KPOD_BINARY} ${KPOD_OPTIONS} logs "$ctr_id" + crioctl ctr status --id "$ctr_id" + run ${KPOD_BINARY} ${KPOD_OPTIONS} kill -s TERM "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kill a running container by name" { + start_crio + ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + ctr_id=$( start_sleep_container ) + crioctl ctr status --id "$ctr_id" + ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a + ${KPOD_BINARY} ${KPOD_OPTIONS} logs "$ctr_id" + crioctl ctr status --id "$ctr_id" + ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a + run ${KPOD_BINARY} ${KPOD_OPTIONS} kill "k8s_container999_podsandbox1_redhat.test.crio_redhat-test-crio_1" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kill a running container by id with a bogus signal" { + start_crio + ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + ctr_id=$( start_sleep_container ) + crioctl ctr status --id "$ctr_id" + ${KPOD_BINARY} ${KPOD_OPTIONS} logs "$ctr_id" + crioctl ctr status --id "$ctr_id" + run ${KPOD_BINARY} ${KPOD_OPTIONS} kill -s foobar "$ctr_id" + echo "$output" + [ "$status" -ne 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_load.bats b/test/kpod_load.bats new file mode 100644 index 000000000..e3896b2ae --- /dev/null +++ b/test/kpod_load.bats @@ -0,0 +1,84 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod load input flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} load -i alpine.tar + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod load oci-archive image" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar --format oci-archive $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} load -i alpine.tar + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + [ "$status" -eq 0 ] +} + +@test "kpod load oci-archive image with signature-policy" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar --format oci-archive $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + [ "$status" -eq 0 ] + cp /etc/containers/policy.json /tmp + run ${KPOD_BINARY} ${KPOD_OPTIONS} load --signature-policy /tmp/policy.json -i alpine.tar + echo "$output" + [ "$status" -eq 0 ] + rm -f /tmp/policy.json + rm -f alpine.tar + run ${KPOD_BINARY} $KPOD_OPTIONS rmi $IMAGE + [ "$status" -eq 0 ] +} + +@test "kpod load using quiet flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} load -q -i alpine.tar + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + [ "$status" -eq 0 ] +} + +@test "kpod load non-existent file" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} load -i alpine.tar + echo "$output" + [ "$status" -ne 0 ] +} diff --git a/test/kpod_logs.bats b/test/kpod_logs.bats new file mode 100644 index 000000000..1e3015566 --- /dev/null +++ b/test/kpod_logs.bats @@ -0,0 +1,74 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "display logs for container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS logs "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "tail three lines of logs for container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS logs --tail 3 $ctr_id + echo "$output" + lines=$(echo "$output" | wc -l) + [ "$status" -eq 0 ] + [[ $(wc -l < "$output" ) -le 3 ]] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "display logs for container since a given time" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS logs --since 2017-08-07T10:10:09.056611202-04:00 $ctr_id + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_mount.bats b/test/kpod_mount.bats new file mode 100644 index 000000000..237dd5848 --- /dev/null +++ b/test/kpod_mount.bats @@ -0,0 +1,48 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "mount" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} mount $ctr_id + echo "$output" + echo ${KPOD_BINARY} ${KPOD_OPTIONS} mount $ctr_id + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} mount --notruncate | grep $ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unmount $ctr_id + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} mount $ctr_id + echo "$output" + [ "$status" -eq 0 ] + root="$output" + run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} mount --format=json | python -m json.tool | grep $ctr_id" + echo "$output" + [ "$status" -eq 0 ] + touch $root/foobar + run ${KPOD_BINARY} ${KPOD_OPTIONS} unmount $ctr_id + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_pause.bats b/test/kpod_pause.bats new file mode 100644 index 000000000..84321beb3 --- /dev/null +++ b/test/kpod_pause.bats @@ -0,0 +1,169 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "pause a bogus container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause foobar + echo "$output" + [ "$status" -eq 1 ] +} + +@test "unpause a bogus container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause foobar + echo "$output" + [ "$status" -eq 1 ] +} + +@test "pause a created container by id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter id="$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "pause a running container by id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause "$id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause "$id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter id="$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "pause a running container by name" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause "k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause "k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter id="k8s_podsandbox1-redis_podsandbox1_redhat.test.crio_redhat-test-crio_0" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "remove a paused container by id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + id="$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause "$id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rm "$id" + echo "$output" + [ "$status" -eq 1 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rm --force "$id" + echo "$output" + [ "$status" -eq 1 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause "$id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} stop "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rm "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "stop a paused container created by id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} pause "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} stop "$ctr_id" + echo "$output" + [ "$status" -eq 1 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} unpause "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter id="$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} diff --git a/test/kpod_ps.bats b/test/kpod_ps.bats new file mode 100644 index 000000000..a4a7b6cbc --- /dev/null +++ b/test/kpod_ps.bats @@ -0,0 +1,313 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +@test "kpod ps with no containers" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod ps default" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps all flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps --all + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps size flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a -s + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --size + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps quiet flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a -q + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --quiet + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps latest flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps --latest + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -l + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps last flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps --last 2 + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -n 2 + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps no-trunc flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --no-trunc + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps namespace flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --ns + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps --all --namespace + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps namespace flag and format flag = json" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --ns --format json | python -m json.tool | grep namespace" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps without namespace flag and format flag = json" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --format json | python -m json.tool | grep namespace" + echo "$output" + [ "$status" -eq 1 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps format flag = go template" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --format "table {{.ID}} {{.Image}} {{.Labels}}" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps filter flag - ancestor" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter ancestor=${IMAGE} + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps filter flag - id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter id="$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "kpod ps filter flag - status" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl image pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} ps -a --filter status=running + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_pull.bats b/test/kpod_pull.bats new file mode 100644 index 000000000..c12c62413 --- /dev/null +++ b/test/kpod_pull.bats @@ -0,0 +1,138 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod pull from docker with tag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull debian:6.0.10 + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi debian:6.0.10 + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from docker without tag" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull debian + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi debian + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from a non-docker registry with tag" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull registry.fedoraproject.org/fedora:rawhide + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi registry.fedoraproject.org/fedora:rawhide + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from a non-docker registry without tag" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull registry.fedoraproject.org/fedora + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi registry.fedoraproject.org/fedora + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull using digest" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull alpine@sha256:1072e499f3f655a032e88542330cf75b02e7bdf673278f701d7ba61629ee3ebe + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi alpine:latest + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from a non existent image" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull umohnani/get-started + echo "$output" + [ "$status" -ne 0 ] +} + +@test "kpod pull from docker with shortname" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull debian + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi docker.io/debian:latest + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from docker with shortname and tag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull debian:6.0.10 + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rmi docker.io/debian:6.0.10 + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod pull from docker-archive" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alp.tar alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker-archive:alp.tar + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi alpine + echo "$output" + [ "$status" -eq 0 ] + rm -f alp.tar +} + +@test "kpod pull from oci-archive" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save --format oci-archive -o oci-alp.tar alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull oci-archive:oci-alp.tar + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi alpine + echo "$output" + [ "$status" -eq 0 ] + rm -f oci-alp.tar +} + +@test "kpod pull from local directory" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull alpine + echo "$output" + [ "$status" -eq 0 ] + run mkdir test_pull_dir + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} push alpine dir:test_pull_dir + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi alpine + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull dir:test_pull_dir + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi test_pull_dir + echo "$output" + [ "$status" -eq 0 ] + rm -rf test_pull_dir +} diff --git a/test/kpod_push.bats b/test/kpod_push.bats new file mode 100644 index 000000000..e8fe4fdbc --- /dev/null +++ b/test/kpod_push.bats @@ -0,0 +1,90 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod push to containers/storage" { + echo # Pull down the image: it gets the name $IMAGE. + run ${KPOD_BINARY} $KPOD_OPTIONS --log-level=debug pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + echo # Push the image right back into storage: it now has two names. + run ${KPOD_BINARY} $KPOD_OPTIONS --log-level=debug push "$IMAGE" containers-storage:busybox:test + echo "$output" + [ "$status" -eq 0 ] + echo # Try to remove it using the first name. Should be refused. + run ${KPOD_BINARY} $KPOD_OPTIONS --log-level=debug rmi "$IMAGE" + echo "$output" + [ "$status" -ne 0 ] + echo # Try to remove it using the second name. Should also be refused. + run ${KPOD_BINARY} $KPOD_OPTIONS --log-level=debug rmi busybox:test + echo "$output" + [ "$status" -ne 0 ] + echo # Force removal despite having multiple names. Should succeed. + run ${KPOD_BINARY} $KPOD_OPTIONS --log-level=debug rmi -f busybox:test + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod push to directory" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run mkdir /tmp/busybox + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS push "$IMAGE" dir:/tmp/busybox + echo "$output" + [ "$status" -eq 0 ] + rm -rf /tmp/busybox + run ${KPOD_BINARY} $KPOD_OPTIONS rmi "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod push to docker archive" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS push "$IMAGE" docker-archive:/tmp/busybox-archive:1.26 + echo "$output" + [ "$status" -eq 0 ] + rm /tmp/busybox-archive + run ${KPOD_BINARY} $KPOD_OPTIONS rmi "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod push to oci-archive without compression" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS push "$IMAGE" oci-archive:/tmp/oci-busybox.tar:alpine + echo "$output" + [ "$status" -eq 0 ] + rm -f /tmp/oci-busybox.tar + run ${KPOD_BINARY} $KPOD_OPTIONS rmi "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] +} + +@test "kpod push without signatures" { + run ${KPOD_BINARY} $KPOD_OPTIONS pull "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] + run mkdir /tmp/busybox + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS push --remove-signatures "$IMAGE" dir:/tmp/busybox + echo "$output" + [ "$status" -eq 0 ] + rm -rf /tmp/busybox + run ${KPOD_BINARY} $KPOD_OPTIONS rmi "$IMAGE" + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_rename.bats b/test/kpod_rename.bats new file mode 100644 index 000000000..ed3fdada1 --- /dev/null +++ b/test/kpod_rename.bats @@ -0,0 +1,33 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +function teardown() { + cleanup_test +} + +@test "kpod rename successful" { + start_crio + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + pod_id="$output" + [ "$status" -eq 0 ] + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + ctr_id="$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rename "$ctr_id" "$NEW_NAME" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS inspect "$ctr_id" --format {{.Name}} + echo "$output" + [ "$status" -eq 0 ] + [ "$output" == "$NEW_NAME" ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_rm.bats b/test/kpod_rm.bats new file mode 100644 index 000000000..022e3efc2 --- /dev/null +++ b/test/kpod_rm.bats @@ -0,0 +1,90 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "remove a stopped container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rm "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "refuse to remove a running container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rm "$ctr_id" + echo "$output" + [ "$status" -ne 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "remove a created container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} $KPOD_OPTIONS rm -f "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "remove a running