mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
88dc842729
As of April 1, Docker Hub rate limits tightened. With only 10 pulls/hr/IP, we're likely to encounter test failures. Switch all Docker images getting pulled from this repository to use the HashiCorp managed registry mirror. Note that most of our tests in `drivers/docker` don't pull from the remote registry but load a local image, while others will need to pull from the remote and fetch different images depending on OS/arch. Refactor the definition of test task configuration to make it clear which is which, and de-factor some false sharing of setup functions. Updates the E2E tests to use that registry by configuring the Docker daemon. This required changing out a few container images that we don't have in the registry, but these new images are all smaller. There are a couple of tests that still use explicitly-tagged `docker.io` images or other third-party registries, which have been left in place. Ref: https://hashicorp.atlassian.net/browse/NET-12233 update E2E images to those in the registry mirror fix windows and docklog test build fix stopsignal test mop-up more mop-up
136 lines
2.8 KiB
Go
136 lines
2.8 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build windows
|
|
|
|
package docker
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/nomad/ci"
|
|
"github.com/hashicorp/nomad/client/allocdir"
|
|
"github.com/hashicorp/nomad/helper/uuid"
|
|
"github.com/hashicorp/nomad/plugins/drivers"
|
|
"github.com/shoenig/test/must"
|
|
)
|
|
|
|
func newTaskConfig(command []string) TaskConfig {
|
|
busyboxImageID := testRemoteDockerImage("hashicorpdev/busybox-windows", "server2016-0.1")
|
|
|
|
// BUSYBOX_IMAGE environment variable overrides the busybox image name
|
|
if img, ok := os.LookupEnv("BUSYBOX_IMAGE"); ok {
|
|
busyboxImageID = img
|
|
}
|
|
|
|
return TaskConfig{
|
|
Image: busyboxImageID,
|
|
ImagePullTimeout: "5m",
|
|
Command: command[0],
|
|
Args: command[1:],
|
|
}
|
|
}
|
|
|
|
// No-op on windows because we don't load images.
|
|
func copyImage(t *testing.T, taskDir *allocdir.TaskDir, image string) {
|
|
}
|
|
|
|
func Test_validateImageUser(t *testing.T) {
|
|
ci.Parallel(t)
|
|
|
|
taskCfg := &drivers.TaskConfig{
|
|
ID: uuid.Generate(),
|
|
Name: "busybox-demo",
|
|
User: "nomadUser",
|
|
}
|
|
taskDriverCfg := newTaskConfig([]string{"sh", "-c", "sleep 1"})
|
|
|
|
tests := []struct {
|
|
name string
|
|
taskUser string
|
|
containerUser string
|
|
privileged bool
|
|
isolation string
|
|
driverConfig *DriverConfig
|
|
wantErr bool
|
|
want string
|
|
}{
|
|
{
|
|
"normal user",
|
|
"nomadUser",
|
|
"nomadUser",
|
|
false,
|
|
"process",
|
|
&DriverConfig{},
|
|
false,
|
|
"",
|
|
},
|
|
{
|
|
"ContainerAdmin image user, non-priviliged",
|
|
"",
|
|
"ContainerAdmin",
|
|
false,
|
|
"process",
|
|
&DriverConfig{},
|
|
true,
|
|
containerAdminErrMsg,
|
|
},
|
|
{
|
|
"ContainerAdmin image user, non-priviliged, but hyper-v",
|
|
"",
|
|
"ContainerAdmin",
|
|
false,
|
|
"hyper-v",
|
|
&DriverConfig{},
|
|
false,
|
|
"",
|
|
},
|
|
{
|
|
"ContainerAdmin task user, non-priviliged",
|
|
"",
|
|
"ContainerAdmin",
|
|
false,
|
|
"process",
|
|
&DriverConfig{},
|
|
true,
|
|
containerAdminErrMsg,
|
|
},
|
|
{
|
|
"ContainerAdmin image user, non-priviliged, but overriden by task user",
|
|
"ContainerUser",
|
|
"ContainerAdmin",
|
|
false,
|
|
"process",
|
|
&DriverConfig{},
|
|
false,
|
|
"",
|
|
},
|
|
{
|
|
"ContainerAdmin image user, non-priviliged, but overriden by windows_allow_insecure_container_admin",
|
|
"ContainerAdmin",
|
|
"ContainerAdmin",
|
|
false,
|
|
"process",
|
|
&DriverConfig{WindowsAllowInsecureContainerAdmin: true},
|
|
false,
|
|
"",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
taskCfg.User = tt.taskUser
|
|
taskDriverCfg.Privileged = tt.privileged
|
|
taskDriverCfg.Isolation = tt.isolation
|
|
|
|
err := validateImageUser(tt.containerUser, tt.taskUser, &taskDriverCfg, tt.driverConfig)
|
|
if tt.wantErr {
|
|
must.Error(t, err)
|
|
must.Eq(t, tt.want, containerAdminErrMsg)
|
|
} else {
|
|
must.NoError(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|