diff --git a/keps/sig-auth/2579-psp-replacement/README.md b/keps/sig-auth/2579-psp-replacement/README.md index 0ffb85841ba3..4136266dd9b5 100644 --- a/keps/sig-auth/2579-psp-replacement/README.md +++ b/keps/sig-auth/2579-psp-replacement/README.md @@ -24,6 +24,10 @@ - [Windows Support](#windows-support) - [Flexible Extension Support](#flexible-extension-support) - [Test Plan](#test-plan) + - [Prerequisite testing updates](#prerequisite-testing-updates) + - [Unit tests](#unit-tests) + - [Integration tests](#integration-tests) + - [e2e tests](#e2e-tests) - [Monitoring](#monitoring) - [Audit Annotations](#audit-annotations) - [PodSecurityPolicy Migration](#podsecuritypolicy-migration) @@ -589,6 +593,44 @@ by @JimBugwadia: https://github.com/JimBugwadia/pod-security-tests **Unit Tests:** Both the library and admission controller implementations will have thorough coverage of unit tests. +##### Prerequisite testing updates + +None. + +##### Unit tests + +- `k8s.io/pod-security-admission/admission`: `2020-05-12` - `80.7% of statements` +- `k8s.io/pod-security-admission/admission/api`: `2020-05-12` - `1.4% of statements` (mostly boilerplate & generated code) +- `k8s.io/pod-security-admission/admission/api/load`: `2020-05-12` - `88.5% of statements` +- `k8s.io/pod-security-admission/admission/api/scheme`: `2020-05-12` - `100.0% of statements` +- `k8s.io/pod-security-admission/admission/api/v1alpha1`: `2020-05-12` - `1.7% of statements` (generated API) +- `k8s.io/pod-security-admission/admission/api/v1beta1`: `2020-05-12` - `1.7% of statements` (generated API) +- `k8s.io/pod-security-admission/admission/api/validation`: `2020-05-12` - `100.0% of statements` +- `k8s.io/pod-security-admission/api`: `2020-05-12` - `9.3% of statements` **room for improvement** +- `k8s.io/pod-security-admission/cmd/webhook`: `2020-05-12` - `no unit tests` (mostly server setup, covered by integration) +- `k8s.io/pod-security-admission/cmd/webhook/server`: `2020-05-12` - `no unit tests` (mostly server setup, covered by integration) +- `k8s.io/pod-security-admission/cmd/webhook/server/options`: `2020-05-12` - `no unit tests` (mostly server setup, covered by integration) +- `k8s.io/pod-security-admission/metrics`: `2020-05-12` - `93.8% of statements` +- `k8s.io/pod-security-admission/policy`: `2020-05-12` - `88.3% of statements` +- `k8s.io/pod-security-admission/test`: `2020-05-12` - `73.7% of statements` + +##### Integration tests + +`k8s.io/kubernetes/test/integration/auth/podsecurity_test.go` +https://storage.googleapis.com/k8s-triage/index.html?test=TestPodSecurity + +Pod Security admission has very thorough integration test coverage, including: +- Generated test fixtures for failing & passing pods across every type of check, version and level. +- Tests with only GA feature gates enabled, and the default set. +- Tests running as a built-in admission controller & webhook. +- Tests pods run directly & via a controller + +##### e2e tests + +There are no Pod Security specific E2E tests (we rely on integration test coverage instead), but the +Pod Security admission controller is enabled in E2E clusters, and all E2E test namespaces are +labeled with the enforcement label for Pod Security. + ### Monitoring Three metrics will be introduced: