opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-25 02:04:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9283 from vrothberg/fix-8897

Browse Source 
generate kube: do not set caps with --privileged
This commit is contained in:
OpenShift Merge Robot
2021-02-09 14:23:15 -05:00
committed by GitHub
parent 763d522983 48c612cf66
commit 995a60481a
2 changed files with 48 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
test/e2e/generate_kube_test.go
View File

@ -699,4 +699,39 @@ ENTRYPOINT /bin/sleep`
Expect(containers[0].Command).To(Equal([]string{"/bin/sh", "-c", "/bin/sleep"}))
Expect(containers[0].Args).To(Equal([]string{"10s"}))
})
It("podman generate kube - --privileged container", func() {
session := podmanTest.Podman([]string{"create", "--pod", "new:testpod", "--privileged", ALPINE, "ls"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
kube := podmanTest.Podman([]string{"generate", "kube", "testpod"})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
// Now make sure that the capabilities aren't set.
pod := new(v1.Pod)
err := yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).To(BeNil())
containers := pod.Spec.Containers
Expect(len(containers)).To(Equal(1))
Expect(containers[0].SecurityContext.Capabilities).To(BeNil())
// Now make sure we can also `play` it.
kubeFile := filepath.Join(podmanTest.TempDir, "kube.yaml")
kube = podmanTest.Podman([]string{"generate", "kube", "testpod", "-f", kubeFile})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
// Remove the pod so play can recreate it.
kube = podmanTest.Podman([]string{"pod", "rm", "-f", "testpod"})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
kube = podmanTest.Podman([]string{"play", "kube", kubeFile})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Equal(0))
})
})