github/charts
4
0
Fork 0
mirror of https://github.com/truenas/charts.git synced 2024-04-21 15:21:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

more

Browse Source
This commit is contained in:
Stavros kois
2023-01-28 22:23:53 +02:00
parent 667da2ee40
commit eae5657116
10 changed files with 623 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/common-test/tests/container_in_deployment/resources_test.yaml
+355 -191
View File
@@ -22,8 +22,13 @@ tests:
- it: should fail with inherit defined in main container
documentIndex: *deploymentDoc
set:
resources:
inherit:
controllers:
main:
pod:
containers:
main:
resources:
inherit:
asserts:
- failedTemplate:
errorMessage: <resources.inherit> key is only available for additional/init/install/upgrade containers.
@@ -33,13 +38,18 @@ tests:
set:
scaleGPU:
somekey:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: Value is not provided for GPU (<key> somekey)
@@ -47,13 +57,18 @@ tests:
- it: should fail with empty requests.cpu
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu:
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu:
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.requests.cpu> cannot be empty.
@@ -61,13 +76,18 @@ tests:
- it: should fail with empty requests.memory
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory:
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory:
asserts:
- failedTemplate:
errorMessage: <resources.requests.memory> cannot be empty.
@@ -77,13 +97,18 @@ tests:
set:
scaleGPU:
somekey:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0.0
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0.0
asserts:
- failedTemplate:
errorMessage: <resources.requests.memory> has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -93,13 +118,18 @@ tests:
set:
scaleGPU:
somekey:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0e0
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0e0
asserts:
- failedTemplate:
errorMessage: <resources.requests.memory> has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -109,13 +139,18 @@ tests:
set:
scaleGPU:
somekey:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0M
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 0M
asserts:
- failedTemplate:
errorMessage: <resources.requests.memory> has invalid format in value (0M). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -125,13 +160,18 @@ tests:
set:
scaleGPU:
somekey:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: not-valid
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: not-valid
asserts:
- failedTemplate:
errorMessage: <resources.requests.memory> has invalid format in value (not-valid). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -139,13 +179,18 @@ tests:
- it: should fail with invalid format in limits.memory (zero)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 0.0
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 0.0
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.memory> has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -153,13 +198,18 @@ tests:
- it: should fail with invalid format in limits.memory (zero exponent)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 0e0
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 0e0
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.memory> has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -167,13 +217,18 @@ tests:
- it: should fail with invalid format in requests.limits (zero with suffix)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 0M
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 0M
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.memory> has invalid format in value (0M). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -181,13 +236,18 @@ tests:
- it: should fail with invalid format in limits.memory (string)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: not-valid
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: not-valid
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.memory> has invalid format in value (not-valid). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6).
@@ -195,13 +255,18 @@ tests:
- it: should fail with invalid format in limits.cpu (zero)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 0.0
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 0.0
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.cpu> has invalid format in value (0). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -209,13 +274,18 @@ tests:
- it: should fail with invalid format in limits.cpu (zero with suffix)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 0m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 0m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.cpu> has invalid format in value (0m). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -223,13 +293,18 @@ tests:
- it: should fail with invalid format in limits.cpu (string)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: not-valid
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: not-valid
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.limits.cpu> has invalid format in value (not-valid). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -237,13 +312,18 @@ tests:
- it: should fail with invalid format in requests.cpu (zero)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: 0.0
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: 0.0
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.requests.cpu> has invalid format in value (0). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -251,13 +331,18 @@ tests:
- it: should fail with invalid format in requests.cpu (zero with suffix)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: 0m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: 0m
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.requests.cpu> has invalid format in value (0m). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -265,13 +350,18 @@ tests:
- it: should fail with invalid format in requests.cpu (string)
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: not-valid
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 4000m
memory: 4Gi
requests:
cpu: not-valid
memory: 100Mi
asserts:
- failedTemplate:
errorMessage: <resources.requests.cpu> has invalid format in value (not-valid). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m).
