[sig-storage] Run storage e2e test_client_pod as privileged #104551

Elbehery · 2021-08-24T16:20:23Z

What type of PR is this?

/kind bug
/kind storage
/kind failing-test

What this PR does / why we need it:

Fix running storage e2e tests in SELinux environment.

HostPath Volume Plugin creates a directory within /tmp on host machine, to be mounted as volume. Usually, Inject-pod writes content to the volume, and a Client-pod tried the read the contents and verify.

When SELinux is enabled on the host, Client-pod can not read the content, with permission denied.

This PR run the Client-pod as privileged, so that it can access the volume content, even when SELinux is enabled on the host.

Which issue(s) this PR fixes:

Fixes #84585

Fixes hostpath storage e2e tests within SELinux enabled env

k8s-ci-robot · 2021-08-24T16:20:26Z

@Elbehery: The label(s) kind/storage cannot be applied, because the repository doesn't have them.

In response to this:

What type of PR is this?

/kind bug
/kind storage
/kind failing-test

What this PR does / why we need it:

Fix running storage e2e tests in SELinux environment.

HostPath Volume Plugin creates a directory within /tmp on host machine, to be mounted as volume. Usually, Inject-pod writes content to the volume, and a Client-pod tried the read the contents and verify.

When SELinux is enabled on the host, Client-pod can not read the content, with permission denied.

This PR run the Client-pod as privileged, so that it can access the volume content, even when SELinux is enabled on the host.

Which issue(s) this PR fixes:

Fixes #84585

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-08-24T16:20:30Z

@Elbehery: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-08-24T16:20:31Z

Hi @Elbehery. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

gnufied · 2021-08-24T17:59:35Z

IIRC privileged containers don't get to bypass SELinux policies. So if SELinux was blocking them before, it will block them after. Please test carefully before going ahead with this approach.

Elbehery · 2021-08-30T09:40:32Z

IIRC privileged containers don't get to bypass SELinux policies. So if SELinux was blocking them before, it will block them after. Please test carefully before going ahead with this approach.

@gnufied i have tested this on a cluster with SELinux enabled and the test passed successfully
cc @vrutkovs @bertinatto

ping035627 · 2021-09-03T06:09:27Z

/ok-to-test

bertinatto · 2021-09-03T18:34:12Z

test/e2e/framework/volume/fixtures.go

@@ -511,8 +511,9 @@ func TestVolumeClientSlow(f *framework.Framework, config TestConfig, fsGroup *in
 }

 func testVolumeClient(f *framework.Framework, config TestConfig, fsGroup *int64, fsType string, tests []Test, slow bool) {
+	privileged := true


@Elbehery, thank you for working on this.

I have a question for you. Although this fixes the issue, could you check if you can set privileged = true only when the HostPath plugin is being used? Perhaps we could add a flag for that in the plugin definition.

The idea is to avoid always going privileged. Thanks!

@bertinatto I have adjusted the fix to use privileged only for this scenario.
cc @vrutkovs

bertinatto · 2021-10-15T13:12:12Z

test/e2e/framework/volume/fixtures.go

-
+	if (config.Prefix == "hostpathsymlink" || config.Prefix == "hostpath") && podSuffix == "client" {
+		privileged = true
+	}


@Elbehery could you add a comment stating why you're making it privileged on hostpath? The explanation from the PR description looks good to me 😉

Also, I think you can remove the last condition (podSuffix == "client").

@bertinatto sure I add the comment 👍🏽 ..
Just about the podSuffix == "client" condition, the test fails because the client-pod can not read the data on the mounted volume when SELinux enabled, this will minimise the privileged pods.

Shall I remove it or leave it ?

As we spoke offline, the pod that writes the content is already privileged (that's the reason it's able to write to the host's /tmp directory). IMO we can safely remove podSuffix == "client".

yes I removed it already in the most recent commit 👍🏽

Elbehery · 2021-10-18T12:03:17Z

@bertinatto I have added a comment and updated the commit msg

hostPath volume plugin creates a directory within /tmp on host machine, to be mounted as volume. inject-pod writes content to the volume, and a client-pod tried the read the contents and verify. when SELinux is enabled on the host, client-pod can not read the content, with permission denied. running the client-pod as privileged, so that it can access the volume content, even when SEinux is enabled on the host.

bertinatto · 2021-10-19T16:44:16Z

/lgtm
As a next step we could make this configurable so that we can add other plugins/driver, like `csi-hostpath).

