From 145883b2adbdafe78a3f2a8f5ee4ae591f2be5df Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Mon, 3 Jan 2022 09:36:17 -0800 Subject: [PATCH] Require integration test to be run as sudo/root (#4824) (#4830) * Remove internal sudo commands from integration tests * Run integration CI as sudo Signed-off-by: Derek Nola --- .github/workflows/integration.yaml | 2 +- tests/TESTING.md | 3 +- tests/integration/Dockerfile.test | 1 + .../secretsencryption_int_test.go | 2 +- tests/util/cmd.go | 53 ++++++------------- 5 files changed, 20 insertions(+), 41 deletions(-) diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index b70ac9f1cf..580e301c49 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -56,7 +56,7 @@ jobs: - name: Run Integration Tests run: | chmod +x ./dist/artifacts/k3s - go test ./pkg/... ./tests/integration/... -run Integration + sudo -E env "PATH=$PATH" go test ./pkg/... ./tests/integration/... -run Integration - name: On Failure, Launch Debug Session if: ${{ failure() }} uses: mxschmitt/action-tmate@v3 diff --git a/tests/TESTING.md b/tests/TESTING.md index e23aaada64..33192b30a6 100644 --- a/tests/TESTING.md +++ b/tests/TESTING.md @@ -71,7 +71,8 @@ See the [local storage test](https://github.com/k3s-io/k3s/blob/master/tests/int ### Running -Integration tests can be run with no k3s cluster present, each test will spin up and kill the appropriate k3s server it needs. +Integration tests can be run with no k3s cluster present, each test will spin up and kill the appropriate k3s server it needs. +Note: Integration tests must be run as root, prefix the commands below with `sudo -E env "PATH=$PATH"` if a sudo user. ```bash go test ./pkg/... ./tests/integration/... -run Integration ``` diff --git a/tests/integration/Dockerfile.test b/tests/integration/Dockerfile.test index 7239a1ac90..cb9fc4c7f5 100644 --- a/tests/integration/Dockerfile.test +++ b/tests/integration/Dockerfile.test @@ -1,5 +1,6 @@ FROM golang:buster +# Enables integration tests to run on existing cluster via Sonobuoy plugin RUN apt update && \ apt install -y curl git lsof bash openssh-server gcc g++ make ca-certificates && \ diff --git a/tests/integration/secretsencryption/secretsencryption_int_test.go b/tests/integration/secretsencryption/secretsencryption_int_test.go index 66b6e956bd..41630947fa 100644 --- a/tests/integration/secretsencryption/secretsencryption_int_test.go +++ b/tests/integration/secretsencryption/secretsencryption_int_test.go @@ -143,7 +143,7 @@ var _ = Describe("secrets encryption rotation", func() { var _ = AfterSuite(func() { if !testutil.IsExistingServer() { Expect(testutil.K3sKillServer(secretsEncryptionServer)).To(Succeed()) - Expect(testutil.K3sRemoveDataDir(secretsEncryptionDataDir)).To(Succeed()) + Expect(os.RemoveAll(secretsEncryptionDataDir)).To(Succeed()) } }) diff --git a/tests/util/cmd.go b/tests/util/cmd.go index e0d7ec3c4a..64a12e7d00 100644 --- a/tests/util/cmd.go +++ b/tests/util/cmd.go @@ -3,6 +3,7 @@ package util import ( "bufio" "encoding/json" + "errors" "os" "os/exec" "os/user" @@ -66,32 +67,17 @@ func IsExistingServer() bool { // cmdEx1, err := K3sCmd("etcd-snapshot", "ls") // cmdEx2, err := K3sCmd("kubectl", "get", "pods", "-A") func K3sCmd(cmdName string, cmdArgs ...string) (string, error) { + if !IsRoot() { + return "", errors.New("integration tests must be run as sudo/root") + } k3sBin := findK3sExecutable() // Only run sudo if not root - var cmd *exec.Cmd - if IsRoot() { - k3sCmd := append([]string{cmdName}, cmdArgs...) - cmd = exec.Command(k3sBin, k3sCmd...) - } else { - k3sCmd := append([]string{k3sBin, cmdName}, cmdArgs...) - cmd = exec.Command("sudo", k3sCmd...) - } + k3sCmd := append([]string{cmdName}, cmdArgs...) + cmd := exec.Command(k3sBin, k3sCmd...) byteOut, err := cmd.CombinedOutput() return string(byteOut), err } -// K3sRemoveDataDir removes the provided directory as root -func K3sRemoveDataDir(dataDir string) error { - var cmd *exec.Cmd - if IsRoot() { - cmd = exec.Command("rm", "-rf", dataDir) - } else { - cmd = exec.Command("sudo", "rm", "-rf", dataDir) - } - _, err := cmd.CombinedOutput() - return err -} - func contains(source []string, target string) bool { for _, s := range source { if s == target { @@ -140,6 +126,10 @@ func FindStringInCmdAsync(scanner *bufio.Scanner, target string) bool { // with the provided arguments. Subsequent/parallel calls to this function will block until // the original lock is cleared using K3sKillServer func K3sStartServer(inputArgs ...string) (*K3sServer, error) { + if !IsRoot() { + return nil, errors.New("integration tests must be run as sudo/root") + } + logrus.Info("waiting to get server lock") k3sLock, err := flock.Acquire(lockFile) if err != nil { @@ -152,14 +142,9 @@ func K3sStartServer(inputArgs ...string) (*K3sServer, error) { } k3sBin := findK3sExecutable() - var cmd *exec.Cmd - if IsRoot() { - k3sCmd := append([]string{"server"}, cmdArgs...) - cmd = exec.Command(k3sBin, k3sCmd...) - } else { - k3sCmd := append([]string{k3sBin, "server"}, cmdArgs...) - cmd = exec.Command("sudo", k3sCmd...) - } + + k3sCmd := append([]string{"server"}, cmdArgs...) + cmd := exec.Command(k3sBin, k3sCmd...) cmdOut, _ := cmd.StderrPipe() cmd.Stderr = os.Stderr err = cmd.Start() @@ -169,16 +154,8 @@ func K3sStartServer(inputArgs ...string) (*K3sServer, error) { // K3sKillServer terminates the running K3s server and unlocks the file for // other tests func K3sKillServer(server *K3sServer) error { - if IsRoot() { - if err := server.cmd.Process.Kill(); err != nil { - return err - } - } else { - // Since k3s was launched as sudo, we can't just kill the process - killCmd := exec.Command("sudo", "pkill", "k3s") - if err := killCmd.Run(); err != nil { - return err - } + if err := server.cmd.Process.Kill(); err != nil { + return err } return flock.Release(server.lock) }