Skip to content

Commit c9d5fe1

Browse files
yashtewariyashtewari
authored
Fix process_api_server test cases. (#393)
Fix process_api_server test cases. These cases used to break the cluster, mostly due to bad configuration values.
1 parent 672f8f8 commit c9d5fe1

File tree

3 files changed

+105
-98
lines changed

3 files changed

+105
-98
lines changed

‎tests/commonlib/io_utils.py

+5
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,11 @@ def exec_command(container_name: str, command: str, param_value: str, resource:
120120
open(param_value, "a+").close()
121121
return
122122

123+
if command == 'cat':
124+
with open(resource, 'w') as f:
125+
f.write(param_value)
126+
return
127+
123128
if container_name == '':
124129
raise Exception("Unknown container name is sent")
125130

‎tests/product/tests/conftest.py

+27
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,25 @@ def config_node_pre_test(cloudbeat_start_stop):
5757
'/var/lib/etcd/some_file.txt',
5858
'/etc/kubernetes/pki/some_file.txt'
5959
]
60+
61+
config_files = {
62+
'/etc/kubernetes/pki/admission_config.yaml': '''apiVersion: apiserver.config.k8s.io/v1
63+
kind: AdmissionConfiguration
64+
plugins:
65+
- name: EventRateLimit
66+
path: /etc/kubernetes/pki/event_config.yaml''',
67+
'/etc/kubernetes/pki/event_config.yaml': '''apiVersion: eventratelimit.admission.k8s.io/v1alpha1
68+
kind: Configuration
69+
limits:
70+
- type: Namespace
71+
qps: 50
72+
burst: 100
73+
cacheSize: 2000
74+
- type: User
75+
qps: 10
76+
burst: 50'''
77+
}
78+
6079
# create temporary files:
6180
for node in nodes:
6281
if node.metadata.name != cloudbeat_agent.node_name:
@@ -67,7 +86,15 @@ def config_node_pre_test(cloudbeat_start_stop):
6786
param_value=temp_file,
6887
resource='')
6988

89+
# create config files:
90+
for config_file, contents in config_files.items():
91+
api_client.exec_command(container_name=node.metadata.name,
92+
command='cat',
93+
param_value=contents,
94+
resource=config_file)
95+
7096
yield k8s_client, api_client, cloudbeat_agent
97+
7198
# delete temporary files:
7299
for node in nodes:
73100
if node.metadata.name != cloudbeat_agent.node_name:

‎tests/product/tests/data/process/process_test_cases.py

+73-98
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,6 @@
66
from commonlib.framework.reporting import skip_param_case, SkipReportData
77

88
cis_1_2_4 = [(
9-
'CIS 1.2.4',
10-
{
11-
"set": {
12-
"--kubelet-https": "false",
13-
},
14-
},
15-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
16-
'failed'
17-
),
18-
(
19-
'CIS 1.2.4',
20-
{
21-
"set": {
22-
"--kubelet-https": "true",
23-
},
24-
},
25-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
26-
'passed'
27-
),
28-
(
299
'CIS 1.2.4',
3010
{
3111
"unset": [
@@ -416,16 +396,16 @@
416396
)]
417397

418398
cis_1_2_5 = [(
419-
'CIS 1.2.5',
420-
{
421-
"set": {
422-
"--kubelet-client-certificate": "/etc/kubernetes/pki/apiserver-kubelet-client.crt ",
423-
"--kubelet-client-key": "/etc/kubernetes/pki/apiserver-kubelet-client.key"
424-
}
425-
},
426-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
427-
'passed'
428-
)]
399+
'CIS 1.2.5',
400+
{
401+
"set": {
402+
"--kubelet-client-certificate": "/etc/kubernetes/pki/apiserver-kubelet-client.crt",
403+
"--kubelet-client-key": "/etc/kubernetes/pki/apiserver-kubelet-client.key"
404+
}
405+
},
406+
'/etc/kubernetes/manifests/kube-apiserver.yaml',
407+
'passed'
408+
)]
429409

430410
cis_1_2_6 = [(
431411
'CIS 1.2.6',
@@ -535,12 +515,13 @@
535515
'CIS 1.2.10',
536516
{
537517
"set": {
538-
"--enable-admission-plugins": "EventRateLimit"
518+
"--enable-admission-plugins": "EventRateLimit",
519+
"--admission-control-config-file": "/etc/kubernetes/pki/admission_config.yaml",
539520
}
540521
},
541522
'/etc/kubernetes/manifests/kube-apiserver.yaml',
542-
'passed'
543-
)]
523+
'passed',
524+
)]
544525

545526
cis_1_2_11 = [(
546527
'CIS 1.2.11',
@@ -595,15 +576,25 @@
595576
)]
596577

597578
cis_1_2_13 = [(
598-
'CIS 1.2.13',
599-
{
600-
"set": {
601-
"--enable-admission-plugins": "AlwaysDeny"
602-
}
603-
},
604-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
605-
'failed'
606-
),
579+
'CIS 1.2.13',
580+
{
581+
"unset": [
582+
"--enable-admission-plugins"
583+
]
584+
},
585+
'/etc/kubernetes/manifests/kube-apiserver.yaml',
586+
'failed'
587+
),
588+
(
589+
'CIS 1.2.13',
590+
{
591+
"set": {
592+
"--enable-admission-plugins": "AlwaysPullImages"
593+
}
594+
},
595+
'/etc/kubernetes/manifests/kube-apiserver.yaml',
596+
'failed'
597+
),
607598
(
608599
'CIS 1.2.13',
609600
{
@@ -697,16 +688,6 @@
697688
},
698689
'/etc/kubernetes/manifests/kube-apiserver.yaml',
699690
'passed'
700-
),
701-
(
702-
'CIS 1.2.17',
703-
{
704-
"set": {
705-
"--secure-port": "260492"
706-
}
707-
},
708-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
709-
'failed'
710691
),
711692
(
712693
'CIS 1.2.17',
@@ -855,14 +836,14 @@
855836
)]
856837