@@ -279,13 +369,18 @@ tests:
- it: should pass with changed resources
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -300,9 +395,14 @@ tests:
- it: should pass with only limits.cpu resource changed
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu: 3000m
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -317,9 +417,14 @@ tests:
- it: should pass with only limits.memory resource changed
documentIndex: *deploymentDoc
set:
resources:
limits:
memory: 4Gi
controllers:
main:
pod:
containers:
main:
resources:
limits:
memory: 4Gi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -334,9 +439,14 @@ tests:
- it: should pass with only requests.cpu resource changed
documentIndex: *deploymentDoc
set:
resources:
requests:
cpu: 20m
controllers:
main:
pod:
containers:
main:
resources:
requests:
cpu: 20m
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -351,9 +461,14 @@ tests:
- it: should pass with only requests.memory resource changed
documentIndex: *deploymentDoc
set:
resources:
requests:
memory: 25Mi
controllers:
main:
pod:
containers:
main:
resources:
requests:
memory: 25Mi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -387,13 +502,18 @@ tests:
set:
scaleGPU:
gpu.intel.com/i915: "1"
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory: 4Gi
requests:
cpu: 20m
memory: 100Mi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -409,10 +529,15 @@ tests:
- it: should pass with empty resources.limits
documentIndex: *deploymentDoc
set:
resources:
limits:
cpu:
memory:
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -425,10 +550,15 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu: 3000m
memory:
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 3000m
memory:
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -443,10 +573,15 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu:
memory: 4Gi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory: 4Gi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -461,12 +596,17 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu:
memory:
requests:
cpu: 30m
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
requests:
cpu: 30m
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -479,12 +619,17 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu:
memory:
requests:
memory: 15Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
requests:
memory: 15Mi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -498,10 +643,15 @@ tests:
set:
scaleGPU:
gpu.intel.com/i915: "1"
resources:
limits:
cpu:
memory:
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -516,13 +666,18 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu:
memory:
requests:
cpu: 10m
memory: 50Mi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
requests:
cpu: 10m
memory: 50Mi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -535,10 +690,15 @@ tests:
documentIndex: *deploymentDoc
set:
scaleGPU: {}
resources:
limits:
cpu: 1000m
memory: 1Gi
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu: 1000m
memory: 1Gi
asserts:
- equal:
path: spec.template.spec.containers[0].resources
@@ -550,16 +710,20 @@ tests:
cpu: 10m
memory: 50Mi
- it: should pass with only gpu defined
documentIndex: *deploymentDoc
set:
scaleGPU:
gpu.intel.com/i915: "1"
resources:
limits:
cpu:
memory:
controllers:
main:
pod:
containers:
main:
resources:
limits:
cpu:
memory:
asserts:
- equal:
path: spec.template.spec.containers[0].resources
library/common-test/tests/container_in_deployment/securityContext_test.yaml
+167 -62
View File
@@ -26,18 +26,23 @@ tests:
- it: should pass with securityContext changed
documentIndex: *deploymentDoc
set:
securityContext:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: false
allowPrivilegeEscalation: true
privileged: true
capabilities:
add:
- SYS_MODULE
drop:
- NET_ADMIN
controllers:
main:
pod:
containers:
main:
securityContext:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: false
allowPrivilegeEscalation: true
privileged: true
capabilities:
add:
- SYS_MODULE
drop:
- NET_ADMIN
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext
@@ -60,12 +65,17 @@ tests:
source:
addCap: SYS_MODULE
remCap: NET_ADMIN
securityContext:
capabilities:
add:
- "{{ .Values.source.addCap }}"
drop:
- "{{ .Values.source.remCap }}"
controllers:
main:
pod:
containers:
main:
securityContext:
capabilities:
add:
- "{{ .Values.source.addCap }}"
drop:
- "{{ .Values.source.remCap }}"
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext
@@ -84,158 +94,253 @@ tests:
- it: should fail with inherit key added in securityContext on main container
set:
securityContext:
inherit: true
controllers:
main:
pod:
containers:
main:
securityContext:
inherit: true
asserts:
- failedTemplate:
errorMessage: <securityContext.inherit> key is only available for additional/init/install/upgrade containers.
