Skip to content
This repository has been archived by the owner on Jun 28, 2024. It is now read-only.

Commit

Permalink
agent_image: Switch order of tests 4 and 5
Browse files Browse the repository at this point in the history
The reason for that being:
```
The test case 5 failed due to a specific behavior when using containerd
and the snapshotter to download images. Containerd needs to fetch both
the manifest and configuration of the image. In this case, both
images`quay.io/kata-containers/confidential-containers:signed` and
`quay.io/kata-containers/confidential-containers:unsigned` have the same
IDs (sha256). Consequently, test case 4 downloaded image
`quay.io/kata-containers/confidential-containers:signed`. So, in test
case 5, when containerd detected that the image ID already existed, it
used the manifest and image name from
`quay.io/kata-containers/confidential-containers:signed` and passed it
to kata instead of
`quay.io/kata-containers/confidential-containers:unsigned`, resulting in
the use of image
`quay.io/kata-containers/confidential-containers:signed`. This explains
the error in test case 5. As a temporary measure, deleting the image
before running each test case should address this.
```
from:
https://cloud-native.slack.com/archives/C039JSH0807/p1695618313572309?thread_ts=1695591000.697989&cid=C039JSH0807

Signed-off-by: Fabiano Fidêncio <[email protected]>
  • Loading branch information
fidencio committed Sep 25, 2023
1 parent 4b5ad40 commit d49b95c
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions integration/kubernetes/confidential/agent_image.bats
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,6 @@ setup() {
[ ${#rootfs[@]} -eq 1 ]
}

@test "$test_tag Test can pull a unencrypted signed image from a protected registry" {
setup_signature_files
create_test_pod
}

@test "$test_tag Test cannot pull an unencrypted unsigned image from a protected registry" {
setup_signature_files
local container_config="$(new_pod_config "$image_unsigned_protected")"
Expand All @@ -76,6 +71,11 @@ setup() {
assert_logs_contain 'Validate image failed: The signatures do not satisfied! Reject reason: \[Match reference failed.\]'
}

@test "$test_tag Test can pull a unencrypted signed image from a protected registry" {
setup_signature_files
create_test_pod
}

@test "$test_tag Test can pull an unencrypted unsigned image from an unprotected registry" {
setup_signature_files
pod_config="$(new_pod_config "$image_unsigned_unprotected")"
Expand Down

0 comments on commit d49b95c

Please sign in to comment.