Skip to content

Commit

Permalink
test without system call
Browse files Browse the repository at this point in the history
  • Loading branch information
@Shell32-Natsu
Shell32-Natsu committed Sep 21, 2020
1 parent 700b74c commit d5b0f34
Show file tree
Hide file tree
Showing 4 changed files with 82 additions and 42 deletions.
24 changes: 2 additions & 22 deletions kyaml/fn/runtime/container/container.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ package container

import (
"fmt"
"os/user"

runtimeexec "sigs.k8s.io/kustomize/kyaml/fn/runtime/exec"
"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
Expand Down Expand Up @@ -185,28 +184,9 @@ func (c *Filter) getCommand() (string, []string) {
return "docker", a
}

// getUIDGID will return "nobody" if asCurrentUser is false. Otherwise
// return "uid:gid" according to current user who runs the command.
func getUIDGID(asCurrentUser bool) (string, error) {
if !asCurrentUser {
return "nobody", nil
}

u, err := user.Current()
if err != nil {
return "", err
}
return fmt.Sprintf("%s:%s", u.Uid, u.Gid), nil
}

// NewContainer returns a new container filter
func NewContainer(spec runtimeutil.ContainerSpec, asCurrentUser bool) (Filter, error) {
f := Filter{ContainerSpec: spec}
u, err := getUIDGID(asCurrentUser)
if err != nil {
return f, err
}
f.UIDGID = u
func NewContainer(spec runtimeutil.ContainerSpec, uidgid string) (Filter, error) {
f := Filter{ContainerSpec: spec, UIDGID: uidgid}

return f, nil
}
16 changes: 7 additions & 9 deletions kyaml/fn/runtime/container/container_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package container
import (
"bytes"
"fmt"
"os/user"
"testing"

"github.com/stretchr/testify/assert"
Expand All @@ -16,16 +15,12 @@ import (
)

func TestFilter_setupExec(t *testing.T) {
u, err := user.Current()
if err != nil {
t.Fatal(err)
}
var tests = []struct {
name string
functionConfig string
expectedArgs []string
containerSpec runtimeutil.ContainerSpec
asCurrentUser bool
UIDGID string
}{
{
name: "command",
Expand All @@ -45,6 +40,7 @@ metadata:
containerSpec: runtimeutil.ContainerSpec{
Image: "example.com:version",
},
UIDGID: "nobody",
},

{
Expand All @@ -68,6 +64,7 @@ metadata:
Network: true,
},
},
UIDGID: "nobody",
},

{
Expand Down Expand Up @@ -98,6 +95,7 @@ metadata:
{MountType: "tmpfs", Src: "", DstPath: "/local/"},
},
},
UIDGID: "nobody",
},
{
name: "as current user",
Expand All @@ -111,13 +109,13 @@ metadata:
"--rm",
"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR",
"--network", "none",
"--user", fmt.Sprintf("%s:%s", u.Uid, u.Gid),
"--user", "1:2",
"--security-opt=no-new-privileges",
},
containerSpec: runtimeutil.ContainerSpec{
Image: "example.com:version",
},
asCurrentUser: true,
UIDGID: "1:2",
},
}

Expand All @@ -129,7 +127,7 @@ metadata:
t.FailNow()
}

instance, err := NewContainer(tt.containerSpec, tt.asCurrentUser)
instance, err := NewContainer(tt.containerSpec, tt.UIDGID)
if err != nil {
t.Fatal(err)
}
Expand Down
29 changes: 25 additions & 4 deletions kyaml/runfn/runfn.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"fmt"
"io"
"os"
"os/user"
"path"
"path/filepath"
"sort"
Expand Down Expand Up @@ -83,7 +84,7 @@ type RunFns struct {
// functionFilterProvider provides a filter to perform the function.
// this is a variable so it can be mocked in tests
functionFilterProvider func(
filter runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter, error)
filter runtimeutil.FunctionSpec, api *yaml.RNode, currentUser currentUserFunc) (kio.Filter, error)

// AsCurrentUser is a boolean to indicate whether docker container should use
// the uid and gid that run the command
Expand Down Expand Up @@ -303,7 +304,7 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
// merge envs from imperative and declarative
spec.Container.Env = r.mergeContainerEnv(spec.Container.Env)

c, err := r.functionFilterProvider(*spec, api)
c, err := r.functionFilterProvider(*spec, api, user.Current)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -395,8 +396,24 @@ func (r *RunFns) init() {
}
}

type currentUserFunc func() (*user.User, error)

// getUIDGID will return "nobody" if asCurrentUser is false. Otherwise
// return "uid:gid" according to the return from currentUser function.
func getUIDGID(asCurrentUser bool, currentUser currentUserFunc) (string, error) {
if !asCurrentUser {
return "nobody", nil
}

u, err := currentUser()
if err != nil {
return "", err
}
return fmt.Sprintf("%s:%s", u.Uid, u.Gid), nil
}

