Skip to content

Commit c60a17a

Browse files
rksharma95rksharma95
committed
handle ginkgo test flakiness
Signed-off-by: rksharma95 <[email protected]>
1 parent 5e82b50 commit c60a17a

File tree

3 files changed

+130
-72
lines changed

3 files changed

+130
-72
lines changed

‎tests/k8s_env/multicontainer/multicontainer_test.go

+55-31
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import (
77
"fmt"
88
"time"
99

10+
"github.com/kubearmor/KubeArmor/protobuf"
11+
1012
. "github.com/kubearmor/KubeArmor/tests/util"
1113
. "github.com/onsi/ginkgo/v2"
1214
. "github.com/onsi/gomega"
@@ -59,13 +61,16 @@ var _ = Describe("Multicontainer", func() {
5961
fmt.Printf("---START---\n%s---END---\n", sout)
6062
Expect(sout).To(MatchRegexp(".*Permission denied"))
6163

64+
expect := protobuf.Alert{
65+
PolicyName: "container-1-block-ls",
66+
Severity: "2",
67+
ContainerName: "container-1",
68+
}
69+
6270
// check policy violation alert
63-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
71+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
6472
Expect(err).To(BeNil())
65-
Expect(len(alerts)).To(BeNumerically(">=", 1))
66-
Expect(alerts[0].PolicyName).To(Equal("container-1-block-ls"))
67-
Expect(alerts[0].Severity).To(Equal("2"))
68-
Expect(alerts[0].ContainerName).To(Equal("container-1"))
73+
Expect(res.Found).To(BeTrue())
6974

7075
//container-2 should run ls
7176
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
@@ -87,26 +92,33 @@ var _ = Describe("Multicontainer", func() {
8792
Expect(sout).To(MatchRegexp(".*Permission denied"))
8893

8994
// check policy violation alert
90-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
95+
expect := protobuf.Alert{
96+
PolicyName: "empty-array-ls-block",
97+
Severity: "4",
98+
ContainerName: "container-1",
99+
}
100+
101+
// check policy violation alert
102+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
91103
Expect(err).To(BeNil())
92-
Expect(len(alerts)).To(BeNumerically(">=", 1))
93-
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
94-
Expect(alerts[0].Severity).To(Equal("4"))
95-
Expect(alerts[0].ContainerName).To(Equal("container-1"))
104+
Expect(res.Found).To(BeTrue())
96105

97106
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
98107
Expect(err).To(BeNil())
99108
fmt.Printf("---START---\n%s---END---\n", sout)
100109
Expect(sout).To(MatchRegexp(".*Permission denied"))
101110

102111
// check policy violation alert
103-
_, alerts, err = KarmorGetLogs(5*time.Second, 1)
104-
Expect(err).To(BeNil())
105-
Expect(len(alerts)).To(BeNumerically(">=", 1))
106-
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
107-
Expect(alerts[0].Severity).To(Equal("4"))
108-
Expect(alerts[0].ContainerName).To(Equal("container-2"))
112+
expect = protobuf.Alert{
113+
PolicyName: "empty-array-ls-block",
114+
Severity: "4",
115+
ContainerName: "container-2",
116+
}
109117

118+
// check policy violation alert
119+
res, err = KarmorGetTargetAlert(5*time.Second, &expect)
120+
Expect(err).To(BeNil())
121+
Expect(res.Found).To(BeTrue())
110122
})
111123

112124
//kubearmor.io/container.name: ""
@@ -123,25 +135,33 @@ var _ = Describe("Multicontainer", func() {
123135
Expect(sout).To(MatchRegexp(".*Permission denied"))
124136

125137
// check policy violation alert
126-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
138+
expect := protobuf.Alert{
139+
PolicyName: "empty-array-ls-block",
140+
Severity: "4",
141+
ContainerName: "container-1",
142+
}
143+
144+
// check policy violation alert
145+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
127146
Expect(err).To(BeNil())
128-
Expect(len(alerts)).To(BeNumerically(">=", 1))
129-
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
130-
Expect(alerts[0].Severity).To(Equal("4"))
131-
Expect(alerts[0].ContainerName).To(Equal("container-1"))
147+
Expect(res.Found).To(BeTrue())
132148

133149
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})
134150
Expect(err).To(BeNil())
135151
fmt.Printf("---START---\n%s---END---\n", sout)
136152
Expect(sout).To(MatchRegexp(".*Permission denied"))
137153

