Check the order of bootstrapped SCCs.
@@ -2,23 +2,26 @@ package bootstrappolicy
import (
"reflect"
+ "sort"
"testing"
"k8s.io/apiserver/pkg/authentication/serviceaccount"
securityapi "github.com/openshift/origin/pkg/security/apis/security"
+ scc "github.com/openshift/origin/pkg/security/securitycontextconstraints"
sccutil "github.com/openshift/origin/pkg/security/securitycontextconstraints/util"
)
func TestBootstrappedConstraints(t *testing.T) {
- expectedConstraints := []string{
- SecurityContextConstraintPrivileged,
+ // ordering of expectedConstraintNames is important, we check it against scc.ByPriority
+ expectedConstraintNames := []string{
+ SecurityContextConstraintsAnyUID,
+ SecurityContextConstraintsHostNetwork,
SecurityContextConstraintRestricted,
SecurityContextConstraintNonRoot,
- SecurityContextConstraintHostMountAndAnyUID,
SecurityContextConstraintHostNS,
- SecurityContextConstraintsAnyUID,
- SecurityContextConstraintsHostNetwork,
+ SecurityContextConstraintHostMountAndAnyUID,
+ SecurityContextConstraintPrivileged,
}
expectedGroups, expectedUsers := getExpectedAccess()
expectedVolumes := []securityapi.FSType{securityapi.FSTypeEmptyDir, securityapi.FSTypeSecret, securityapi.FSTypeDownwardAPI, securityapi.FSTypeConfigMap, securityapi.FSTypePersistentVolumeClaim}
@@ -26,11 +29,16 @@ func TestBootstrappedConstraints(t *testing.T) {
groups, users := GetBoostrapSCCAccess(DefaultOpenShiftInfraNamespace)
bootstrappedConstraints := GetBootstrapSecurityContextConstraints(groups, users)
- if len(expectedConstraints) != len(bootstrappedConstraints) {
- t.Errorf("unexpected number of constraints: found %d, wanted %d", len(bootstrappedConstraints), len(expectedConstraints))
+ if len(expectedConstraintNames) != len(bootstrappedConstraints) {
+ t.Errorf("unexpected number of constraints: found %d, wanted %d", len(bootstrappedConstraints), len(expectedConstraintNames))
}
- for _, constraint := range bootstrappedConstraints {
+ sort.Sort(scc.ByPriority(bootstrappedConstraints))
+
+ for i, constraint := range bootstrappedConstraints {
+ if constraint.Name != expectedConstraintNames[i] {
+ t.Errorf("unexpected contraint no. %d (by priority). Found %v, wanted %v", i, constraint.Name, expectedConstraintNames[i])
+ }
g := expectedGroups[constraint.Name]
if !reflect.DeepEqual(g, constraint.Groups) {
t.Errorf("unexpected group access for %s. Found %v, wanted %v", constraint.Name, constraint.Groups, g)
