Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 447cc0d

Browse files
johnstcnjohnstcn
authored
chore(helm/coder/tests): add tests for securitycontext including additional fields (#16348)
Specifically tests for capabilities
1 parent 6e2dc6f commit 447cc0d

File tree

3 files changed

+205
-0
lines changed

3 files changed

+205
-0
lines changed

‎helm/coder/tests/chart_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,10 @@ var testCases = []testCase{
108108
name: "svc_loadbalancer",
109109
expectedError: "",
110110
},
111+
{
112+
name: "securitycontext",
113+
expectedError: "",
114+
},
111115
}
112116

113117
type testCase struct {

‎helm/coder/tests/testdata/securitycontext.golden

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
---
2+
# Source: coder/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder
11+
app.kubernetes.io/part-of: coder
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-0.1.0
14+
name: coder
15+
---
16+
# Source: coder/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-workspace-perms
70+
---
71+
# Source: coder/templates/service.yaml
72+
apiVersion: v1
73+
kind: Service
74+
metadata:
75+
name: coder
76+
labels:
77+
helm.sh/chart: coder-0.1.0
78+
app.kubernetes.io/name: coder
79+
app.kubernetes.io/instance: release-name
80+
app.kubernetes.io/part-of: coder
81+
app.kubernetes.io/version: "0.1.0"
82+
app.kubernetes.io/managed-by: Helm
83+
annotations:
84+
{}
85+
spec:
86+
type: LoadBalancer
87+
sessionAffinity: None
88+
ports:
89+
- name: "http"
90+
port: 80
91+
targetPort: "http"
92+
protocol: TCP
93+
nodePort:
94+
externalTrafficPolicy: "Cluster"
95+
selector:
96+
app.kubernetes.io/name: coder
97+
app.kubernetes.io/instance: release-name
98+
---
99+
# Source: coder/templates/coder.yaml
100+
apiVersion: apps/v1
101+
kind: Deployment
102+
metadata:
103+
annotations: {}
104+
labels:
105+
app.kubernetes.io/instance: release-name
106+
app.kubernetes.io/managed-by: Helm
107+
app.kubernetes.io/name: coder
108+
app.kubernetes.io/part-of: coder
109+
app.kubernetes.io/version: 0.1.0
110+
helm.sh/chart: coder-0.1.0
111+
name: coder
112+
spec:
113+
replicas: 1
114+
selector:
115+
matchLabels:
116+
app.kubernetes.io/instance: release-name
117+
app.kubernetes.io/name: coder
118+
template:
119+
metadata:
120+
annotations: {}
121+
labels:
122+
app.kubernetes.io/instance: release-name
123+
app.kubernetes.io/managed-by: Helm
124+
app.kubernetes.io/name: coder
125+
app.kubernetes.io/part-of: coder
126+
app.kubernetes.io/version: 0.1.0
127+
helm.sh/chart: coder-0.1.0
128+
spec:
129+
affinity:
130+
podAntiAffinity:
131+
preferredDuringSchedulingIgnoredDuringExecution:
132+
- podAffinityTerm:
133+
labelSelector:
134+
matchExpressions:
135+
- key: app.kubernetes.io/instance
136+
operator: In
137+
values:
138+
- coder
139+
topologyKey: kubernetes.io/hostname
140+
weight: 1
141+
containers:
142+
- args:
143+
- server
144+
command:
145+
- /opt/coder
146+
env:
147+
- name: CODER_HTTP_ADDRESS
148+
value: 0.0.0.0:8080
149+
- name: CODER_PROMETHEUS_ADDRESS
150+
value: 0.0.0.0:2112
151+
- name: CODER_ACCESS_URL
152+
value: http://coder.default.svc.cluster.local
153+
- name: KUBE_POD_IP
154+
valueFrom:
155+
fieldRef:
156+
fieldPath: status.podIP
157+
- name: CODER_DERP_SERVER_RELAY_URL
158+
value: http://$(KUBE_POD_IP):8080
159+
image: ghcr.io/coder/coder:latest
160+
imagePullPolicy: IfNotPresent
161+
lifecycle: {}
162+
livenessProbe:
163+
httpGet:
164+
path: /healthz
165+
port: http
166+
scheme: HTTP
167+
name: coder
168+
ports:
169+
- containerPort: 8080
170+
name: http
171+
protocol: TCP
172+
readinessProbe:
173+
httpGet:
174+
path: /healthz
175+
port: http
176+
scheme: HTTP
177+
resources: {}
178+
securityContext:
179+
allowPrivilegeEscalation: false
180+
capabilities:
181+
drop:
182+
- ALL
183+
readOnlyRootFilesystem: null
184+
runAsGroup: 1000
185+
runAsNonRoot: true
186+
runAsUser: 1000
187+
seccompProfile:
188+
type: RuntimeDefault
189+
volumeMounts: []
190+
restartPolicy: Always
191+
serviceAccountName: coder
192+
terminationGracePeriodSeconds: 60
193+
volumes: []

‎helm/coder/tests/testdata/securitycontext.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
coder:
2+
image:
3+
tag: latest
4+
securityContext:
5+
allowPrivilegeEscalation: false
6+
capabilities:
7+
drop:
8+
- ALL

0 commit comments

Comments
 (0)