Unit tests for NET_ADMIN capability
@@ -627,8 +627,16 @@ var _ = Describe("Template", func() {
tun, ok := pod.Spec.Containers[0].Resources.Limits[TunDevice]
Expect(ok).To(BeTrue())
-
Expect(int(tun.Value())).To(Equal(1))
+
+ found := false
+ caps := pod.Spec.Containers[0].SecurityContext.Capabilities
+ for _, cap := range caps.Add {
+ if cap == CAP_NET_ADMIN {
+ found = true
+ }
+ }
+ Expect(found).To(BeTrue(), "Expected compute container to be granted NET_ADMIN capability")
})
It("Should require tun device if explicitly requested", func() {
@@ -647,8 +655,16 @@ var _ = Describe("Template", func() {
tun, ok := pod.Spec.Containers[0].Resources.Limits[TunDevice]
Expect(ok).To(BeTrue())
-
Expect(int(tun.Value())).To(Equal(1))
+
+ found := false
+ caps := pod.Spec.Containers[0].SecurityContext.Capabilities
+ for _, cap := range caps.Add {
+ if cap == CAP_NET_ADMIN {
+ found = true
+ }
+ }
+ Expect(found).To(BeTrue(), "Expected compute container to be granted NET_ADMIN capability")
})
It("Should not require tun device if explicitly rejected", func() {
@@ -667,6 +683,15 @@ var _ = Describe("Template", func() {
_, ok := pod.Spec.Containers[0].Resources.Limits[TunDevice]
Expect(ok).To(BeFalse())
+
+ found := false
+ caps := pod.Spec.Containers[0].SecurityContext.Capabilities
+ for _, cap := range caps.Add {
+ if cap == CAP_NET_ADMIN {
+ found = true
+ }
+ }
+ Expect(found).To(BeFalse(), "Expected compute container to not be granted NET_ADMIN capability")
})
})
})
