Require integration test to be run as sudo/root (#4824) (#4830)

* Remove internal sudo commands from integration tests
* Run integration CI as sudo

Signed-off-by: Derek Nola <derek.nola@suse.com>

.github/workflows/integration.yaml

@@ -56,7 +56,7 @@ jobs:
     - name: Run Integration Tests
       run: | 
         chmod +x ./dist/artifacts/k3s
-        go test ./pkg/... ./tests/integration/... -run Integration
+        sudo -E env "PATH=$PATH" go test ./pkg/... ./tests/integration/... -run Integration
     - name: On Failure, Launch Debug Session
       if: ${{ failure() }}
       uses: mxschmitt/action-tmate@v3

tests/TESTING.md

@@ -71,7 +71,8 @@ See the [local storage test](https://github.com/k3s-io/k3s/blob/master/tests/int
 
 ### Running
 
-Integration tests can be run with no k3s cluster present, each test will spin up and kill the appropriate k3s server it needs.
+Integration tests can be run with no k3s cluster present, each test will spin up and kill the appropriate k3s server it needs.  
+Note: Integration tests must be run as root, prefix the commands below with `sudo -E env "PATH=$PATH"` if a sudo user.
 ```bash
 go test ./pkg/... ./tests/integration/... -run Integration
 ```

tests/integration/Dockerfile.test

@@ -1,5 +1,6 @@
 FROM golang:buster
 
+# Enables integration tests to run on existing cluster via Sonobuoy plugin
 
 RUN apt update && \
     apt install -y curl git lsof bash openssh-server gcc g++ make ca-certificates && \

tests/integration/secretsencryption/secretsencryption_int_test.go

@@ -143,7 +143,7 @@ var _ = Describe("secrets encryption rotation", func() {
 var _ = AfterSuite(func() {
 	if !testutil.IsExistingServer() {
 		Expect(testutil.K3sKillServer(secretsEncryptionServer)).To(Succeed())
-		Expect(testutil.K3sRemoveDataDir(secretsEncryptionDataDir)).To(Succeed())
+		Expect(os.RemoveAll(secretsEncryptionDataDir)).To(Succeed())
 	}
 })
 

tests/util/cmd.go

@@ -3,6 +3,7 @@ package util
 import (
 	"bufio"
 	"encoding/json"
+	"errors"
 	"os"
 	"os/exec"
 	"os/user"
@@ -66,32 +67,17 @@ func IsExistingServer() bool {
 //   cmdEx1, err := K3sCmd("etcd-snapshot", "ls")
 //   cmdEx2, err := K3sCmd("kubectl", "get", "pods", "-A")
 func K3sCmd(cmdName string, cmdArgs ...string) (string, error) {
+	if !IsRoot() {
+		return "", errors.New("integration tests must be run as sudo/root")
+	}
 	k3sBin := findK3sExecutable()
 	// Only run sudo if not root
-	var cmd *exec.Cmd
-	if IsRoot() {
-		k3sCmd := append([]string{cmdName}, cmdArgs...)
-		cmd = exec.Command(k3sBin, k3sCmd...)
-	} else {
-		k3sCmd := append([]string{k3sBin, cmdName}, cmdArgs...)
-		cmd = exec.Command("sudo", k3sCmd...)
-	}
+	k3sCmd := append([]string{cmdName}, cmdArgs...)
+	cmd := exec.Command(k3sBin, k3sCmd...)
 	byteOut, err := cmd.CombinedOutput()
 	return string(byteOut), err
 }
 
-// K3sRemoveDataDir removes the provided directory as root
-func K3sRemoveDataDir(dataDir string) error {
-	var cmd *exec.Cmd
-	if IsRoot() {
-		cmd = exec.Command("rm", "-rf", dataDir)
-	} else {
-		cmd = exec.Command("sudo", "rm", "-rf", dataDir)
-	}
-	_, err := cmd.CombinedOutput()
-	return err
-}
-
 func contains(source []string, target string) bool {
 	for _, s := range source {
 		if s == target {
@@ -140,6 +126,10 @@ func FindStringInCmdAsync(scanner *bufio.Scanner, target string) bool {
 // with the provided arguments. Subsequent/parallel calls to this function will block until
 // the original lock is cleared using K3sKillServer
 func K3sStartServer(inputArgs ...string) (*K3sServer, error) {
+	if !IsRoot() {
+		return nil, errors.New("integration tests must be run as sudo/root")
+	}
+
 	logrus.Info("waiting to get server lock")
 	k3sLock, err := flock.Acquire(lockFile)
 	if err != nil {
@@ -152,14 +142,9 @@ func K3sStartServer(inputArgs ...string) (*K3sServer, error) {
 	}
 
 	k3sBin := findK3sExecutable()
-	var cmd *exec.Cmd
-	if IsRoot() {
-		k3sCmd := append([]string{"server"}, cmdArgs...)
-		cmd = exec.Command(k3sBin, k3sCmd...)
-	} else {
-		k3sCmd := append([]string{k3sBin, "server"}, cmdArgs...)
-		cmd = exec.Command("sudo", k3sCmd...)
-	}
+
+	k3sCmd := append([]string{"server"}, cmdArgs...)
+	cmd := exec.Command(k3sBin, k3sCmd...)
 	cmdOut, _ := cmd.StderrPipe()
 	cmd.Stderr = os.Stderr
 	err = cmd.Start()
@@ -169,16 +154,8 @@ func K3sStartServer(inputArgs ...string) (*K3sServer, error) {
 // K3sKillServer terminates the running K3s server and unlocks the file for
 // other tests
 func K3sKillServer(server *K3sServer) error {
-	if IsRoot() {
-		if err := server.cmd.Process.Kill(); err != nil {
-			return err
-		}
-	} else {
-		// Since k3s was launched as sudo, we can't just kill the process
-		killCmd := exec.Command("sudo", "pkill", "k3s")
-		if err := killCmd.Run(); err != nil {
-			return err
-		}
+	if err := server.cmd.Process.Kill(); err != nil {
+		return err
 	}
 	return flock.Release(server.lock)
 }