@@ -380,6 +380,119 @@ func TestPodExtractContent(t *testing.T) {
380380 },
381381 },
382382 },
383+ {
384+ name : "content extraction expected - legacy security context config, no catalog cache dir" ,
385+ input : & v1alpha1.CatalogSource {
386+ ObjectMeta : metav1.ObjectMeta {
387+ Name : "test" ,
388+ Namespace : "testns" ,
389+ },
390+ Spec : v1alpha1.CatalogSourceSpec {
391+ GrpcPodConfig : & v1alpha1.GrpcPodConfig {
392+ ExtractContent : & v1alpha1.ExtractContentConfig {
393+ CatalogDir : "/catalog" ,
394+ },
395+ },
396+ },
397+ },
398+ securityContextConfig : v1alpha1 .Legacy ,
399+ expected : & corev1.Pod {
400+ ObjectMeta : metav1.ObjectMeta {
401+ GenerateName : "test-" ,
402+ Namespace : "testns" ,
403+ Labels : map [string ]string {"olm.pod-spec-hash" : "b0yrMl85J8bFjFWNl1O2XxsX698iPAjbpNhRIT" , "olm.managed" : "true" },
404+ Annotations : map [string ]string {"cluster-autoscaler.kubernetes.io/safe-to-evict" : "true" },
405+ },
406+ Spec : corev1.PodSpec {
407+ Volumes : []corev1.Volume {
408+ {
409+ Name : "utilities" ,
410+ VolumeSource : corev1.VolumeSource {EmptyDir : & corev1.EmptyDirVolumeSource {}},
411+ },
412+ {
413+ Name : "catalog-content" ,
414+ VolumeSource : corev1.VolumeSource {EmptyDir : & corev1.EmptyDirVolumeSource {}},
415+ },
416+ },
417+ InitContainers : []corev1.Container {
418+ {
419+ Name : "extract-utilities" ,
420+ Image : "utilImage" ,
421+ Command : []string {"cp" },
422+ Args : []string {"/bin/copy-content" , "/utilities/copy-content" },
423+ VolumeMounts : []corev1.VolumeMount {{Name : "utilities" , MountPath : "/utilities" }},
424+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
425+ },
426+ {
427+ Name : "extract-content" ,
428+ Image : "image" ,
429+ ImagePullPolicy : image .InferImagePullPolicy ("image" ),
430+ Command : []string {"/utilities/copy-content" },
431+ Args : []string {
432+ "--catalog.from=/catalog" ,
433+ "--catalog.to=/extracted-catalog/catalog" ,
434+ },
435+ VolumeMounts : []corev1.VolumeMount {
436+ {Name : "utilities" , MountPath : "/utilities" },
437+ {Name : "catalog-content" , MountPath : "/extracted-catalog" },
438+ },
439+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
440+ },
441+ },
442+ Containers : []corev1.Container {
443+ {
444+ Name : "name" ,
445+ Image : "opmImage" ,
446+ Command : []string {"/bin/opm" },
447+ Args : []string {"serve" , "/extracted-catalog/catalog" , "--cache-dir=/extracted-catalog/cache" },
448+ Ports : []corev1.ContainerPort {{Name : "grpc" , ContainerPort : 50051 }},
449+ ReadinessProbe : & corev1.Probe {
450+ ProbeHandler : corev1.ProbeHandler {
451+ Exec : & corev1.ExecAction {
452+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
453+ },
454+ },
455+ InitialDelaySeconds : 0 ,
456+ TimeoutSeconds : 5 ,
457+ },
458+ LivenessProbe : & corev1.Probe {
459+ ProbeHandler : corev1.ProbeHandler {
460+ Exec : & corev1.ExecAction {
461+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
462+ },
463+ },
464+ InitialDelaySeconds : 0 ,
465+ TimeoutSeconds : 5 ,
466+ },
467+ StartupProbe : & corev1.Probe {
468+ ProbeHandler : corev1.ProbeHandler {
469+ Exec : & corev1.ExecAction {
470+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
471+ },
472+ },
473+ FailureThreshold : 10 ,
474+ PeriodSeconds : 10 ,
475+ TimeoutSeconds : 5 ,
476+ },
477+ Resources : corev1.ResourceRequirements {
478+ Requests : corev1.ResourceList {
479+ corev1 .ResourceCPU : resource .MustParse ("10m" ),
480+ corev1 .ResourceMemory : resource .MustParse ("50Mi" ),
481+ },
482+ },
483+ SecurityContext : & corev1.SecurityContext {
484+ ReadOnlyRootFilesystem : ptr .To (false ),
485+ },
486+ ImagePullPolicy : image .InferImagePullPolicy ("image" ),
487+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
488+ VolumeMounts : []corev1.VolumeMount {{Name : "catalog-content" , MountPath : "/extracted-catalog" }},
489+ },
490+ },
491+ NodeSelector : map [string ]string {"kubernetes.io/os" : "linux" },
492+ ServiceAccountName : "service-account" ,
493+ },
494+ },
495+ },
383496 {
384497 name : "content extraction not requested - restricted security context config" ,
385498 input : & v1alpha1.CatalogSource {
@@ -586,6 +699,134 @@ func TestPodExtractContent(t *testing.T) {
586699 },
587700 },
588701 },
702+ {
703+ name : "content extraction expected - restricted security context config, no catalog cache dir" ,
704+ input : & v1alpha1.CatalogSource {
705+ ObjectMeta : metav1.ObjectMeta {
706+ Name : "test" ,
707+ Namespace : "testns" ,
708+ },
