Not all tests require to run privileged #25084
Description
I've tried to run the openshift/conformance/parallel/minimal test suite ( without those labeled as ClusterAdmin) like:
openshift-tests run all --dry-run 2>/dev/null| grep "openshift/conformance/parallel/minimal" | grep -v -i "clusteradmin" | openshift-tests run --junit-dir=./ -f -
against an OCP 4.5 cluster without being cluster-admin (just a regular user):
$ oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 -d > users.htpasswd
$ htpasswd -bB users.htpasswd nonadmin nonadmin
Adding password for user nonadmin
$ export KUBECONFIG=/tmp/nonadmin.kubeconfig
$ oc login --insecure-skip-tls-verify=true -u nonadmin -p nonadmin https://api.example.com:6443
$ openshift-tests run all --dry-run 2>/dev/null| grep "openshift/conformance/parallel/minimal" | grep -v -i "clusteradmin" | openshift-tests run --junit-dir=./ -f -
and all tests failed because of:
fail [github.com/openshift/origin/test/extended/util/client.go:693]: Jun 9 10:49:49.077: securitycontextconstraints.security.openshift.io "privileged" is forbidden: User "nonadmin" cannot update resource "securitycontextconstraints" in API group "security.openshift.io" at the cluster scope
I've did some modifications here master...e-minguez:cluster-admin-not-needed and recompiled the openshift-tests binary, executed the same set of tests this time with the same user but with 'admin' cluster-role + a custom cluster role to be able to create/delete namespaces:
$ export KUBECONFIG=/tmp/clusteradmin.kubeconfig
$ cat <<EOF | oc apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
openshift.io/description: A user that can create and delete namespaces
name: self-provisioner-namespaces
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- "*"
EOF
$ oc adm policy add-cluster-role-to-user admin nonadmin
$ oc adm policy add-cluster-role-to-user self-provisioner-namespaces nonadmin
And this time, error: 87 fail, 134 pass, 0 skip.
I guess this would be a ton of work, but maybe the tests can request cluster-admin permissions only if needed (and be tagged like that).