Skip to content

Unprivileged user conformance test#4071

Merged
knative-prow-robot merged 3 commits intoknative:masterfrom
dgerd:unprivileged-user
May 10, 2019
Merged

Unprivileged user conformance test#4071
knative-prow-robot merged 3 commits intoknative:masterfrom
dgerd:unprivileged-user

Conversation

@dgerd
Copy link
Copy Markdown

@dgerd dgerd commented May 10, 2019

This adds a test to validate that a container specified user is
respected when executed within Knative.

Fixes #3223

Unprivileged user conformance test
d8514c4 
This adds a test to validate that a container specified user is
respected when executed within Knative.

Fixes knative#3223
@googlebot googlebot added the cla: yes Indicates the PR's author has signed the CLA. label May 10, 2019
@knative-prow-robot knative-prow-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 10, 2019
knative-prow-robot
knative-prow-robot reviewed May 10, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@knative-prow-robot knative-prow-robot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dgerd: 1 warning.

Details

In response to this:

This adds a test to validate that a container specified user is
respected when executed within Knative.

Fixes #3223

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Comment thread test/conformance/conformancetest_helper.go Outdated
@knative-prow-robot knative-prow-robot added the area/test-and-release It flags unit/e2e/conformance/perf test issues for product features label May 10, 2019
vagababov
vagababov reviewed May 10, 2019
View reviewed changes
Comment thread test/conformance/conformancetest_helper.go
names.Service = test.ObjectNameForTest(t)
if names.Image == "" {
names.Image = runtime
} else if names.Image != runtimeUnprivileged {
Copy link
Copy Markdown
Contributor

@vagababov vagababov May 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this restriction?

Copy link
Copy Markdown
Author

@dgerd dgerd May 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The function won't work unless the service returns the expected runtime image response. I put it there mostly for easy debugging if an unexpected image is passed in.

I thought about adding an unprivileged bool/enum rather than using the resource names, but it felt worse.

Comment thread test/conformance/conformancetest_helper.go Outdated
Comment thread test/test_images/runtime-unprivileged/main.go Outdated
@googlebot
Copy link
Copy Markdown

googlebot commented May 10, 2019

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

ℹ️ Googlers: Go here for more info.

1 similar comment
@googlebot
Copy link
Copy Markdown

googlebot commented May 10, 2019

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added cla: no Indicates the PR's author has not signed the CLA. and removed cla: yes Indicates the PR's author has signed the CLA. labels May 10, 2019
@dgerd dgerd force-pushed the unprivileged-user branch from c96e3da to f1071d3 Compare May 10, 2019 17:48
@googlebot
Copy link
Copy Markdown

googlebot commented May 10, 2019

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added cla: yes Indicates the PR's author has signed the CLA. and removed cla: no Indicates the PR's author has not signed the CLA. labels May 10, 2019
vagababov
vagababov reviewed May 10, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@vagababov vagababov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@knative-prow-robot knative-prow-robot added the lgtm Indicates that a PR is ready to be merged. label May 10, 2019
@dgerd
Copy link
Copy Markdown
Author

dgerd commented May 10, 2019

/assign @mattmoor

mattmoor
mattmoor reviewed May 10, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@mattmoor mattmoor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@knative-prow-robot
Copy link
Copy Markdown
Contributor

knative-prow-robot commented May 10, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dgerd, mattmoor

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow-robot knative-prow-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 10, 2019
@knative-prow-robot knative-prow-robot merged commit 5fed6d7 into knative:master May 10, 2019
JRBANCEL pushed a commit to JRBANCEL/serving that referenced this pull request May 29, 2019
@JRBANCEL
Unprivileged user conformance test (knative#4071)
bf1f089 
* Unprivileged user conformance test

This adds a test to validate that a container specified user is
respected when executed within Knative.

Fixes knative#3223

* Capitalization fix

* Code Review comments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@knative-prow-robot knative-prow-robot knative-prow-robot left review comments

@srinivashegde86 srinivashegde86 Awaiting requested review from srinivashegde86

@tcnghia tcnghia Awaiting requested review from tcnghia

+2 more reviewers

@vagababov vagababov vagababov left review comments

@mattmoor mattmoor mattmoor left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@vagababov vagababov

@mattmoor mattmoor

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/test-and-release It flags unit/e2e/conformance/perf test issues for product features cla: yes Indicates the PR's author has signed the CLA. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add conformance test to validate runAsUser is as specified

5 participants

@dgerd @googlebot @knative-prow-robot @vagababov @mattmoor