feat: add runtimeclass control

Signed-off-by: Oliver Baehler <oliver.baehler@hotmail.com>
2026-05-02 07:26:36 +00:00 · 2022-12-28 15:01:28 +01:00
parent ee0fdc9efa
commit 79391f863a
15 changed files with 3754 additions and 2000 deletions
--- a/e2e/pod_priority_class_test.go
+++ b/e2e/pod_priority_class_test.go
@@ -8,14 +8,15 @@ package e2e
 import (
 	"context"

+	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+	"github.com/clastix/capsule/pkg/api"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	v1 "k8s.io/api/scheduling/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
-	"github.com/clastix/capsule/pkg/api"
+	"strconv"
+	"strings"
 )

 var _ = Describe("enforcing a Priority Class", func() {
@@ -35,6 +36,11 @@ var _ = Describe("enforcing a Priority Class", func() {
 					Exact: []string{"gold"},
 					Regex: "pc\\-\\w+",
 				},
+				Selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{
+						"env": "customers",
+					},
+				},
 			},
 		},
 	}
@@ -155,4 +161,51 @@ var _ = Describe("enforcing a Priority Class", func() {
 			Expect(k8sClient.Delete(context.TODO(), class)).Should(Succeed())
 		}
 	})
+
+	It("should allow selector match", func() {
+		ns := NewNamespace("priority-selector-match")
+
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+
+		for i, pc := range []string{"customer-bronze", "customer-silver", "customer-gold"} {
+			priorityName := strings.Join([]string{pc, "-", strconv.Itoa(i)}, "")
+			class := &v1.PriorityClass{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: pc,
+					Labels: map[string]string{
+						"name": priorityName,
+						"env":  "customers",
+					},
+				},
+				Description: "fake PriorityClass for e2e",
+				Value:       int32(10000 * (i + 2)),
+			}
+			Expect(k8sClient.Create(context.TODO(), class)).Should(Succeed())
+
+			pod := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: pc,
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  "container",
+							Image: "quay.io/google-containers/pause-amd64:3.0",
+						},
+					},
+					PriorityClassName: class.GetName(),
+				},
+			}
+
+			cs := ownerClient(tnt.Spec.Owners[0])
+
+			EventuallyCreation(func() error {
+				_, err := cs.CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+				return err
+			}).Should(Succeed())
+
+			Expect(k8sClient.Delete(context.TODO(), class)).Should(Succeed())
+		}
+	})
+
 })
--- a/e2e/pod_runtime_class_test.go
+++ b/e2e/pod_runtime_class_test.go
@@ -0,0 +1,222 @@
+//go:build e2e
+
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+	"context"
+	"github.com/clastix/capsule/pkg/api"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	nodev1 "k8s.io/api/node/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"strconv"
+	"strings"
+
+	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+)
+
+var _ = Describe("enforcing a Runtime Class", func() {
+	tnt := &capsulev1beta2.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "runtime-class",
+		},
+		Spec: capsulev1beta2.TenantSpec{
+			Owners: capsulev1beta2.OwnerListSpec{
+				{
+					Name: "george",
+					Kind: "User",
+				},
+			},
+			RuntimeClasses: &api.SelectorAllowedListSpec{
+				AllowedListSpec: api.AllowedListSpec{
+					Exact: []string{"legacy"},
+					Regex: "^hardened-.*$",
+				},
+				Selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{
+						"env": "customers",
+					},
+				},
+			},
+		},
+	}
+
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			tnt.ResourceVersion = ""
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("should block non allowed Runtime Class", func() {
+		runtime := &nodev1.RuntimeClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "disallowed",
+			},
+			Handler: "custom-handler",
+		}
+		Expect(k8sClient.Create(context.TODO(), runtime)).Should(Succeed())
+
+		defer func() {
+			Expect(k8sClient.Delete(context.TODO(), runtime)).Should(Succeed())
+		}()
+
+		ns := NewNamespace("rt-disallow")
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+		runtimeName := "disallowed"
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "container",
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name:  "container",
+						Image: "quay.io/google-containers/pause-amd64:3.0",
+					},
+				},
+				RuntimeClassName: &runtimeName,
+			},
+		}
+
+		cs := ownerClient(tnt.Spec.Owners[0])
+		EventuallyCreation(func() error {
+			_, err := cs.CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+			return err
+		}).ShouldNot(Succeed())
+	})
+
+	It("should allow exact match", func() {
+		runtime := &nodev1.RuntimeClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "legacy",
+			},
+			Handler: "custom-handler",
+		}
+		Expect(k8sClient.Create(context.TODO(), runtime)).Should(Succeed())
+
+		defer func() {
+			Expect(k8sClient.Delete(context.TODO(), runtime)).Should(Succeed())
+		}()
+
+		ns := NewNamespace("rt-exact-match")
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+		runtimeName := "legacy"
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "container",
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name:  "container",
+						Image: "quay.io/google-containers/pause-amd64:3.0",
+					},
+				},
+				RuntimeClassName: &runtimeName,
+			},
+		}
+
+		cs := ownerClient(tnt.Spec.Owners[0])
+		EventuallyCreation(func() error {
+			_, err := cs.CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+			return err
+		}).Should(Succeed())
+	})
+
+	It("should allow regex match", func() {
+		ns := NewNamespace("rc-regex-match")
+
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+
+		for i, rt := range []string{"hardened-crio", "hardened-containerd", "hardened-dockerd"} {
+			runtimeName := strings.Join([]string{rt, "-", strconv.Itoa(i)}, "")
+			runtime := &nodev1.RuntimeClass{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: runtimeName,
+				},
+				Handler: "custom-handler",
+			}
+
+			Expect(k8sClient.Create(context.TODO(), runtime)).Should(Succeed())
+
+			pod := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: rt,
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  "container",
+							Image: "quay.io/google-containers/pause-amd64:3.0",
+						},
+					},
+					RuntimeClassName: &runtimeName,
+				},
+			}
+
+			cs := ownerClient(tnt.Spec.Owners[0])
+
+			EventuallyCreation(func() error {
+				_, err := cs.CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+				return err
+			}).Should(Succeed())
+
+			Expect(k8sClient.Delete(context.TODO(), runtime)).Should(Succeed())
+		}
+	})
+
+	It("should allow selector match", func() {
+		ns := NewNamespace("rc-selector-match")
+
+		NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+
+		for i, rt := range []string{"customer-containerd", "customer-crio", "customer-dockerd"} {
+			runtimeName := strings.Join([]string{rt, "-", strconv.Itoa(i)}, "")
+			runtime := &nodev1.RuntimeClass{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: runtimeName,
+					Labels: map[string]string{
+						"name": runtimeName,
+						"env":  "customers",
+					},
+				},
+				Handler: "custom-handler",
+			}
+
+			Expect(k8sClient.Create(context.TODO(), runtime)).Should(Succeed())
+
+			pod := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: rt,
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  "container",
+							Image: "quay.io/google-containers/pause-amd64:3.0",
+						},
+					},
+					RuntimeClassName: &runtimeName,
+				},
+			}
+
+			cs := ownerClient(tnt.Spec.Owners[0])
+
+			EventuallyCreation(func() error {
+				_, err := cs.CoreV1().Pods(ns.GetName()).Create(context.Background(), pod, metav1.CreateOptions{})
+				return err
+			}).Should(Succeed())
+
+			Expect(k8sClient.Delete(context.TODO(), runtime)).Should(Succeed())
+		}
+	})
+
+})