709+ Spec : v1alpha1.CatalogSourceSpec {
710+ GrpcPodConfig : & v1alpha1.GrpcPodConfig {
711+ ExtractContent : & v1alpha1.ExtractContentConfig {
712+ CatalogDir : "/catalog" ,
713+ },
714+ },
715+ },
716+ },
717+ securityContextConfig : v1alpha1 .Restricted ,
718+ expected : & corev1.Pod {
719+ ObjectMeta : metav1.ObjectMeta {
720+ GenerateName : "test-" ,
721+ Namespace : "testns" ,
722+ Labels : map [string ]string {"olm.pod-spec-hash" : "3qxzUcTKDfq8QwZPoXteAv35FSwRho7vyYkv4d" , "olm.managed" : "true" },
723+ Annotations : map [string ]string {"cluster-autoscaler.kubernetes.io/safe-to-evict" : "true" },
724+ },
725+ Spec : corev1.PodSpec {
726+ Volumes : []corev1.Volume {
727+ {
728+ Name : "utilities" ,
729+ VolumeSource : corev1.VolumeSource {EmptyDir : & corev1.EmptyDirVolumeSource {}},
730+ },
731+ {
732+ Name : "catalog-content" ,
733+ VolumeSource : corev1.VolumeSource {EmptyDir : & corev1.EmptyDirVolumeSource {}},
734+ },
735+ },
736+ InitContainers : []corev1.Container {
737+ {
738+ Name : "extract-utilities" ,
739+ Image : "utilImage" ,
740+ Command : []string {"cp" },
741+ Args : []string {"/bin/copy-content" , "/utilities/copy-content" },
742+ SecurityContext : & corev1.SecurityContext {
743+ Capabilities : & corev1.Capabilities {Drop : []corev1.Capability {"ALL" }},
744+ AllowPrivilegeEscalation : ptr .To (false ),
745+ },
746+ VolumeMounts : []corev1.VolumeMount {{Name : "utilities" , MountPath : "/utilities" }},
747+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
748+ },
749+ {
750+ Name : "extract-content" ,
751+ Image : "image" ,
752+ ImagePullPolicy : image .InferImagePullPolicy ("image" ),
753+ Command : []string {"/utilities/copy-content" },
754+ Args : []string {
755+ "--catalog.from=/catalog" ,
756+ "--catalog.to=/extracted-catalog/catalog" ,
757+ },
758+ SecurityContext : & corev1.SecurityContext {
759+ Capabilities : & corev1.Capabilities {Drop : []corev1.Capability {"ALL" }},
760+ AllowPrivilegeEscalation : ptr .To (false ),
761+ },
762+ VolumeMounts : []corev1.VolumeMount {
763+ {Name : "utilities" , MountPath : "/utilities" },
764+ {Name : "catalog-content" , MountPath : "/extracted-catalog" },
765+ },
766+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
767+ },
768+ },
769+ Containers : []corev1.Container {
770+ {
771+ Name : "name" ,
772+ Image : "opmImage" ,
773+ Command : []string {"/bin/opm" },
774+ Args : []string {"serve" , "/extracted-catalog/catalog" , "--cache-dir=/extracted-catalog/cache" },
775+ Ports : []corev1.ContainerPort {{Name : "grpc" , ContainerPort : 50051 }},
776+ ReadinessProbe : & corev1.Probe {
777+ ProbeHandler : corev1.ProbeHandler {
778+ Exec : & corev1.ExecAction {
779+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
780+ },
781+ },
782+ InitialDelaySeconds : 0 ,
783+ TimeoutSeconds : 5 ,
784+ },
785+ LivenessProbe : & corev1.Probe {
786+ ProbeHandler : corev1.ProbeHandler {
787+ Exec : & corev1.ExecAction {
788+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
789+ },
790+ },
791+ InitialDelaySeconds : 0 ,
792+ TimeoutSeconds : 5 ,
793+ },
794+ StartupProbe : & corev1.Probe {
795+ ProbeHandler : corev1.ProbeHandler {
796+ Exec : & corev1.ExecAction {
797+ Command : []string {"grpc_health_probe" , "-addr=:50051" },
798+ },
799+ },
800+ FailureThreshold : 10 ,
801+ PeriodSeconds : 10 ,
802+ TimeoutSeconds : 5 ,
803+ },
804+ Resources : corev1.ResourceRequirements {
805+ Requests : corev1.ResourceList {
806+ corev1 .ResourceCPU : resource .MustParse ("10m" ),
807+ corev1 .ResourceMemory : resource .MustParse ("50Mi" ),
808+ },
809+ },
810+ ImagePullPolicy : image .InferImagePullPolicy ("image" ),
811+ SecurityContext : & corev1.SecurityContext {
812+ Capabilities : & corev1.Capabilities {Drop : []corev1.Capability {"ALL" }},
813+ AllowPrivilegeEscalation : ptr .To (false ),
814+ ReadOnlyRootFilesystem : ptr .To (false ),
815+ },
816+ TerminationMessagePolicy : "FallbackToLogsOnError" ,
817+ VolumeMounts : []corev1.VolumeMount {{Name : "catalog-content" , MountPath : "/extracted-catalog" }},
818+ },
819+ },
820+ NodeSelector : map [string ]string {"kubernetes.io/os" : "linux" },
821+ SecurityContext : & corev1.PodSecurityContext {
822+ RunAsUser : ptr .To (int64 (workloadUserID )),
823+ RunAsNonRoot : ptr .To (true ),
824+ SeccompProfile : & corev1.SeccompProfile {Type : corev1 .SeccompProfileTypeRuntimeDefault },
825+ },
826+ ServiceAccountName : "service-account" ,
827+ },
828+ },
829+ },
589830 }
590831
591832 for _ , testCase := range testCases {
0 commit comments