Elbehery · 2021-10-19T18:48:58Z

/assign @jsafrane

jsafrane · 2021-10-20T09:14:03Z

/approve

k8s-ci-robot · 2021-10-20T09:14:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Elbehery, jsafrane

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~test/e2e/framework/volume/OWNERS~~ [jsafrane]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jsafrane · 2021-10-20T09:19:07Z

/release-notes-none

…age-client-1.20 Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

…age-client-1.21 Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

…age-client Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Aug 24, 2021

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Aug 24, 2021

k8s-ci-robot requested review from chrishenzie and gnufied August 24, 2021 16:21

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 3, 2021

bertinatto reviewed Sep 3, 2021

View reviewed changes

Elbehery force-pushed the unprivileged_storage_client branch from 4f373a7 to 775a853 Compare October 11, 2021 10:19

bertinatto reviewed Oct 18, 2021

View reviewed changes

Elbehery force-pushed the unprivileged_storage_client branch from 775a853 to 01b6743 Compare October 18, 2021 12:02

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 18, 2021

Elbehery force-pushed the unprivileged_storage_client branch from 01b6743 to 8a5a9bb Compare October 18, 2021 12:15

Elbehery force-pushed the unprivileged_storage_client branch from 8a5a9bb to 04ad18c Compare October 18, 2021 13:06

k8s-ci-robot assigned bertinatto Oct 19, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 19, 2021

k8s-ci-robot assigned jsafrane Oct 19, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 20, 2021

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 20, 2021

k8s-ci-robot merged commit d5de03f into kubernetes:master Oct 20, 2021

k8s-ci-robot added this to the v1.23 milestone Oct 20, 2021

This was referenced Oct 20, 2021

Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged #105786

Merged

Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged #105787

Merged

vrutkovs mentioned this pull request Oct 20, 2021

Bug 2000963: UPSTREAM: 104551: Run storage hostpath e2e test client pod as privileged openshift/kubernetes#1015

Closed

Elbehery mentioned this pull request Oct 20, 2021

Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged #105788

Merged

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Oct 26, 2021

k8s-ci-robot added a commit that referenced this pull request Nov 4, 2021

Merge pull request #105788 from Elbehery/cherrypick-unprivileged-stor…

06fc952

…age-client-1.20 Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

k8s-ci-robot added a commit that referenced this pull request Nov 4, 2021

Merge pull request #105787 from Elbehery/cherrypick-unprivileged-stor…

45bddf0

…age-client-1.21 Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

k8s-ci-robot added a commit that referenced this pull request Nov 4, 2021

Merge pull request #105786 from Elbehery/cherrypick-unprivileged-stor…

6315226

…age-client Cherry pick of #104551: Run storage hostpath e2e test client pod as privileged

Elbehery mentioned this pull request Apr 8, 2022

REQUEST: New membership for elbehery kubernetes/org#3365

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[sig-storage] Run storage e2e test_client_pod as privileged #104551

[sig-storage] Run storage e2e test_client_pod as privileged #104551

Elbehery commented Aug 24, 2021 •

edited

k8s-ci-robot commented Aug 24, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

k8s-ci-robot commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

gnufied commented Aug 24, 2021

Elbehery commented Aug 30, 2021

ping035627 commented Sep 3, 2021

bertinatto Sep 3, 2021

Elbehery Oct 11, 2021

bertinatto Oct 15, 2021

Elbehery Oct 18, 2021

bertinatto Oct 18, 2021

Elbehery Oct 18, 2021

Elbehery commented Oct 18, 2021

bertinatto commented Oct 19, 2021

Elbehery commented Oct 19, 2021

jsafrane commented Oct 20, 2021

k8s-ci-robot commented Oct 20, 2021

jsafrane commented Oct 20, 2021

[sig-storage] Run storage e2e test_client_pod as privileged #104551

[sig-storage] Run storage e2e test_client_pod as privileged #104551

Conversation

Elbehery commented Aug 24, 2021 • edited

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

k8s-ci-robot commented Aug 24, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

k8s-ci-robot commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

gnufied commented Aug 24, 2021

Elbehery commented Aug 30, 2021

ping035627 commented Sep 3, 2021

bertinatto Sep 3, 2021

Choose a reason for hiding this comment

Elbehery Oct 11, 2021

Choose a reason for hiding this comment

bertinatto Oct 15, 2021

Choose a reason for hiding this comment

Elbehery Oct 18, 2021

Choose a reason for hiding this comment

bertinatto Oct 18, 2021

Choose a reason for hiding this comment

Elbehery Oct 18, 2021

Choose a reason for hiding this comment

Elbehery commented Oct 18, 2021

bertinatto commented Oct 19, 2021

Elbehery commented Oct 19, 2021

jsafrane commented Oct 20, 2021

k8s-ci-robot commented Oct 20, 2021

jsafrane commented Oct 20, 2021

Elbehery commented Aug 24, 2021 •

edited