Skip to content

Commit

Permalink
handle multicontainer test suit flakiness
Browse files Browse the repository at this point in the history 
Signed-off-by: rksharma95 <[email protected]>
  • Loading branch information
@rksharma95
rksharma95 committed Oct 7, 2024
1 parent 5e82b50 commit 53b1d78
Show file tree
Hide file tree
Showing 2 changed files with 60 additions and 31 deletions.
86 changes: 55 additions & 31 deletions tests/k8s_env/multicontainer/multicontainer_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ import (
"fmt"
"time"

"github.com/kubearmor/KubeArmor/protobuf"

. "github.com/kubearmor/KubeArmor/tests/util"

Check warning on line 12 in tests/k8s_env/multicontainer/multicontainer_test.go

View workflow job for this annotation

GitHub Actions / go-lint-tests 

should not use dot imports
. "github.com/onsi/ginkgo/v2"

Check warning on line 13 in tests/k8s_env/multicontainer/multicontainer_test.go

View workflow job for this annotation

GitHub Actions / go-lint-tests 

should not use dot imports
. "github.com/onsi/gomega"

Check warning on line 14 in tests/k8s_env/multicontainer/multicontainer_test.go

View workflow job for this annotation

GitHub Actions / go-lint-tests 

should not use dot imports
Expand Down Expand Up @@ -59,13 +61,16 @@ var _ = Describe("Multicontainer", func() {
fmt.Printf("---START---\n%s---END---\n", sout)
Expect(sout).To(MatchRegexp(".*Permission denied"))

expect := protobuf.Alert{
PolicyName: "container-1-block-ls",
Severity: "2",
ContainerName: "container-1",
}

// check policy violation alert
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("container-1-block-ls"))
Expect(alerts[0].Severity).To(Equal("2"))
Expect(alerts[0].ContainerName).To(Equal("container-1"))
Expect(res.Found).To(BeTrue())

//container-2 should run ls
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
Expand All @@ -87,26 +92,33 @@ var _ = Describe("Multicontainer", func() {
Expect(sout).To(MatchRegexp(".*Permission denied"))

// check policy violation alert
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
expect := protobuf.Alert{
PolicyName: "empty-array-ls-block",
Severity: "4",
ContainerName: "container-1",
}

// check policy violation alert
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
Expect(alerts[0].Severity).To(Equal("4"))
Expect(alerts[0].ContainerName).To(Equal("container-1"))
Expect(res.Found).To(BeTrue())

sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
Expect(sout).To(MatchRegexp(".*Permission denied"))

// check policy violation alert
_, alerts, err = KarmorGetLogs(5*time.Second, 1)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
Expect(alerts[0].Severity).To(Equal("4"))
Expect(alerts[0].ContainerName).To(Equal("container-2"))
expect = protobuf.Alert{
PolicyName: "empty-array-ls-block",
Severity: "4",
ContainerName: "container-2",
}

// check policy violation alert
res, err = KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(res.Found).To(BeTrue())
})

//kubearmor.io/container.name: ""
Expand All @@ -123,25 +135,33 @@ var _ = Describe("Multicontainer", func() {
Expect(sout).To(MatchRegexp(".*Permission denied"))

// check policy violation alert
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
expect := protobuf.Alert{
PolicyName: "empty-array-ls-block",
Severity: "4",
ContainerName: "container-1",
}

// check policy violation alert
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
Expect(alerts[0].Severity).To(Equal("4"))
Expect(alerts[0].ContainerName).To(Equal("container-1"))
Expect(res.Found).To(BeTrue())

sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
Expect(sout).To(MatchRegexp(".*Permission denied"))

// check policy violation alert
_, alerts, err = KarmorGetLogs(5*time.Second, 1)
expect = protobuf.Alert{
PolicyName: "empty-array-ls-block",
Severity: "4",
ContainerName: "container-2",
}

// check policy violation alert
res, err = KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
Expect(alerts[0].Severity).To(Equal("4"))
Expect(alerts[0].ContainerName).To(Equal("container-2"))
Expect(res.Found).To(BeTrue())

})

Expand All @@ -158,12 +178,16 @@ var _ = Describe("Multicontainer", func() {
Expect(sout).To(MatchRegexp(".*Permission denied"))

// check policy violation alert
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
expect := protobuf.Alert{
PolicyName: "malformated-array-ls-block",
Severity: "4",
ContainerName: "container-1",
}

// check policy violation alert
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
Expect(err).To(BeNil())
Expect(len(alerts)).To(BeNumerically(">=", 1))
Expect(alerts[0].PolicyName).To(Equal("malformated-array-ls-block"))
Expect(alerts[0].Severity).To(Equal("4"))
Expect(alerts[0].ContainerName).To(Equal("container-1"))
Expect(res.Found).To(BeTrue())

//container-2 should run ls
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
Expand Down
5 changes: 5 additions & 0 deletions tests/util/karmorlog.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,11 @@ func getAlertWithInfo(alert *pb.Alert, target *pb.Alert) bool {
return false
}
}
if target.ContainerName != "" {
if !strings.Contains(alert.ContainerName, target.ContainerName) {
return false
}
}

return true
}
Expand Down

0 comments on commit 53b1d78

Please sign in to comment.