UPSTREAM: <carry>: storage: switch test pods to privileged to survive selinux
@@ -45,7 +45,7 @@ import (
"strconv"
"time"
- "k8s.io/api/core/v1"
+ v1 "k8s.io/api/core/v1"
apierrs "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
@@ -426,7 +426,7 @@ func TestCleanup(f *framework.Framework, config TestConfig) {
}
}
-func runVolumeTesterPod(client clientset.Interface, config TestConfig, podSuffix string, fsGroup *int64, tests []Test) (*v1.Pod, error) {
+func runVolumeTesterPod(client clientset.Interface, config TestConfig, podSuffix string, fsGroup *int64, privileged bool, tests []Test) (*v1.Pod, error) {
ginkgo.By(fmt.Sprint("starting ", config.Prefix, "-", podSuffix))
var gracePeriod int64 = 1
var command string
@@ -459,6 +459,7 @@ func runVolumeTesterPod(client clientset.Interface, config TestConfig, podSuffix
// We expect that /opt is empty in the minimal containers which we use in this test.
Command: GenerateScriptCmd(command),
VolumeMounts: []v1.VolumeMount{},
+ SecurityContext: GenerateSecurityContext(privileged),
},
},
TerminationGracePeriodSeconds: &gracePeriod,
@@ -547,7 +548,7 @@ func testVolumeContent(client clientset.Interface, pod *v1.Pod, fsGroup *int64,
// Multiple Tests can be specified to mount multiple volumes to a single
// pod.
func TestVolumeClient(client clientset.Interface, config TestConfig, fsGroup *int64, fsType string, tests []Test) {
- clientPod, err := runVolumeTesterPod(client, config, "client", fsGroup, tests)
+ clientPod, err := runVolumeTesterPod(client, config, "client", fsGroup, false, tests)
if err != nil {
framework.Failf("Failed to create client pod: %v", err)
@@ -560,7 +561,7 @@ func TestVolumeClient(client clientset.Interface, config TestConfig, fsGroup *in
// starting and auxiliary pod which writes the file there.
// The volume must be writable.
func InjectContent(client clientset.Interface, config TestConfig, fsGroup *int64, fsType string, tests []Test) {
- injectorPod, err := runVolumeTesterPod(client, config, "injector", fsGroup, tests)
+ injectorPod, err := runVolumeTesterPod(client, config, "injector", fsGroup, true, tests)
if err != nil {
framework.Failf("Failed to create injector pod: %v", err)
return
