Commit graph

34 commits

Author SHA1 Message Date
baude
7b062cf4c1 Add support for kpod kill
Kill one or more containers using a user-provided signal.  If not signal
is provided, KILL is used.

Signed-off-by: baude <bbaude@redhat.com>
2017-09-28 09:34:21 -05:00
baude
3bf23b684a Add kpod wait
Waits on one or more containers to stop and prints the container's
return code

Signed-off-by: baude <bbaude@redhat.com>
2017-09-27 09:03:33 -05:00
Antonio Murdaca
a11b8cd8ec
sandbox, ctr: SELinux fixes
server: fix selinux labels for pod and containers

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

sandbox: set selinux labels from request, not defaults

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

container_create: use sandbox's selinux if container's nil

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

sandbox: correctly init selinux labels

First, we weren't correctly initializing selinux labels. If any of
(level, user, role, type) was missing from kube selinux options, we
were erroring out. This is wrong as kube sends just `level=s0`
sometimes and docker itself allows `--security-opt label=level:s0`.
This patch directly initializes selinux labels, correctly, and adds a
test to verify it.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

test: testdata: use container_runtime_t selinux type

RHEL SELinux policy doesn't have `container_t` type but we're using it
in our fixtures. That means Fedora integration tests pass because
`container_t` is in Fedora's container policy but RHEL is broken.
Fix it by using `container_runtime_t` which is aliased in Fedora policy
to `container_t`.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-17 22:40:17 +02:00
Antonio Murdaca
af0a494251
container_create: handle cap add/drop ALL
Kubelet can send cap add/drop ALL. Handle that in CRI-O as well.
Also, this PR is re-vendoring runtime-tools to fix capabilities add to
add caps to _all_ caps set **and** fix a shared memory issue (caps set
were initialized with the same slice, if one modifies one slice, it's
reflected on the other slices, the vendoring fixes this as well)

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-07 16:43:33 +02:00
Andrew Pilloud
e4e982d78a test: hostport network test
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-06-22 15:46:15 -07:00
Andrew Pilloud
afc731d3a6 testdata: Remove hostport from sandbox_config
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-06-22 08:51:50 -07:00
Antonio Murdaca
8b4e3036ea
test: add a test for /etc/resolv.conf in rw/ro mode
This patch isn't adding a test for /etc/hosts as that requires host
network and we don't want to play with host's /etc/hosts when running
make localintegration on our laptops. That may change in the future
moving to some sort of in-container testing.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-06-16 11:01:12 +02:00
Antonio Murdaca
4dcf33581c
test: add CGROUP_MANAGER env to switch to systemd
default is still cgroupfs

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-05-18 17:39:49 +02:00
Antonio Murdaca
725c159bea
test: testdata: get rid of memory limits
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-05-17 17:30:11 +02:00
Dan Walsh
4493b6f176 Rename ocid to crio.
The ocid project was renamed to CRI-O, months ago, it is time that we moved
all of the code to the new name.  We want to elminate the name ocid from use.
Move fully to crio.

Also cric is being renamed to crioctl for the time being.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
2017-05-12 09:56:06 -04:00
Mrunal Patel
4a02418c82 Add a test config for device
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-05-10 13:36:33 -07:00
Antonio Murdaca
139b16bac2
server: fix set caps on container create
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-05-05 16:31:52 +02:00
Antonio Murdaca
715785950c
test: use redis:alpine
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-05-05 16:31:48 +02:00
Aleksa Sarai
6940313691
test: add tests for split std{err,out}
Now that we have support for split std{out,err}, make sure that execsync
will correctly handle the split stdio properly. In addition, extend the
ctr logging test to make sure that the regular container logging is also
split correctly. We can't test !terminal containers because we only have
a single console for both std{out,err}.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2017-04-12 21:59:25 +10:00
Aleksa Sarai
65527da361
test: add logging tests
The main purpose of these tests is to make sure that the log actually
contains output from the container. We don't test the timestamps or the
stream that's stated at the moment.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2017-04-05 02:45:58 +10:00
Aleksa Sarai
c31f2cf0ee
test: unset log_* in configurations
This is necessary, as otherwise ocid will use its own current directory
as a log_directory, which is not the best idea in the world. The same
applies for log_path.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2017-04-05 02:45:58 +10:00
Daniel J Walsh
6f81ec8c67 Default all container storage to /var/lib/containers/storage
containers/storage is defaulting to /var/lib/containers/storage
for image and containers storage.  It is also defaulting to
/var/run/containers/storage for all runtime.  The defaults
for CRI-O should match so that lots of other tools that use
containers/storage can share the same storage.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2017-03-24 08:19:08 -04:00
Antonio Murdaca
2202c1a460
storage: fix image retrieval by id
kubelet sends a request to create a container with an image ID (as
opposed as an image name). That ID comes from the ImageStatus response.
This patch fixes that by setting the image ID as well as the image name
and fix the login to lookup for image ID as well.

Found while running `make test-e2e-node`.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-31 16:32:30 +01:00
Daniel J Walsh
9c61688098 Default type for containers is not container_t
We usually specify MCS Labels as comma separated pair.
Finally if we run two different containers we want them on different
MCS labels.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2017-01-25 22:11:30 +01:00
Samuel Ortiz
b6455253c2
test: Add host pod ping test
We create a pod with host networking and we try to ping
it from the host.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-21 12:24:37 +01:00
Mrunal Patel
a418ef8dc2 Fixup cgroup in test sandbox config
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-16 13:33:38 -08:00
Antonio Murdaca
e1054cf28e
cmd/client: move pod create to pod run
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-14 18:15:37 +01:00
Antonio Murdaca
4bb0830c37 Merge pull request from xlgao-zju/reload-apparmor-profile
reload default apparmor profile if it is unloaded
2016-12-13 11:10:26 +01:00
Mrunal Patel
7a6213c3ef Merge pull request from sameo/topic/config.json
testdata: Add missing closed curly
2016-12-08 16:12:02 -08:00
Samuel Ortiz
c55d9a5da6
testdata: Add missing closed curly
Typo introduced by PR .

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-09 00:11:16 +01:00
fd7a052023
testdata: fix invalid json doc
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
2016-12-08 15:23:24 -05:00
Samuel Ortiz
5d8537f270
testdata: sandbox ns options should be under security_context
And not directly under linux.

Fixes 

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-08 18:09:28 +01:00
Xianglin Gao
cb5ed1ce9d reload default apparmor profile if it is unloaded
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
2016-12-07 20:19:29 +08:00
Xianglin Gao
bec3c3e2aa add test cases
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
2016-12-01 21:42:13 +08:00
Antonio Murdaca
78ee03a8fc
add seccomp support
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-11-28 22:05:34 +01:00
HaoZhang
bdd817d002 add test for sysctls
Signed-off-by: HaoZhang <crazykev@zju.edu.cn>
2016-11-24 20:32:33 +08:00
HaoZhang
018c4db06d add test for container/pod metadata in status/list APIs
Signed-off-by: HaoZhang <crazykev@zju.edu.cn>
2016-11-02 00:37:40 +08:00
Mike Brown
5ac01ec8f3 removing mount from test/testdata/container_redis.json
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2016-10-07 12:32:11 -05:00
Antonio Murdaca
3ddf3f21c1
test: fix and add tests
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-09-27 10:42:53 +02:00