857838
cis_1_2_23 = [(
858-
'CIS 1.2.23',
859-
{
860-
"set": {
861-
"--request-timeout": "-1s"
862-
}
863-
},
864-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
865-
'failed'
839+
'CIS 1.2.23',
840+
{
841+
"set": {
842+
"--request-timeout": "59s"
843+
}
844+
},
845+
'/etc/kubernetes/manifests/kube-apiserver.yaml',
846+
'failed'
866847
),
867848
(
868849
'CIS 1.2.23',
@@ -974,36 +955,37 @@
974955
)]
975956

976957
cis_1_2_32 = [(
977-
'CIS 1_2_32',
978-
{
979-
"set": {
980-
"--tls-cipher-suites": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_DUMMY"
981-
}
982-
},
983-
'/etc/kubernetes/manifests/kube-apiserver.yaml',
984-
'failed'
985-
),
986-
(
987-
'CIS 1_2_32',
958+
'CIS 1.2.32',
988959
{
989960
"set": {
990961
"--tls-cipher-suites": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
991962
}
992963
},
993964
'/etc/kubernetes/manifests/kube-apiserver.yaml',
994965
'passed'
995-
),
966+
),
996967
(
997-
'CIS 1_2_32',
968+
'CIS 1.2.32',
998969
{
999970
"set": {
1000971
"--tls-cipher-suites":
1001-
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
972+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
1002973
}
1003974
},
1004975
'/etc/kubernetes/manifests/kube-apiserver.yaml',
1005976
'passed'
1006-
)]
977+
),
978+
(
979+
'CIS 1.2.32',
980+
{
981+
"set": {
982+
"--tls-cipher-suites":
983+
"TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
984+
}
985+
},
986+
'/etc/kubernetes/manifests/kube-apiserver.yaml',
987+
'failed'
988+
)]
1007989

1008990
cis_4_2_1 = [(
1009991
'CIS 4.2.1',
@@ -1301,51 +1283,44 @@
13011283

13021284
api_server_rules = [
13031285
*cis_1_2_2,
1304-
*skip_param_case(skip_list=[*cis_1_2_3,
1305-
*cis_1_2_4,
1306-
*cis_1_2_5
1307-
],
1286+
*skip_param_case(skip_list=[*cis_1_2_3],
13081287
data_to_report=SkipReportData(
1309-
skip_reason="This case fails and breaks cluster")
1310-
),
1288+
url_title="security-team: #4975",
1289+
url_link="https://github.com/elastic/security-team/issues/4975",
1290+
skip_reason="Known issue: rule not implemented"
1291+
)),
1292+
*cis_1_2_4,
1293+
*cis_1_2_5,
13111294
*cis_1_2_6,
13121295
*cis_1_2_7,
13131296
*cis_1_2_8,
1314-
*skip_param_case(skip_list=[*cis_1_2_9,
1315-
*cis_1_2_10
1316-
],
1297+
*cis_1_2_9[:1],
1298+
*skip_param_case(skip_list=[*cis_1_2_9[1:], *cis_1_2_10],
13171299
data_to_report=SkipReportData(
1318-
skip_reason="This case fails and breaks cluster")
1319-
),
1300+
url_title="security-team: #5128",
1301+
url_link="https://github.com/elastic/security-team/issues/5128",
1302+
skip_reason="Known issue: connection errors"
1303+
)),
13201304
*cis_1_2_11,
13211305
*cis_1_2_12,
13221306
*cis_1_2_13,
13231307
*cis_1_2_14,
13241308
*cis_1_2_15,
13251309
*cis_1_2_16,
1326-
*skip_param_case(skip_list=[*cis_1_2_17],
1327-
data_to_report=SkipReportData(
1328-
skip_reason="This case fails and breaks cluster")
1329-
),
1310+
*cis_1_2_17,
13301311
*cis_1_2_18,
13311312
*cis_1_2_19,
13321313
*cis_1_2_20,
13331314
*cis_1_2_21,
13341315
*cis_1_2_22,
1335-
*skip_param_case(skip_list=[*cis_1_2_23],
1336-
data_to_report=SkipReportData(
1337-
skip_reason="This case fails and breaks cluster")
1338-
),
1316+
*cis_1_2_23,
13391317
*cis_1_2_24,
13401318
*cis_1_2_25,
13411319
*cis_1_2_26,
13421320
*cis_1_2_27,
13431321
*cis_1_2_28,
13441322
*cis_1_2_29,
1345-
*skip_param_case(skip_list=[*cis_1_2_32],
1346-
data_to_report=SkipReportData(
1347-
skip_reason="This case fails and breaks cluster")
1348-
)
1323+
*cis_1_2_32,
13491324
]
13501325

13511326
controller_manager_rules = [

0 commit comments

Comments
 (0)