container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} $KPOD_OPTIONS rm -f "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} diff --git a/test/kpod_save.bats b/test/kpod_save.bats new file mode 100644 index 000000000..d8c581a5c --- /dev/null +++ b/test/kpod_save.bats @@ -0,0 +1,65 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod save output flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar +} + +@test "kpod save oci flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar --format oci-archive $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + [ "$status" -eq 0 ] + rm -f alpine.tar +} + +@test "kpod save using stdout" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save > alpine.tar $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar +} + +@test "kpod save quiet flag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -q -o alpine.tar $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi $IMAGE + echo "$output" + [ "$status" -eq 0 ] + rm -f alpine.tar +} + +@test "kpod save non-existent image" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} save -o alpine.tar $IMAGE + echo "$output" + [ "$status" -ne 0 ] +} diff --git a/test/kpod_stats.bats b/test/kpod_stats.bats new file mode 100644 index 000000000..a4b8e61e6 --- /dev/null +++ b/test/kpod_stats.bats @@ -0,0 +1,104 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "stats single output" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} stats --no-stream "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "stats does not output stopped container" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} stats --no-stream + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "stats outputs stopped container with all flag" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run ${KPOD_BINARY} ${KPOD_OPTIONS} stats --no-stream --all + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "stats output only id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} stats --no-stream --format {{.ID}} "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + # once ps is implemented, run ps -q and see if that equals the output from above + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "stats streaming output" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run timeout 5s bash -c "${KPOD_BINARY} ${KPOD_OPTIONS} stats --all" + echo "$output" + [ "$status" -eq 124 ] #124 is the status set by timeout when it has to kill the command at the end of the given time + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/kpod_stop.bats b/test/kpod_stop.bats new file mode 100644 index 000000000..72e818d40 --- /dev/null +++ b/test/kpod_stop.bats @@ -0,0 +1,58 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "stop a bogus container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} stop foobar + echo "$output" + [ "$status" -eq 1 ] +} + +@test "stop a running container by id" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + id="$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} stop "$id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "stop a running container by name" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + [ "$status" -eq 0 ] + run crioctl ctr inspect --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_name=$(python -c 'import json; import sys; print json.load(sys.stdin)["crio_annotations"]["io.kubernetes.cri-o.Name"]' <<< "$output") + echo container name is \""$ctr_name"\" + run ${KPOD_BINARY} ${KPOD_OPTIONS} stop "$ctr_name" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} diff --git a/test/kpod_tag.bats b/test/kpod_tag.bats new file mode 100644 index 000000000..93109db52 --- /dev/null +++ b/test/kpod_tag.bats @@ -0,0 +1,50 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="alpine:latest" + +function teardown() { + cleanup_test +} + +@test "kpod tag with shortname:latest" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} tag $IMAGE foobar:latest + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} inspect foobar:latest + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi --force foobar:latest + [ "$status" -eq 0 ] +} + +@test "kpod tag with shortname" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} tag $IMAGE foobar + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} inspect foobar:latest + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi --force foobar:latest + [ "$status" -eq 0 ] +} + +@test "kpod tag with shortname:tag" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull $IMAGE + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} tag $IMAGE foobar:v + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} inspect foobar:v + echo "$output" + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} rmi --force foobar:v + [ "$status" -eq 0 ] +} diff --git a/test/kpod_version.bats b/test/kpod_version.bats new file mode 100644 index 000000000..e6c062b80 --- /dev/null +++ b/test/kpod_version.bats @@ -0,0 +1,13 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "kpod version test" { + run ${KPOD_BINARY} version + echo "$output" + [ "$status" -eq 0 ] +} diff --git a/test/kpod_wait.bats b/test/kpod_wait.bats new file mode 100644 index 000000000..ba7556b2e --- /dev/null +++ b/test/kpod_wait.bats @@ -0,0 +1,69 @@ +#!/usr/bin/env bats + +load helpers + +IMAGE="redis:alpine" + +# Returns the POD ID +function pod_run_from_template(){ + #1=name, 2=uid, 3=namespace) { + NAME=$1 CUID=$2 NAMESPACE=$3 envsubst < ${TESTDATA}/template_sandbox_config.json > ${TESTDIR}/pod-${1}.json + crioctl pod run --config ${TESTDIR}/pod-${1}.json +} + +# Returns the container ID +function container_create_from_template() { + #1=name, 2=image, 3=command, 4=id) { + NAME=$1 IMAGE=$2 COMMAND=$3 envsubst < ${TESTDATA}/template_container_config.json > ${TESTDIR}/ctr-${1}.json + crioctl ctr create --config ${TESTDIR}/ctr-${1}.json --pod "$4" +} + +function container_start() { + #1=id + crioctl ctr start --id "$1" + +} +@test "wait on a bogus container" { + start_crio + run ${KPOD_BINARY} ${KPOD_OPTIONS} wait 12343 + echo $output + [ "$status" -eq 1 ] + stop_crio +} + +@test "wait on a stopped container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + echo $output + [ "$status" -eq 0 ] + start_crio + pod_id=$( pod_run_from_template "test" "test" "test1-1" ) + echo $pod_id + ctr_id=$(container_create_from_template "test-CTR" "docker.io/library/busybox:latest" '["ls"]' "${pod_id}") + echo $ctr_id + container_start $ctr_id + run ${KPOD_BINARY} ${KPOD_OPTIONS} wait $ctr_id + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "wait on a sleeping container" { + run ${KPOD_BINARY} ${KPOD_OPTIONS} pull docker.io/library/busybox:latest + echo $output + [ "$status" -eq 0 ] + start_crio + pod_id=$( pod_run_from_template "test" "test" "test1-1" ) + echo $pod_id + ctr_id=$(container_create_from_template "test-CTR" "docker.io/library/busybox:latest" '["sleep", "5"]' "${pod_id}") + echo $ctr_id + run container_start $ctr_id + echo $output + [ "$status" -eq 0 ] + run ${KPOD_BINARY} ${KPOD_OPTIONS} wait $ctr_id + echo $output + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/network.bats b/test/network.bats new file mode 100644 index 000000000..dc8143c26 --- /dev/null +++ b/test/network.bats @@ -0,0 +1,186 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_ctrs + cleanup_pods + stop_crio + rm -f /var/lib/cni/networks/crionet_test_args/* + chmod 0755 $CONMON_BINARY + cleanup_test +} + +@test "ensure correct hostname" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr execsync --id "$ctr_id" sh -c "hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "echo \$HOSTNAME" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "cat /etc/hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] +} + +@test "ensure correct hostname for hostnetwork:true" { + start_crio + hostnetworkconfig=$(cat "$TESTDATA"/sandbox_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["linux"]["security_context"]["namespace_options"]["host_network"] = True; obj["annotations"] = {}; obj["hostname"] = ""; json.dump(obj, sys.stdout)') + echo "$hostnetworkconfig" > "$TESTDIR"/sandbox_hostnetwork_config.json + run crioctl pod run --config "$TESTDIR"/sandbox_hostnetwork_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr execsync --id "$ctr_id" sh -c "hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "echo \$HOSTNAME" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "cat /etc/hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] +} + +@test "Check for valid pod netns CIDR" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + check_pod_cidr $ctr_id +} + +@test "Ping pod from the host" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + ping_pod $ctr_id +} + +@test "Ping pod from another pod" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod1_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + ctr1_id="$output" + + temp_sandbox_conf cni_test + + run crioctl pod run --config "$TESTDIR"/sandbox_config_cni_test.json + echo "$output" + [ "$status" -eq 0 ] + pod2_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + ctr2_id="$output" + + ping_pod_from_pod $ctr1_id $ctr2_id + + ping_pod_from_pod $ctr2_id $ctr1_id +} + +@test "Ensure correct CNI plugin namespace/name/container-id arguments" { + start_crio "" "" "" "prepare_plugin_test_args_network_conf" + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + [ "$status" -eq 0 ] + + . /tmp/plugin_test_args.out + + [ "$FOUND_CNI_CONTAINERID" != "redhat.test.crio" ] + [ "$FOUND_CNI_CONTAINERID" != "podsandbox1" ] + [ "$FOUND_K8S_POD_NAMESPACE" = "redhat.test.crio" ] + [ "$FOUND_K8S_POD_NAME" = "podsandbox1" ] + + rm -rf /tmp/plugin_test_args.out +} + +@test "Connect to pod hostport from the host" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config_hostport.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + get_host_ip + echo $host_ip + + run crioctl ctr create --config "$TESTDATA"/container_config_hostport.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run nc -w 5 $host_ip 4888 </dev/null + echo "$output" + [ "$output" = "crioctl_host" ] + [ "$status" -eq 0 ] + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] +} + +@test "Clean up network if pod sandbox fails" { + start_crio "" "" "" "prepare_plugin_test_args_network_conf" + + # make conmon non-executable to cause the sandbox setup to fail after + # networking has been configured + chmod 0644 $CONMON_BINARY + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + chmod 0755 $CONMON_BINARY + echo "$output" + [ "$status" -ne 0 ] + + # ensure that the server cleaned up sandbox networking if the sandbox + # failed after network setup + rm -f /var/lib/cni/networks/crionet_test_args/last_reserved_ip + num_allocated=$(ls /var/lib/cni/networks/crionet_test_args | wc -l) + [[ "${num_allocated}" == "0" ]] +} diff --git a/test/pod.bats b/test/pod.bats new file mode 100644 index 000000000..2b5837903 --- /dev/null +++ b/test/pod.bats @@ -0,0 +1,365 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +# PR#59 +@test "pod release name on remove" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + id="$output" + run crioctl pod stop --id "$id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + id="$output" + run crioctl pod stop --id "$id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "pod remove" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "pod stop ignores not found sandboxes" { + start_crio + + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "pod list filtering" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json -name pod1 --label "a=b" --label "c=d" --label "e=f" + echo "$output" + [ "$status" -eq 0 ] + pod1_id="$output" + run crioctl pod run --config "$TESTDATA"/sandbox_config.json -name pod2 --label "a=b" --label "c=d" + echo "$output" + [ "$status" -eq 0 ] + pod2_id="$output" + run crioctl pod run --config "$TESTDATA"/sandbox_config.json -name pod3 --label "a=b" + echo "$output" + [ "$status" -eq 0 ] + pod3_id="$output" + run crioctl pod list --label "a=b" --label "c=d" --label "e=f" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + run crioctl pod list --label "g=h" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == "" ]] + run crioctl pod list --label "a=b" --label "c=d" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + [[ "$output" =~ "$pod2_id" ]] + run crioctl pod list --label "a=b" --quiet + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + [[ "$output" =~ "$pod2_id" ]] + [[ "$output" =~ "$pod3_id" ]] + run crioctl pod list --id "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + # filter by truncated id should work as well + run crioctl pod list --id "${pod1_id:0:4}" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + run crioctl pod list --id "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod2_id" ]] + run crioctl pod list --id "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod3_id" ]] + run crioctl pod list --id "$pod1_id" --label "a=b" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod1_id" ]] + run crioctl pod list --id "$pod2_id" --label "a=b" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod2_id" ]] + run crioctl pod list --id "$pod3_id" --label "a=b" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" != "" ]] + [[ "$output" =~ "$pod3_id" ]] + run crioctl pod list --id "$pod3_id" --label "c=d" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" == "" ]] + run crioctl pod stop --id "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod1_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod2_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod3_id" + echo "$output" + [ "$status" -eq 0 ] + cleanup_pods + stop_crio +} + +@test "pod metadata in list & status" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl pod list --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + # TODO: expected value should not hard coded here + [[ "$output" =~ "Name: podsandbox1" ]] + [[ "$output" =~ "UID: redhat-test-crio" ]] + [[ "$output" =~ "Namespace: redhat.test.crio" ]] + [[ "$output" =~ "Attempt: 1" ]] + + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + # TODO: expected value should not hard coded here + [[ "$output" =~ "Name: podsandbox1" ]] + [[ "$output" =~ "UID: redhat-test-crio" ]] + [[ "$output" =~ "Namespace: redhat.test.crio" ]] + [[ "$output" =~ "Attempt: 1" ]] + + cleanup_pods + stop_crio +} + +@test "pass pod sysctls to runtime" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl ctr create --pod "$pod_id" --config "$TESTDATA"/container_redis.json + echo "$output" + [ "$status" -eq 0 ] + container_id="$output" + + run crioctl ctr start --id "$container_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr execsync --id "$container_id" sysctl kernel.shm_rmid_forced + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "kernel.shm_rmid_forced = 1" ]] + + run crioctl ctr execsync --id "$container_id" sysctl kernel.msgmax + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "kernel.msgmax = 8192" ]] + + run crioctl ctr execsync --id "$container_id" sysctl net.ipv4.ip_local_port_range + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "net.ipv4.ip_local_port_range = 1024 65000" ]] + + cleanup_pods + stop_crio +} + +@test "pod stop idempotent" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "pod remove idempotent" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "pod stop idempotent with ctrs already stopped" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "restart crio and still get pod status" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + restart_crio + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + [ "$output" != "" ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "invalid systemd cgroup_parent fail" { + if [[ "$CGROUP_MANAGER" != "systemd" ]]; then + skip "need systemd cgroup manager" + fi + + wrong_cgroup_parent_config=$(cat "$TESTDATA"/sandbox_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["linux"]["cgroup_parent"] = "podsandbox1.slice:container:infra"; json.dump(obj, sys.stdout)') + echo "$wrong_cgroup_parent_config" > "$TESTDIR"/sandbox_wrong_cgroup_parent.json + + start_crio + run crioctl pod run --config "$TESTDIR"/sandbox_wrong_cgroup_parent.json + echo "$output" + [ "$status" -eq 1 ] + + stop_crio +} + +@test "systemd cgroup_parent correctly set" { + if [[ "$CGROUP_MANAGER" != "systemd" ]]; then + skip "need systemd cgroup manager" + fi + + cgroup_parent_config=$(cat "$TESTDATA"/sandbox_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["linux"]["cgroup_parent"] = "/Burstable/pod_integration_tests-123"; json.dump(obj, sys.stdout)') + echo "$cgroup_parent_config" > "$TESTDIR"/sandbox_systemd_cgroup_parent.json + + start_crio + run crioctl pod run --config "$TESTDIR"/sandbox_systemd_cgroup_parent.