// ffp provides function filters
func (r *RunFns) ffp(spec runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter, error) {
func (r *RunFns) ffp(spec runtimeutil.FunctionSpec, api *yaml.RNode, currentUser currentUserFunc) (kio.Filter, error) {
var resultsFile string
if r.ResultsDir != "" {
resultsFile = filepath.Join(r.ResultsDir, fmt.Sprintf(
Expand All @@ -405,14 +422,18 @@ func (r *RunFns) ffp(spec runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter
}
if !r.DisableContainers && spec.Container.Image != "" {
// TODO: Add a test for this behavior
uidgid, err := getUIDGID(r.AsCurrentUser, currentUser)
if err != nil {
return nil, err
}
c, err := container.NewContainer(
runtimeutil.ContainerSpec{
Image: spec.Container.Image,
Network: spec.Container.Network,
StorageMounts: r.StorageMounts,
Env: spec.Container.Env,
},
r.AsCurrentUser,
uidgid,
)
if err != nil {
return nil, err
Expand Down
55 changes: 48 additions & 7 deletions kyaml/runfn/runfn_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"fmt"
"io/ioutil"
"os"
"os/user"
"path/filepath"
"runtime"
"strings"
Expand Down Expand Up @@ -38,6 +39,13 @@ replace: StatefulSet
`
)

func currentUser() (*user.User, error) {
return &user.User{
Uid: "1",
Gid: "2",
}, nil
}

func TestRunFns_init(t *testing.T) {
instance := RunFns{}
instance.init()
Expand All @@ -59,8 +67,41 @@ kind:
if !assert.NoError(t, err) {
return
}
filter, _ := instance.functionFilterProvider(spec, api)
c, err := container.NewContainer(runtimeutil.ContainerSpec{Image: "example.com:version"}, false)
filter, _ := instance.functionFilterProvider(spec, api, currentUser)
c, err := container.NewContainer(runtimeutil.ContainerSpec{Image: "example.com:version"}, "nobody")
if err != nil {
t.Fatal(err)
}
cf := &c
cf.Exec.FunctionConfig = api
assert.Equal(t, cf, filter)
}

func TestRunFns_initAsCurrentUser(t *testing.T) {
instance := RunFns{
AsCurrentUser: true,
}
instance.init()
if !assert.Equal(t, instance.Input, os.Stdin) {
t.FailNow()
}
if !assert.Equal(t, instance.Output, os.Stdout) {
t.FailNow()
}

api, err := yaml.Parse(`apiVersion: apps/v1
kind:
`)
spec := runtimeutil.FunctionSpec{
Container: runtimeutil.ContainerSpec{
Image: "example.com:version",
},
}
if !assert.NoError(t, err) {
return
}
filter, _ := instance.functionFilterProvider(spec, api, currentUser)
c, err := container.NewContainer(runtimeutil.ContainerSpec{Image: "example.com:version"}, "1:2")
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -93,8 +134,8 @@ kind:
if !assert.NoError(t, err) {
return
}
filter, _ := instance.functionFilterProvider(spec, api)
c, err := container.NewContainer(runtimeutil.ContainerSpec{Image: "example.com:version"}, false)
filter, _ := instance.functionFilterProvider(spec, api, currentUser)
c, err := container.NewContainer(runtimeutil.ContainerSpec{Image: "example.com:version"}, "nobody")
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -869,7 +910,7 @@ replace: StatefulSet
var fltrs []*TestFilter
instance := RunFns{
Path: dir,
functionFilterProvider: func(f runtimeutil.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
functionFilterProvider: func(f runtimeutil.FunctionSpec, node *yaml.RNode, currentUser currentUserFunc) (kio.Filter, error) {
tf := &TestFilter{
Exit: errors.Errorf("message: %s", f.Container.Image),
}
Expand Down Expand Up @@ -1075,8 +1116,8 @@ func setupTest(t *testing.T) string {
// getFilterProvider fakes the creation of a filter, replacing the ContainerFiler with
// a filter to s/kind: Deployment/kind: StatefulSet/g.
// this can be used to simulate running a filter.
func getFilterProvider(t *testing.T) func(runtimeutil.FunctionSpec, *yaml.RNode) (kio.Filter, error) {
return func(f runtimeutil.FunctionSpec, node *yaml.RNode) (kio.Filter, error) {
func getFilterProvider(t *testing.T) func(runtimeutil.FunctionSpec, *yaml.RNode, currentUserFunc) (kio.Filter, error) {
return func(f runtimeutil.FunctionSpec, node *yaml.RNode, currentUser currentUserFunc) (kio.Filter, error) {
// parse the filter from the input
filter := yaml.YFilter{}
b := &bytes.Buffer{}
Expand Down

0 comments on commit d5b0f34

Please sign in to comment.