- it: should fail with securityContext changed, runAsNonRoot true and runAsUser 0
set:
securityContext:
runAsNonRoot: true
runAsUser: 0
controllers:
main:
pod:
containers:
main:
securityContext:
runAsNonRoot: true
runAsUser: 0
asserts:
- failedTemplate:
errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true
- it: should fail with securityContext changed, runAsNonRoot true and runAsGroup 0
set:
securityContext:
runAsNonRoot: true
runAsUser: 0
controllers:
main:
pod:
containers:
main:
securityContext:
runAsNonRoot: true
runAsUser: 0
asserts:
- failedTemplate:
errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true
- it: should fail with securityContext changed and runAsNonRoot set to a non-bool value
set:
securityContext:
runAsNonRoot: non-bool
controllers:
main:
pod:
containers:
main:
securityContext:
runAsNonRoot: non-bool
asserts:
- failedTemplate:
errorMessage: <runAsNonRoot> key has value (non-bool). But it must be boolean.
- it: should fail with securityContext changed and privileged set to a non-bool value
set:
securityContext:
privileged: non-bool
controllers:
main:
pod:
containers:
main:
securityContext:
privileged: non-bool
asserts:
- failedTemplate:
errorMessage: <privileged> key has value (non-bool). But it must be boolean.
- it: should fail with securityContext changed and readOnlyRootFilesystem set to a non-bool value
set:
securityContext:
readOnlyRootFilesystem: non-bool
controllers:
main:
pod:
containers:
main:
securityContext:
readOnlyRootFilesystem: non-bool
asserts:
- failedTemplate:
errorMessage: <readOnlyRootFilesystem> key has value (non-bool). But it must be boolean.
- it: should fail with securityContext changed and allowPrivilegeEscalation set to a non-bool value
set:
securityContext:
allowPrivilegeEscalation: non-bool
controllers:
main:
pod:
containers:
main:
securityContext:
allowPrivilegeEscalation: non-bool
asserts:
- failedTemplate:
errorMessage: <allowPrivilegeEscalation> key has value (non-bool). But it must be boolean.
- it: should fail with securityContext changed and capabilities.add is not a list
set:
securityContext:
capabilities:
add: non-a-list
controllers:
main:
pod:
containers:
main:
securityContext:
capabilities:
add: non-a-list
asserts:
- failedTemplate:
errorMessage: <capabilities.add> key has value (non-a-list). But it must be a list. Set a list value or remove the key for the default ([]) to take effect.
- it: should fail with securityContext changed and capabilities.drop is not a list
set:
securityContext:
capabilities:
drop: non-a-list
controllers:
main:
pod:
containers:
main:
securityContext:
capabilities:
drop: non-a-list
asserts:
- failedTemplate:
errorMessage: <capabilities.drop> key has value (non-a-list). But it must be a list. Set a list value or remove the key for the default ([ALL]) to take effect.
- it: should fail with empty capabilities.drop in securityContext
set:
securityContext:
capabilities:
drop:
controllers:
main:
pod:
containers:
main:
securityContext:
capabilities:
drop:
asserts:
- failedTemplate:
errorMessage: <capabilities.drop> key has value (<nil>). But it must be a list. Set a list value or remove the key for the default ([ALL]) to take effect.
- it: should fail with empty capabilities.add in securityContext
set:
securityContext:
capabilities:
add:
controllers:
main:
pod:
containers:
main:
securityContext:
capabilities:
add:
asserts:
- failedTemplate:
errorMessage: <capabilities.add> key has value (<nil>). But it must be a list. Set a list value or remove the key for the default ([]) to take effect.
