test(integ): add test for RCS process owner #389
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jericht
approved these changes
Apr 13, 2021
horsmand
approved these changes
Apr 14, 2021
There was a problem hiding this comment.
I discussed with Josh about using something like ps to determine what the OS is reporting the process owner as, but he explained how since we're only running these SSM commands against the bastion instance, there is a lot of overhead to running the command against the RCS.
This method of using Deadline Command to query for the list of proxy servers and then read the user from that info relies on Deadline reporting the correct user, but I don't see any reason for that to report incorrectly in the farm setups we use in our integration tests, so I believe this is fine.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The RFDK integration tests does not have any coverage for the owning user of the process that the Deadline RCS runs as within the ECS task container. This means that we have no assurance that RFDK follows the principle of least-privilege with respect to the process permissions within these containers.
Solution
Add a test that checks the OS user of the RCS process running within the ECS task containers deployed by RFDK's
RenderQueueconstruct. The Deadline RCS already reports it's process' user to Deadline's database. This tests relies on:which returns this information as reported by the RCS.
Testing
Ran the integration tests and confirmed that the new test was run and passed:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license