Function TestHostNetworkPodForTraceSecurityContext

shell/trace_test.go:143–201

(t *testing.T)

}

func TestHostNetworkPodForTraceSecurityContext(t *testing.T) {
	config := TraceConfig{
		RetinaShellImage: "test-image:v1",
	}

	pod := hostNetworkPodForTrace(config, "default", "test-node")
	container := pod.Spec.Containers[0]
	secCtx := container.SecurityContext

	t.Run("not privileged", func(t *testing.T) {
		if secCtx.Privileged != nil && *secCtx.Privileged {
			t.Error("Pod should use capabilities, not privileged mode")
		}
	})

	t.Run("drops all capabilities", func(t *testing.T) {
		if secCtx.Capabilities == nil {
			t.Fatal("Expected Capabilities to be set")
		}

		foundDropAll := false
		for _, drop := range secCtx.Capabilities.Drop {
			if string(drop) == "ALL" {
				foundDropAll = true
				break
			}
		}
		if !foundDropAll {
			t.Error("Expected to drop ALL capabilities first")
		}
	})

	t.Run("adds required capabilities", func(t *testing.T) {
		if secCtx.Capabilities == nil {
			t.Fatal("Expected Capabilities to be set")
		}

		addedCaps := make(map[string]bool)
		for _, cap := range secCtx.Capabilities.Add {
			addedCaps[string(cap)] = true
		}

		requiredCaps := TraceCapabilities()
		for _, required := range requiredCaps {
			if !addedCaps[required] {
				t.Errorf("Missing required capability: %s", required)
			}
		}
	})

	t.Run("seccomp unconfined", func(t *testing.T) {
		if secCtx.SeccompProfile == nil {
			t.Fatal("Expected SeccompProfile to be set")
		}
		if secCtx.SeccompProfile.Type != v1.SeccompProfileTypeUnconfined {
			t.Errorf("Expected Seccomp Unconfined, got %s", secCtx.SeccompProfile.Type)
		}
	})