- it: should fail with empty runAsGroup in securityContext
set:
securityContext:
runAsGroup:
controllers:
main:
pod:
containers:
main:
securityContext:
runAsGroup:
asserts:
- failedTemplate:
errorMessage: <runAsGroup> key cannot be empty. Set a value or remove the key for the default (568) to take effect.
- it: should fail with non int runAsGroup in securityContext
set:
securityContext:
runAsGroup: "1000"
controllers:
main:
pod:
containers:
main:
securityContext:
runAsGroup: "1000"
asserts:
- failedTemplate:
errorMessage: <runAsGroup> key has value of ("1000"). But must be an int.
- it: should fail with non int runAsUser in securityContext
set:
securityContext:
runAsUser: "1000"
controllers:
main:
pod:
containers:
main:
securityContext:
runAsUser: "1000"
asserts:
- failedTemplate:
errorMessage: <runAsUser> key has value of ("1000"). But must be an int.
- it: should fail with empty runAsUser in securityContext
set:
securityContext:
runAsUser:
controllers:
main:
pod:
containers:
main:
securityContext:
runAsUser:
asserts:
- failedTemplate:
errorMessage: <runAsUser> key cannot be empty. Set a value or remove the key for the default (568) to take effect.
- it: should fail with empty privileged in securityContext
set:
securityContext:
privileged:
controllers:
main:
pod:
containers:
main:
securityContext:
privileged:
asserts:
- failedTemplate:
errorMessage: <privileged> key has value (<nil>). But it must be boolean.
- it: should fail with empty allowPrivilegeEscalation in securityContext
set:
securityContext:
allowPrivilegeEscalation:
controllers:
main:
pod:
containers:
main:
securityContext:
allowPrivilegeEscalation:
asserts:
- failedTemplate:
errorMessage: <allowPrivilegeEscalation> key has value (<nil>). But it must be boolean.
- it: should fail with empty readOnlyRootFilesystem in securityContext
set:
securityContext:
readOnlyRootFilesystem:
controllers:
main:
pod:
containers:
main:
securityContext:
readOnlyRootFilesystem:
asserts:
- failedTemplate:
errorMessage: <readOnlyRootFilesystem> key has value (<nil>). But it must be boolean.
- it: should fail with empty runAsNonRoot in securityContext
set:
securityContext:
runAsNonRoot:
controllers:
main:
pod:
containers:
main:
securityContext:
runAsNonRoot:
asserts:
- failedTemplate:
errorMessage: <runAsNonRoot> key has value (<nil>). But it must be boolean.
library/common-test/tests/container_in_deployment/various_options_test.yaml
+47 -12
View File
@@ -14,7 +14,12 @@ tests:
- it: should pass with tty set
documentIndex: *deploymentDoc
set:
tty: true
controllers:
main:
pod:
containers:
main:
tty: true
asserts:
- equal:
path: spec.template.spec.containers[0].tty
@@ -23,7 +28,12 @@ tests:
- it: should pass with stdin set
documentIndex: *deploymentDoc
set:
stdin: true
controllers:
main:
pod:
containers:
main:
stdin: true
asserts:
- equal:
path: spec.template.spec.containers[0].stdin
@@ -32,8 +42,13 @@ tests:
- it: should pass with terminationMessagePath set
documentIndex: *deploymentDoc
set:
termination:
messagePath: /tmp/log
controllers:
main:
pod:
containers:
main:
termination:
messagePath: /tmp/log
asserts:
- equal:
path: spec.template.spec.containers[0].terminationMessagePath
@@ -43,8 +58,13 @@ tests:
documentIndex: *deploymentDoc
set:
some_path: /tmp/log
termination:
messagePath: "{{ .Values.some_path }}"
controllers:
main:
pod:
containers:
main:
