Skip to content

Commit

Permalink
Fix non-root cache end-to-end test
Browse files Browse the repository at this point in the history
Signed-off-by: Burak Varlı <[email protected]>
  • Loading branch information
unexge committed Dec 27, 2024
1 parent cd37851 commit 540618a
Showing 1 changed file with 8 additions and 1 deletion.
9 changes: 8 additions & 1 deletion tests/e2e-kubernetes/testsuites/cache.go
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ func (t *s3CSICacheTestSuite) DefineTests(driver storageframework.TestDriver, pa
"allow-other",
fmt.Sprintf("uid=%d", defaultNonRootUser),
fmt.Sprintf("gid=%d", defaultNonRootGroup))
podModifiers := append(basePodModifiers, podModifierNonRoot)
podModifiers := append([]func(*v1.Pod){podModifierNonRoot}, basePodModifiers...)

pod, bucketName := createPod(ctx, mountOptions, podModifiers...)
checkBasicFileOperations(ctx, pod, bucketName, e2epod.VolumeMountPath1)
Expand Down Expand Up @@ -327,6 +327,13 @@ func ensureCacheDirExistsInNode(pod *v1.Pod, cacheDir string) {
MountPath: "/cache",
}

if pod.Spec.SecurityContext == nil {
pod.Spec.SecurityContext = &v1.PodSecurityContext{}
}
// We need to set this false at Pod-level as `chmod-cache-dir` needs to run as `root` and this
// would prevent container creation if its true.
pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(false)

// The directory created with `DirectoryOrCreate` will have 0755 permissions and will be owned by kubelet.
// Unless we change permissions here, non-root containers won't be able to access to the cache dir.
pod.Spec.InitContainers = append(pod.Spec.DeepCopy().InitContainers, v1.Container{
Expand Down

0 comments on commit 540618a

Please sign in to comment.