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run systemctl list-units --type=slice + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Burstable-pod_integration_tests_123.slice" ]] + + cleanup_pods + stop_crio +} diff --git a/test/policy.json b/test/policy.json new file mode 100644 index 000000000..ddc46e1a6 --- /dev/null +++ b/test/policy.json @@ -0,0 +1,23 @@ +{ + "default": [ + { + "type": "insecureAcceptAnything" + } + ], + "transports": { + "docker": { + "docker.io/library/hello-world": [ + { + "type": "reject" + } + ], + "registry.access.redhat.com": [ + { + "keyType": "GPGKeys", + "type": "signedBy", + "keyData": "VGhlIGZvbGxvd2luZyBwdWJsaWMga2V5IGNhbiBiZSB1c2VkIHRvIHZlcmlmeSBSUE0gcGFja2FnZXMgYnVpbHQgYW5kCnNpZ25lZCBieSBSZWQgSGF0LCBJbmMuICBUaGlzIGtleSBpcyB1c2VkIGZvciBwYWNrYWdlcyBpbiBSZWQgSGF0CnByb2R1Y3RzIHNoaXBwZWQgYWZ0ZXIgTm92ZW1iZXIgMjAwOSwgYW5kIGZvciBhbGwgdXBkYXRlcyB0byB0aG9zZQpwcm9kdWN0cy4KClF1ZXN0aW9ucyBhYm91dCB0aGlzIGtleSBzaG91bGQgYmUgc2VudCB0byBzZWN1cml0eUByZWRoYXQuY29tLgoKcHViICA0MDk2Ui9GRDQzMUQ1MSAyMDA5LTEwLTIyIFJlZCBIYXQsIEluYy4gKHJlbGVhc2Uga2V5IDIpIDxzZWN1cml0eUByZWRoYXQuY29tPgoKLS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tClZlcnNpb246IEdudVBHIHYxLjIuNiAoR05VL0xpbnV4KQoKbVFJTkJFcmdTVHNCRUFDaDJBNGIwTzl0K3Z6QzlWclZ0TDFBS3ZVV2k5T1BDamt2UjdYZDhEdEp4ZWVNWjVlRgowSHR6SUc1OHFEUnlid1VlODlGWnByQjFmZnVVS3pkRStIY0wzRmJOV1NTT1hWalpJZXJzZFh5SDNOdm5MTExGCjBETlJCMml4M2JYRzlSaC9SWHBGc054RHAyQ0VNZFV2YllDekU3OUsxRW5VVFZoMUwwT2YwMjNGdFBTWlhYMGMKdTdQYjVESTVsWDVZZW9YTzZSb29kcklHWUpzVkJRV25yV3c0eE5UY29uVWZOUGswRUdadEVuenZIMnp5UG9KaApYR0YrTmN1OVh3YmFsbllkZTEwT0N2U1dBWjV6VENwb0xNVHZRaldwYkNkV1hKekNtNkcrL2h4OXVwa2U1NDZICjVJanRZbTRkVElWVG5jM3d2RGlPRGdCS1J6T2w5ckVPQ0lnT3VHdER4UnhjUWtqckMreHZnNVZrcW43dkJVeVcKOXBIZWRPVStQb0YzREdPTStkcXYrZU5LQnZoOVlGOXVnRkFRQmtjRzd2aVpndkdFTUdHVXB6TmdON1huUzFnagovRFBvOW1aRVNPWW5LY2V2ZTJ0SUM4N3AyaHFqcnhPSHVJN2ZrWlllTkljQW9hODNyQmx0RlhhQkRZaFdBS1MxClBjWFMxLzdKelAwa3k3ZDBMNlhidS9JZjVrcVdRcEt3VUluWHR5U1JrdXJhVmZ1SzNCcGErWDFYZWNXaTI0SlkKSFZ0bE5YMDI1eHgxZXdWekdOQ1RsV24xc2tRTjJPT29RVFY0QzgvcUZwVFc2RFRXWXVyZDQrZkUwT0pGSlpRRgpidWhmWFl3bVJsVk9nTjVpNzdOVElKWkpRZllGajM4Yy9JdjV2WkJQb2tPNm1mZnJPVHYzTUhXVmdRQVJBUUFCCnRETlNaV1FnU0dGMExDQkpibU11SUNoeVpXeGxZWE5sSUd0bGVTQXlLU0E4YzJWamRYSnBkSGxBY21Wa2FHRjAKTG1OdmJUNkpBallFRXdFQ0FDQUZBa3JnU1RzQ0d3TUdDd2tJQndNQ0JCVUNDQU1FRmdJREFRSWVBUUlYZ0FBSwpDUkFabmkrUi9VTWRVV3pwRC85czVTRlIvWkYzeWpZNVZMVUZMTVhJS1V6dE5OM29jNDVmeUxkVEkzK1VDbEtDCjJ0RXJ1ellqcU5IaHFBRVhhMnNOMWZNcnN1S2VjNjFMbDJOZnZKamtMS0R2Z1ZJaDdrTTdhc2xOWVZPUDZCVGYKQy9KSjcvdWZ6M1VabXlWaUgvV0RsK0FZZGdrM0pxQ0lPNXc1cnlyQzlJeUJ6WXYybTBIcVliV2ZwaFkzdUh3NQp1bjNuZExKY3U4K0JHUDVGK09OUUVHbCtEUkg1OElsOUpwM0h3YlJhN2R2a1BnRWhmRlIrMWhJK0J0dGEyQzdFCjAvMk5LekN4Wnc3THgzUEJSY1U5MllLeWFFaWhmeS9hUUtaQ0F1eWZLaU12c216cys0cG9JWDdJOU5RQ0pweUUKSUdmSU5vWjdWeHFId1JuL2Q1bXcyTVpUSmpielNmK1VtOVlKeUEwaUVFeUQ2cWpyaVdRUmJ1eHBRWG1sQUpiaAo4b2taNGdiVkZ2MUY4TXpLKzRSOFZ2V0owWHhndGlrU283MmZIandoYTdNQWpxRm5PcTZlbzZmRUMvNzVnM05MCkdodDVWZHBHdUhrMHZiZEVOSE1DOHdTOTllNXFYR05EdWVkM2hsVGF2RE1sRUFIbDM0cTJIOW5ha1RHUkY1S2kKSlVmTmgzRFZSR2hnOGNNSXRpMjFuamlSaDdneUZJMk9jY0FUWTdiQlNyNzlKaHVOd2VsSHV4THJDRnBZN1YyNQpPRmt0bDE1alpKYU14dVFCcVlkQmdTYXkyRzBVNkQxKzdWc1d1ZnB6ZC9BYngxL2Mzb2k5WmFKdlcyMmtBZ2dxCmR6ZEEyN1VVWWpXdng0Mnc5bWVuSndoLzBqZVFjVGVjSVVkMGQwckZjdy9jMXB2Z01NbC9RNzN5ektnS1l3PT0KPXpiSEUKLS0tLS1FTkQgUEdQIFBVQkxJQyBLRVkgQkxPQ0stLS0tLQpUaGUgZm9sbG93aW5nIHB1YmxpYyBrZXkgY2FuIGJlIHVzZWQgdG8gdmVyaWZ5IFJQTSBwYWNrYWdlcyBidWlsdCBhbmQKc2lnbmVkIGJ5IFJlZCBIYXQsIEluYy4gIFRoaXMga2V5IGlzIGEgc3VwcG9ydGluZyAoYXV4aWxpYXJ5KSBrZXkgZm9yClJlZCBIYXQgcHJvZHVjdHMgc2hpcHBlZCBhZnRlciBOb3ZlbWJlciAyMDA2IGFuZCBmb3IgYWxsIHVwZGF0ZXMgdG8KdGhvc2UgcHJvZHVjdHMuCgpRdWVzdGlvbnMgYWJvdXQgdGhpcyBrZXkgc2hvdWxkIGJlIHNlbnQgdG8gc2VjdXJpdHlAcmVkaGF0LmNvbS4KCi0tLS0tQkVHSU4gUEdQIFBVQkxJQyBLRVkgQkxPQ0stLS0tLQpWZXJzaW9uOiBHbnVQRyB2MS4yLjYgKEdOVS9MaW51eCkKCm1RR2lCRVZ3REdrUkJBQ3dQaFpJcHZrakk4d1Y5c0ZURG9xeVBMeDF1YjhTZC93K1l1STVPdm00OW12dkVRVlQKVkxnOEZnRTVKbFNUNTlBYnNMRHlWdFJhOUN4SXZONXN5QlZyV1dXdEh0RG5ueWxGQmNxRy9BNkozYkk0RTkvQQpVdFNMNVp4YmF2MCt1dFA2ZjN3T3B4UXJ4YytXSURWZ3B1cmRCS0FRM2Rzb2JHQnF5cGVYNkZYWjV3Q2dvdTZDCnlacEdJQnFvc0phRFdMek5lT2ZiLzcwRC8xdGhMa1F5aFczSko2Y0hDWUpITmZCU2h2YkxXQmY2UzIzMW1nbXUKTXlNbHQ4S21pcGM5Yncrc2FhQWtTa1ZzUS9aYmZqcldCN2U1a2JNcnVLTFZySCtuR2hhbWxIWVVHeUFQdHNQZwpVai9OVVNqNUJtckNzT2tNcG40M25nVExzc0U5TUxoU1BqMm5JSEdGdjlCK2lWTHZvbURkd25hQlJnUTFhSzh6Cno2TUFBLzQwNnlmNXlWSi9NbFRXczEvNjhWd0Rob3NjOUJ0VTFWNUlFME5YZ1pVQWZCSnp6ZlZ6ektRcTZ6SjIKZVpzTUxocjk2d2JzVzEzelVadDFpbmcrdWx3aDJlZTRtZXVKcTZoLzk3MUpzcEZZL1hCaGNmcTRxQ05xVmpzcQpTWm5Xb0dkQ082SjhDeFBJZW1EMklVSHpqb3l5ZUVqM1JWeWR1cDZwY1daQW1oemtLclF6VW1Wa0lFaGhkQ3dnClNXNWpMaUFvWVhWNGFXeHBZWEo1SUd0bGVTa2dQSE5sWTNWeWFYUjVRSEpsWkdoaGRDNWpiMjAraUY0RUV4RUMKQUI0RkFrVndER2tDR3dNR0N3a0lCd01DQXhVQ0F3TVdBZ0VDSGdFQ0Y0QUFDZ2tRUldpY2lDK21XT0MxclFDZwpvb05MQ0ZPek5QY3ZoZDlaYThDODAxSG1uc1lBbmlDdzN5enJDcXRqWW54RER4bHVmSDBGVlR3WAo9ZC9ibQotLS0tLUVORCBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCg==" + } + ] + } + } +} diff --git a/test/redhat_sigstore.yaml b/test/redhat_sigstore.yaml new file mode 100644 index 000000000..835528538 --- /dev/null +++ b/test/redhat_sigstore.yaml @@ -0,0 +1,3 @@ +docker: + registry.access.redhat.com: + sigstore: https://access.redhat.com/webassets/docker/content/sigstore diff --git a/test/registries.conf b/test/registries.conf new file mode 100644 index 000000000..f3bf092b0 --- /dev/null +++ b/test/registries.conf @@ -0,0 +1,9 @@ +[registries.search] +registries = ['registry.access.redhat.com', 'registry.fedoraproject.org', 'docker.io'] + +[registries.insecure] +registries = [] + +#blocked (docker only) +[registries.block] +registries = [] diff --git a/test/restore.bats b/test/restore.bats new file mode 100644 index 000000000..264096ed8 --- /dev/null +++ b/test/restore.bats @@ -0,0 +1,267 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "crio restore" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl pod list --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + pod_list_info="$output" + + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + pod_status_info="$output" + + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr list --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_list_info="$output" + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_status_info="$output" + + stop_crio + + start_crio + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" != "" ]] + [[ "${output}" =~ "${pod_id}" ]] + + run crioctl pod list --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" == "${pod_list_info}" ]] + + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" == "${pod_status_info}" ]] + + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" != "" ]] + [[ "${output}" =~ "${ctr_id}" ]] + + run crioctl ctr list --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" == "${ctr_list_info}" ]] + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" == "${ctr_status_info}" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "crio restore with bad state and pod stopped" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + stop_crio + + # simulate reboot with runc state going away + for i in $("$RUNTIME" list -q | xargs); do "$RUNTIME" delete -f $i; done + + start_crio + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_pods + stop_crio +} + +@test "crio restore with bad state and ctr stopped" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + stop_crio + + # simulate reboot with runc state going away + for i in $("$RUNTIME" list -q | xargs); do "$RUNTIME" delete -f $i; done + + start_crio + + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "crio restore with bad state and ctr removed" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr remove --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + stop_crio + + # simulate reboot with runc state going away + for i in $("$RUNTIME" list -q | xargs); do "$RUNTIME" delete -f $i; done + + start_crio + + run crioctl ctr stop --id "$ctr_id" + echo "$output" + [ "$status" -eq 1 ] + [[ "${output}" =~ "not found" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "crio restore with bad state and pod removed" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + stop_crio + + # simulate reboot with runc state going away + for i in $("$RUNTIME" list -q | xargs); do "$RUNTIME" delete -f $i; done + + start_crio + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_pods + stop_crio +} + +@test "crio restore with bad state" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" =~ "SANDBOX_READY" ]] + + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" =~ "CONTAINER_CREATED" ]] + + stop_crio + + # simulate reboot with runc state going away + for i in $("$RUNTIME" list -q | xargs); do "$RUNTIME" delete -f $i; done + + start_crio + run crioctl pod list + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" != "" ]] + [[ "${output}" =~ "${pod_id}" ]] + + run crioctl pod status --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" =~ "SANDBOX_NOTREADY" ]] + + run crioctl ctr list + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" != "" ]] + [[ "${output}" =~ "${ctr_id}" ]] + + run crioctl ctr status --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + [[ "${output}" =~ "CONTAINER_EXITED" ]] + [[ "${output}" =~ "Exit Code: 255" ]] + + run crioctl pod stop --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl pod remove --id "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/runtimeversion.bats b/test/runtimeversion.bats new file mode 100644 index 000000000..f0d2a4367 --- /dev/null +++ b/test/runtimeversion.bats @@ -0,0 +1,15 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "crioctl runtimeversion" { + start_crio + run crioctl runtimeversion + echo "$output" + [ "$status" -eq 0 ] + stop_crio +} diff --git a/test/seccomp.bats b/test/seccomp.bats new file mode 100644 index 000000000..b77a7f8cf --- /dev/null +++ b/test/seccomp.bats @@ -0,0 +1,368 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +# 1. test running with ctr unconfined +# test that we can run with a syscall which would be otherwise blocked +@test "ctr seccomp profiles unconfined" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/testname": "unconfined"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp1.json + run crioctl pod run --name seccomp1 --config "$TESTDIR"/seccomp1.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 2. test running with ctr runtime/default +# test that we cannot run with a syscall blocked by the default seccomp profile +@test "ctr seccomp profiles runtime/default" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/testname2": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp2.json + run crioctl pod run --name seccomp2 --config "$TESTDIR"/seccomp2.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname2 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + [[ "$output" =~ "Operation not permitted" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 3. test running with ctr wrong profile name +@test "ctr seccomp profiles wrong profile name" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/testname3": "notgood"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp3.json + run crioctl pod run --name seccomp3 --config "$TESTDIR"/seccomp3.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname3 --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -ne 0 ] + [[ "$output" =~ "unknown seccomp profile option:" ]] + [[ "$output" =~ "notgood" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# TODO(runcom): need https://issues.k8s.io/36997 +# 4. test running with ctr localhost/profile_name +@test "ctr seccomp profiles localhost/profile_name" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + #sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + #sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + #sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + #start_crio "$TESTDIR"/seccomp_profile1.json + + skip "need https://issues.k8s.io/36997" +} + +# 5. test running with unkwown ctr profile falls back to pod profile +# unknown ctr -> unconfined +# pod -> runtime/default +# result: fail chmod +@test "ctr seccomp profiles falls back to pod profile" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/redhat\.test\.crio-seccomp2-1-testname2-0-not-exists": "unconfined", "seccomp\.security\.alpha\.kubernetes\.io\/pod": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp5.json + run crioctl pod run --name seccomp5 --config "$TESTDIR"/seccomp5.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + [[ "$output" =~ "Operation not permitted" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 6. test running with unkwown ctr profile and no pod, falls back to unconfined +# unknown ctr -> runtime/default +# pod -> NO +# result: success, running unconfined +@test "ctr seccomp profiles falls back to unconfined" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/redhat\.test\.crio-seccomp6-1-testname6-0-not-exists": "runtime-default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp6.json + run crioctl pod run --name seccomp6 --config "$TESTDIR"/seccomp6.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname6 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 1. test running with pod unconfined +# test that we can run with a syscall which would be otherwise blocked +@test "pod seccomp profiles unconfined" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"seccomp\.security\.alpha\.kubernetes\.io\/pod": "unconfined"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp1.json + run crioctl pod run --name seccomp1 --config "$TESTDIR"/seccomp1.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 2. test running with pod runtime/default +# test that we cannot run with a syscall blocked by the default seccomp profile +@test "pod seccomp profiles runtime/default" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"seccomp\.security\.alpha\.kubernetes\.io\/pod": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp2.json + run crioctl pod run --name seccomp2 --config "$TESTDIR"/seccomp2.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + [[ "$output" =~ "Operation not permitted" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# 3. test running with pod wrong profile name +@test "pod seccomp profiles wrong profile name" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + # 3. test running with pod wrong profile name + sed -e 's/%VALUE%/,"seccomp\.security\.alpha\.kubernetes\.io\/pod": "notgood"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp3.json + run crioctl pod run --name seccomp3 --config "$TESTDIR"/seccomp3.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_config.json --pod "$pod_id" + echo "$output" + [ "$status" -ne 0 ] + [[ "$output" =~ "unknown seccomp profile option:" ]] + [[ "$output" =~ "notgood" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +# TODO(runcom): need https://issues.k8s.io/36997 +# 4. test running with pod localhost/profile_name +@test "pod seccomp profiles localhost/profile_name" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + #sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + #sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + #sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + #start_crio "$TESTDIR"/seccomp_profile1.json + + skip "need https://issues.k8s.io/36997" +} + +# test running with ctr docker/default +# test that we cannot run with a syscall blocked by the default seccomp profile +@test "ctr seccomp profiles docker/default" { + # this test requires seccomp, so skip this test if seccomp is not enabled. + enabled=$(is_seccomp_enabled) + if [[ "$enabled" -eq 0 ]]; then + skip "skip this test since seccomp is not enabled." + fi + + sed -e 's/"chmod",//' "$CRIO_ROOT"/cri-o/seccomp.json > "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmod",//' "$TESTDIR"/seccomp_profile1.json + sed -i 's/"fchmodat",//g' "$TESTDIR"/seccomp_profile1.json + + start_crio "$TESTDIR"/seccomp_profile1.json + + sed -e 's/%VALUE%/,"container\.seccomp\.security\.alpha\.kubernetes\.io\/testname2": "docker\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/seccomp2.json + run crioctl pod run --name seccomp2 --config "$TESTDIR"/seccomp2.