termination:
messagePath: "{{ .Values.some_path }}"
asserts:
- equal:
path: spec.template.spec.containers[0].terminationMessagePath
@@ -53,8 +73,13 @@ tests:
- it: should pass with terminationMessagePolicy set
documentIndex: *deploymentDoc
set:
termination:
messagePolicy: FallbackToLogsOnError
controllers:
main:
pod:
containers:
main:
termination:
messagePolicy: FallbackToLogsOnError
asserts:
- equal:
path: spec.template.spec.containers[0].terminationMessagePolicy
@@ -64,8 +89,13 @@ tests:
documentIndex: *deploymentDoc
set:
some_key: FallbackToLogsOnError
termination:
messagePolicy: "{{ .Values.some_key }}"
controllers:
main:
pod:
containers:
main:
termination:
messagePolicy: "{{ .Values.some_key }}"
asserts:
- equal:
path: spec.template.spec.containers[0].terminationMessagePolicy
@@ -74,8 +104,13 @@ tests:
- it: should fail with invalid terminationMessagePolicy
set:
some_key: invalid
termination:
messagePolicy: "{{ .Values.some_key }}"
controllers:
main:
pod:
containers:
main:
termination:
messagePolicy: "{{ .Values.some_key }}"
asserts:
- failedTemplate:
errorMessage: Not valid option for messagePolicy (invalid). Valid options are FallbackToLogsOnError and File
library/common-test/tests/deployment/dns-network_test.yaml
+3
View File
@@ -319,3 +319,6 @@ tests:
hostnames:
- hostname3
- hostname4
# TODO: default dns on root level and on pod
# TODO: default dns on root level and not on pod
library/common-test/tests/pvc/pvc_test.yaml
+1 -1
View File
@@ -24,7 +24,7 @@ tests:
mountPath: /somepath
asserts:
- failedTemplate:
errorMessage: A storageClass must be defined in global.defaults.scaleZFSStorageClass
errorMessage: A storageClass must be defined in globalDefaults.scaleZFSStorageClass
- it: should fail with invalid accessMode
set:
library/common/1.0.0/templates/lib/container/_resources.tpl
+1 -1
View File
@@ -10,7 +10,7 @@
{{- end -}}
{{/* Get defaults from global */}}
{{- $defautlResources := $root.Values.globalDefaults.resources -}}
{{- $defautlResources := $root.Values.resources -}}
{{- $newResources := (mustDeepCopy $defautlResources) -}}
{{- if and $resources.inherit (not $isMainContainer) -}} {{/* if inherit is set, overwrite defaults with values from mainContainer */}}
library/common/1.0.0/templates/lib/container/_security.tpl
+2 -2
View File
@@ -14,7 +14,7 @@ The reason is not splitted, is that on one of the places needs a combo of all va
{{- $isMainContainer := .isMainContainer -}}
{{/* Initialiaze Values */}}
{{- $defaultSecCont := $root.Values.globalDefaults.securityContext -}}
{{- $defaultSecCont := $root.Values.securityContext -}}
{{- $returnValue := (mustDeepCopy $defaultSecCont) -}}
{{- if and (hasKey $secCont "inherit") $isMainContainer -}}
@@ -112,7 +112,7 @@ The reason is not splitted, is that on one of the places needs a combo of all va
{{- $podSecCont := .podSecCont -}}
{{/* Initialiaze Values */}}
{{- $defaultPodSecCont := $root.Values.globalDefaults.podSecurityContext -}}
{{- $defaultPodSecCont := $root.Values.podSecurityContext -}}
{{- $returnValue := (mustDeepCopy $defaultPodSecCont) -}}
{{/* Overwrite from values that user/dev passed */}}
library/common/1.0.0/templates/lib/pod/_dns.tpl
+7 -1
View File
@@ -4,7 +4,7 @@
{{- $hostNetwork := .hostNetwork -}}
{{- $root := .root -}}
{{- $policy := $root.Values.globalDefaults.dnsPolicy -}}
{{- $policy := $root.Values.dnsPolicy -}}