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --name testname2 --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + run crioctl ctr execsync --id "$ctr_id" chmod 777 . + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "Exit code: 1" ]] + [[ "$output" =~ "Operation not permitted" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/selinux.bats b/test/selinux.bats new file mode 100644 index 000000000..1617e5546 --- /dev/null +++ b/test/selinux.bats @@ -0,0 +1,26 @@ +#!/usr/bin/env bats + +load helpers + +function teardown() { + cleanup_test +} + +@test "ctr termination reason Completed" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config_selinux.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + cleanup_ctrs + cleanup_pods + stop_crio +} diff --git a/test/test_runner.sh b/test/test_runner.sh new file mode 100755 index 000000000..868df60e3 --- /dev/null +++ b/test/test_runner.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +set -e + +cd "$(dirname "$(readlink -f "$BASH_SOURCE")")" + +# Load the helpers. +. helpers.bash + +function execute() { + >&2 echo "++ $@" + eval "$@" +} + +# Tests to run. Defaults to all. +TESTS=${@:-.} + +# Run the tests. +execute time bats --tap $TESTS diff --git a/test/testdata/README.md b/test/testdata/README.md new file mode 100644 index 000000000..afc6b32f0 --- /dev/null +++ b/test/testdata/README.md @@ -0,0 +1,15 @@ +In terminal 1: +``` +sudo ./crio +``` + +In terminal 2: +``` +sudo ./crioctl runtimeversion + +sudo rm -rf /var/lib/containers/storage/sandboxes/podsandbox1 +sudo ./crioctl pod run --config testdata/sandbox_config.json + +sudo rm -rf /var/lib/containers/storage/containers/container1 +sudo ./crioctl container create --pod podsandbox1 --config testdata/container_config.json +``` diff --git a/test/testdata/apparmor_test_deny_write b/test/testdata/apparmor_test_deny_write new file mode 100644 index 000000000..55311aaf5 --- /dev/null +++ b/test/testdata/apparmor_test_deny_write @@ -0,0 +1,10 @@ +#include <tunables/global> + +profile apparmor-test-deny-write flags=(attach_disconnected) { + #include <abstractions/base> + + file, + + # Deny all file writes. + deny /** w, +} diff --git a/test/testdata/container_config.json b/test/testdata/container_config.json new file mode 100644 index 000000000..d8ef76a56 --- /dev/null +++ b/test/testdata/container_config.json @@ -0,0 +1,70 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "redis:alpine" + }, + "command": [ + "/bin/ls" + ], + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "readonly_rootfs": false, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + }, + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + } + } + } +} diff --git a/test/testdata/container_config_by_imageid.json b/test/testdata/container_config_by_imageid.json new file mode 100644 index 000000000..d953efb3c --- /dev/null +++ b/test/testdata/container_config_by_imageid.json @@ -0,0 +1,70 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "%VALUE%" + }, + "command": [ + "/bin/ls" + ], + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "readonly_rootfs": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_hostport.json b/test/testdata/container_config_hostport.json new file mode 100644 index 000000000..e5a0ca67a --- /dev/null +++ b/test/testdata/container_config_hostport.json @@ -0,0 +1,72 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "busybox:latest" + }, + "command": [ + "/bin/nc", "-ll", "-p", "80", "-e" + ], + "args": [ + "/bin/hostname" + ], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "readonly_rootfs": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_logging.json b/test/testdata/container_config_logging.json new file mode 100644 index 000000000..8e8d0da44 --- /dev/null +++ b/test/testdata/container_config_logging.json @@ -0,0 +1,72 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "busybox:latest" + }, + "command": [ + "/bin/sh", "-c" + ], + "args": [ + "%shellcommand%" + ], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "readonly_rootfs": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_resolvconf.json b/test/testdata/container_config_resolvconf.json new file mode 100644 index 000000000..52b77e082 --- /dev/null +++ b/test/testdata/container_config_resolvconf.json @@ -0,0 +1,72 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "redis:alpine" + }, + "command": [ + "sh", + "-c", + "echo test >> /etc/resolv.conf" + ], + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "readonly_rootfs": false, + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_resolvconf_ro.json b/test/testdata/container_config_resolvconf_ro.json new file mode 100644 index 000000000..7e121c079 --- /dev/null +++ b/test/testdata/container_config_resolvconf_ro.json @@ -0,0 +1,72 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "redis:alpine" + }, + "command": [ + "sh", + "-c", + "echo test >> /etc/resolv.conf" + ], + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "readonly_rootfs": true, + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_seccomp.json b/test/testdata/container_config_seccomp.json new file mode 100644 index 000000000..582132b0e --- /dev/null +++ b/test/testdata/container_config_seccomp.json @@ -0,0 +1,72 @@ +{ + "metadata": { + "name": "container1", + "attempt": 1 + }, + "image": { + "image": "redis:alpine" + }, + "command": [ + "/bin/bash" + ], + "args": [ + "/bin/chmod", "777", "." + ], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "readonly_rootfs": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/container_config_sleep.json b/test/testdata/container_config_sleep.json new file mode 100644 index 000000000..c86ff7011 --- /dev/null +++ b/test/testdata/container_config_sleep.json @@ -0,0 +1,71 @@ +{ + "metadata": { + "name": "container999", + "attempt": 1 + }, + "image": { + "image": "docker.io/library/busybox:latest" + }, + "command": [ + "sleep", + "9999" + ], + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "readonly_rootfs": false, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + }, + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + } + } + } +} diff --git a/test/testdata/container_exit_test.json b/test/testdata/container_exit_test.json new file mode 100644 index 000000000..6ead905a6 --- /dev/null +++ b/test/testdata/container_exit_test.json @@ -0,0 +1,22 @@ +{ + "metadata": { + "name": "podsandbox1-exit-test" + }, + "image": { + "image": "docker://mrunalp/exit_test:latest" + }, + "args": [ + "/exit_test" + ], + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + } + ], + "readonly_rootfs": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false +} diff --git a/test/testdata/container_redis.json b/test/testdata/container_redis.json new file mode 100644 index 000000000..638aba4fc --- /dev/null +++ b/test/testdata/container_redis.json @@ -0,0 +1,61 @@ +{ + "metadata": { + "name": "podsandbox1-redis" + }, + "image": { + "image": "redis:alpine" + }, + "args": [ + "docker-entrypoint.sh", + "redis-server" + ], + "working_dir": "/data", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "REDIS_VERSION", + "value": "3.2.3" + }, + { + "key": "REDIS_DOWNLOAD_URL", + "value": "http://download.redis.io/releases/redis-3.2.3.tar.gz" + }, + { + "key": "REDIS_DOWNLOAD_SHA1", + "value": "92d6d93ef2efc91e595c8bf578bf72baff397507" + } + ], + "labels": { + "tier": "backend" + }, + "annotations": { + "pod": "podsandbox1" + }, + "readonly_rootfs": false, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "sys_admin" + ] + } + } + } +} diff --git a/test/testdata/container_redis_default_mounts.json b/test/testdata/container_redis_default_mounts.json new file mode 100644 index 000000000..dff3db5a7 --- /dev/null +++ b/test/testdata/container_redis_default_mounts.json @@ -0,0 +1,67 @@ +{ + "metadata": { + "name": "podsandbox1-redis" + }, + "image": { + "image": "redis:alpine" + }, + "args": [ + "docker-entrypoint.sh", + "redis-server" + ], + "mounts": [ + { + "container_path": "%CPATH%", + "host_path": "%HPATH%" + } + ], + "working_dir": "/data", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "REDIS_VERSION", + "value": "3.2.3" + }, + { + "key": "REDIS_DOWNLOAD_URL", + "value": "http://download.redis.io/releases/redis-3.2.3.tar.gz" + }, + { + "key": "REDIS_DOWNLOAD_SHA1", + "value": "92d6d93ef2efc91e595c8bf578bf72baff397507" + } + ], + "labels": { + "tier": "backend" + }, + "annotations": { + "pod": "podsandbox1" + }, + "readonly_rootfs": false, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "sys_admin" + ] + } + } + } +} diff --git a/test/testdata/container_redis_device.json b/test/testdata/container_redis_device.json new file mode 100644 index 000000000..2a2495515 --- /dev/null +++ b/test/testdata/container_redis_device.json @@ -0,0 +1,68 @@ +{ + "metadata": { + "name": "podsandbox1-redis" + }, + "image": { + "image": "redis:alpine" + }, + "args": [ + "docker-entrypoint.sh", + "redis-server" + ], + "working_dir": "/data", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "REDIS_VERSION", + "value": "3.2.3" + }, + { + "key": "REDIS_DOWNLOAD_URL", + "value": "http://download.redis.io/releases/redis-3.2.3.tar.gz" + }, + { + "key": "REDIS_DOWNLOAD_SHA1", + "value": "92d6d93ef2efc91e595c8bf578bf72baff397507" + } + ], + "devices": [ + { + "host_path": "/dev/null", + "container_path": "/dev/mynull", + "permissions": "rwm" + } + ], + "labels": { + "tier": "backend" + }, + "annotations": { + "pod": "podsandbox1" + }, + "readonly_rootfs": false, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "capabilities": { + "add_capabilities": [ + "sys_admin" + ] + } + } + } +} diff --git a/test/testdata/fake_ocid_default b/test/testdata/fake_ocid_default new file mode 100644 index 000000000..915fb17dd --- /dev/null +++ b/test/testdata/fake_ocid_default @@ -0,0 +1 @@ +profile crio-default flags=(attach_disconnected) {} diff --git a/test/testdata/sandbox_config.json b/test/testdata/sandbox_config.json new file mode 100644 index 000000000..57e211bd6 --- /dev/null +++ b/test/testdata/sandbox_config.json @@ -0,0 +1,51 @@ +{ + "metadata": { + "name": "podsandbox1", + "uid": "redhat-test-crio", + "namespace": "redhat.test.crio", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_config": { + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng", + "security.alpha.kubernetes.io/sysctls": "kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000", + "security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" , + "security.alpha.kubernetes.io/seccomp/pod": "unconfined" + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": false, + "host_pid": false, + "host_ipc": false + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/sandbox_config_hostnet.json b/test/testdata/sandbox_config_hostnet.json new file mode 100644 index 000000000..99a7560dc --- /dev/null +++ b/test/testdata/sandbox_config_hostnet.json @@ -0,0 +1,48 @@ +{ + "metadata": { + "name": "podsandbox1", + "uid": "redhat-test-crio", + "namespace": "redhat.test.crio", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_options": { + "servers": [ + "server1.redhat.com", + "server2.redhat.com" + ], + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng", + "security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" , + "security.alpha.kubernetes.io/seccomp/pod": "unconfined" + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": true, + "host_pid": false, + "host_ipc": false + } + } + } +} diff --git a/test/testdata/sandbox_config_hostport.json b/test/testdata/sandbox_config_hostport.json new file mode 100644 index 000000000..5feda8668 --- /dev/null +++ b/test/testdata/sandbox_config_hostport.json @@ -0,0 +1,55 @@ +{ + "metadata": { + "name": "podsandbox1", + "uid": "redhat-test-crio", + "namespace": "redhat.test.crio", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_options": { + "servers": [ + "server1.redhat.com", + "server2.redhat.com" + ], + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [ + { + "protocol": 0, + "container_port": 80, + "host_port": 4888 + } + ], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng", + "security.alpha.kubernetes.io/sysctls": "kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000", + "security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" , + "security.alpha.kubernetes.io/seccomp/pod": "unconfined" + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": false, + "host_pid": false, + "host_ipc": false + } + } + } +} diff --git a/test/testdata/sandbox_config_seccomp.json b/test/testdata/sandbox_config_seccomp.json new file mode 100644 index 000000000..8e440b164 --- /dev/null +++ b/test/testdata/sandbox_config_seccomp.json @@ -0,0 +1,53 @@ +{ + "metadata": { + "name": "podsandbox1", + "uid": "redhat-test-crio", + "namespace": "redhat.test.crio", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_options": { + "servers": [ + "server1.redhat.com", + "server2.redhat.com" + ], + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng" + %VALUE% + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": false, + "host_pid": false, + "host_ipc": false + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} diff --git a/test/testdata/sandbox_config_selinux.json b/test/testdata/sandbox_config_selinux.json new file mode 100644 index 000000000..916a10ecd --- /dev/null +++ b/test/testdata/sandbox_config_selinux.json @@ -0,0 +1,48 @@ +{ + "metadata": { + "name": "podsandbox1", + "uid": "redhat-test-crio", + "namespace": "redhat.test.crio", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_config": { + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng", + "security.alpha.kubernetes.io/sysctls": "kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000", + "security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" , + "security.alpha.kubernetes.io/seccomp/pod": "unconfined" + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": false, + "host_pid": false, + "host_ipc": false + }, + "selinux_options": { + "level": "s0" + } + } + } +} diff --git a/test/testdata/template_container_config.json b/test/testdata/template_container_config.json new file mode 100644 index 000000000..a770a7c9d --- /dev/null +++ b/test/testdata/template_container_config.json @@ -0,0 +1,68 @@ +{ + "metadata": { + "name": "${NAME}", + "attempt": 1 + }, + "image": { + "image": "${IMAGE}" + }, + "command": ${COMMAND}, + "args": [], + "working_dir": "/", + "envs": [ + { + "key": "PATH", + "value": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + }, + { + "key": "TERM", + "value": "xterm" + }, + { + "key": "TESTDIR", + "value": "test/dir1" + }, + { + "key": "TESTFILE", + "value": "test/file1" + } + ], + "labels": { + "type": "small", + "batch": "no" + }, + "annotations": { + "owner": "dragon", + "daemon": "crio" + }, + "privileged": true, + "log_path": "", + "stdin": false, + "stdin_once": false, + "tty": false, + "linux": { + "resources": { + "cpu_period": 10000, + "cpu_quota": 20000, + "cpu_shares": 512, + "oom_score_adj": 30 + }, + "security_context": { + "readonly_rootfs": false, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + }, + "capabilities": { + "add_capabilities": [ + "setuid", + "setgid" + ], + "drop_capabilities": [ + ] + } + } + } +} diff --git a/test/testdata/template_sandbox_config.json b/test/testdata/template_sandbox_config.json new file mode 100644 index 000000000..f43ffb0d6 --- /dev/null +++ b/test/testdata/template_sandbox_config.json @@ -0,0 +1,51 @@ +{ + "metadata": { + "name": "${NAME}", + "uid": "${CUID}", + "namespace": "${NAMESPACE}", + "attempt": 1 + }, + "hostname": "crioctl_host", + "log_directory": "", + "dns_config": { + "searches": [ + "8.8.8.8" + ] + }, + "port_mappings": [], + "resources": { + "cpu": { + "limits": 3, + "requests": 2 + }, + "memory": { + "limits": 50000000, + "requests": 2000000 + } + }, + "labels": { + "group": "test" + }, + "annotations": { + "owner": "hmeng", + "security.alpha.kubernetes.io/sysctls": "kernel.shm_rmid_forced=1,net.ipv4.ip_local_port_range=1024 65000", + "security.alpha.kubernetes.io/unsafe-sysctls": "kernel.msgmax=8192" , + "security.alpha.kubernetes.io/seccomp/pod": "unconfined" + }, + "linux": { + "cgroup_parent": "/Burstable/pod_123-456", + "security_context": { + "namespace_options": { + "host_network": false, + "host_pid": false, + "host_ipc": false + }, + "selinux_options": { + "user": "system_u", + "role": "system_r", + "type": "svirt_lxc_net_t", + "level": "s0:c4,c5" + } + } + } +} |