{{- if $dnsPolicy -}}
{{- if not (mustHas $dnsPolicy (list "Default" "ClusterFirst" "ClusterFirstWithHostNet" "None")) -}}
{{- fail (printf "Not valid dnsPolicy (%s). Valid options are ClusterFirst, Default, ClusterFirstWithHostNet, None" $dnsPolicy) -}}
@@ -23,6 +23,12 @@
{{- $dnsConfig := .dnsConfig -}}
{{- $root := .root -}}
{{- $config := $root.Values.dnsConfig -}}
{{- if not $dnsConfig -}}
{{- $dnsConfig = $config -}}
{{- end -}}
{{- if and (eq $dnsPolicy "None") (not $dnsConfig.nameservers) -}}
{{- fail "With dnsPolicy set to None, you must specify at least 1 nameservers on dnsConfig" -}}
{{- end -}}
library/common/1.0.0/templates/lib/pod/_mainContainer.tpl
+1 -1
View File
@@ -24,7 +24,7 @@ So it can work on multiple places, like additional containers and not only the m
{{- end -}}
{{- with (include "ix.v1.common.container.securityContext" (dict "secCont" $values.securityContext
"isMainContainer" true
"deviceList" $values.deviceList
"deviceList" $root.Values.deviceList
"scaleGPU" $values.scaleGPU
"root" $root)) | trim }}
securityContext:
library/common/1.0.0/values.yaml
+39 -46
View File
@@ -52,23 +52,6 @@ globalDefaults:
# Default security context used for all
# init/install/upgrade/additional
# and main containers if not specified
securityContext:
runAsNonRoot: true
runAsUser: 568
runAsGroup: 568
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
capabilities:
add: []
drop:
- ALL
# Default podSecurityContext, used if
# no other is specified
podSecurityContext:
fsGroup: 568
supplementalGroups: []
fsGroupChangePolicy: OnRootMismatch
# Whether to inject fixedEnvs on containers
# Can be overruled per container
injectFixedEnvs: true
@@ -78,13 +61,7 @@ globalDefaults:
- all
# Default Resources values, if no others
# are specified, use those
resources:
limits:
cpu: 4000m
memory: 8Gi
requests:
cpu: 10m
memory: 50Mi
# If no probe Type is defined, assume this
probeType: auto
# If no probe Path is defined, assume this
@@ -118,8 +95,6 @@ globalDefaults:
successfulJobsHistoryLimit: 3
backoffLimit: 6
completionMode: NonIndexed
# If not defined on the pod, assume this
dnsPolicy: ClusterFirst
# Defines image info
image:
@@ -230,26 +205,44 @@ controllers:
enabled: true
startup:
enabled: true
# Default securityContext for main container
securityContext:
runAsNonRoot: true
runAsUser: 568
runAsGroup: 568
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
capabilities:
add: []
drop:
- ALL
# Default resources for main container
resources:
limits:
cpu: 4000m
memory: 8Gi
requests:
cpu: 10m
memory: 50Mi
# Default DNS Policy that applies to all pods
# Can be overruled per pod
dnsPolicy: ClusterFirst
# Default DNS Config that applies to all pods
# Can be overruled per pod
dnsConfig: {}
# Security Context that applies to all containers
# Can be overruled per container
securityContext:
runAsNonRoot: true
runAsUser: 568
runAsGroup: 568
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
capabilities:
add: []
drop:
- ALL
# Default podSecurityContext that applies to all pods
# Can be overruled per pod
podSecurityContext:
fsGroup: 568
supplementalGroups: []
fsGroupChangePolicy: OnRootMismatch
# Resources that apply to all containers
# Can be overruled per container
resources:
limits:
cpu: 4000m
memory: 8Gi
requests:
cpu: 10m
memory: 50Mi
# Values that will be exposed to UI
# Defines the timezone for the container