138154
// check policy violation alert
139-
_, alerts, err = KarmorGetLogs(5*time.Second, 1)
155+
expect = protobuf.Alert{
156+
PolicyName: "empty-array-ls-block",
157+
Severity: "4",
158+
ContainerName: "container-2",
159+
}
160+
161+
// check policy violation alert
162+
res, err = KarmorGetTargetAlert(5*time.Second, &expect)
140163
Expect(err).To(BeNil())
141-
Expect(len(alerts)).To(BeNumerically(">=", 1))
142-
Expect(alerts[0].PolicyName).To(Equal("empty-array-ls-block"))
143-
Expect(alerts[0].Severity).To(Equal("4"))
144-
Expect(alerts[0].ContainerName).To(Equal("container-2"))
164+
Expect(res.Found).To(BeTrue())
145165

146166
})
147167

@@ -158,12 +178,16 @@ var _ = Describe("Multicontainer", func() {
158178
Expect(sout).To(MatchRegexp(".*Permission denied"))
159179

160180
// check policy violation alert
161-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
181+
expect := protobuf.Alert{
182+
PolicyName: "malformated-array-ls-block",
183+
Severity: "4",
184+
ContainerName: "container-1",
185+
}
186+
187+
// check policy violation alert
188+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
162189
Expect(err).To(BeNil())
163-
Expect(len(alerts)).To(BeNumerically(">=", 1))
164-
Expect(alerts[0].PolicyName).To(Equal("malformated-array-ls-block"))
165-
Expect(alerts[0].Severity).To(Equal("4"))
166-
Expect(alerts[0].ContainerName).To(Equal("container-1"))
190+
Expect(res.Found).To(BeTrue())
167191

168192
//container-2 should run ls
169193
sout, _, err = K8sExecInPodWithContainer(multicontainer, "multicontainer", "container-2", []string{"bash", "-c", "ls"})

‎tests/k8s_env/smoke/smoke_test.go

+65-41
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ import (
77
"fmt"
88
"time"
99

10+
"github.com/kubearmor/KubeArmor/protobuf"
1011
"github.com/kubearmor/KubeArmor/tests/util"
12+
1113
. "github.com/kubearmor/KubeArmor/tests/util"
1214
. "github.com/onsi/ginkgo/v2"
1315
. "github.com/onsi/gomega"
@@ -72,11 +74,15 @@ var _ = Describe("Smoke", func() {
7274
Expect(sout).To(MatchRegexp("apt.*Permission denied"))
7375

7476
// check policy violation alert
75-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
77+
expect := protobuf.Alert{
78+
PolicyName: "ksp-wordpress-block-process",
79+
Severity: "3",
80+
}
81+
82+
// check policy violation alert
83+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
7684
Expect(err).To(BeNil())
77-
Expect(len(alerts)).To(BeNumerically(">=", 1))
78-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-block-process"))
79-
Expect(alerts[0].Severity).To(Equal("3"))
85+
Expect(res.Found).To(BeTrue())
8086
})
8187

8288
It("can block execution of access to sensitive file with abs path", func() {
@@ -98,13 +104,15 @@ var _ = Describe("Smoke", func() {
98104
Expect(sout).To(MatchRegexp("wp-config.php.*Permission denied"))
99105

100106
// check policy violation alert
101-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
107+
expect := protobuf.Alert{
108+
PolicyName: "ksp-wordpress-block-config",
109+
Severity: "10",
110+
Message: "blocked access to wordpress configuration file",
111+
}
112+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
102113
Expect(err).To(BeNil())
103-
Expect(len(alerts)).To(BeNumerically(">=", 1))
104-
fmt.Printf("%+v\n", alerts[0])
105-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-block-config"))
106-
Expect(alerts[0].Severity).To(Equal("10"))
107-
Expect(alerts[0].Message).To(Equal("blocked access to wordpress configuration file"))
114+
Expect(res.Found).To(BeTrue())
115+
108116
})
109117

110118
It("can block execution of access to sensitive file with rel path", func() {
@@ -126,13 +134,14 @@ var _ = Describe("Smoke", func() {
126134
Expect(sout).To(MatchRegexp("wp-config.php.*Permission denied"))
127135

128136
// check policy violation alert
129-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
130-
Expect(err).To(BeNil())
131-
Expect(len(alerts)).To(BeNumerically(">=", 1))
132-
fmt.Printf("%+v\n", alerts[0])
133-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-block-config"))
134-
Expect(alerts[0].Severity).To(Equal("10"))
135-
Expect(alerts[0].Message).To(Equal("blocked access to wordpress configuration file"))
137+
expect := protobuf.Alert{
138+
PolicyName: "ksp-wordpress-block-config",
139+
Severity: "10",
140+
Message: "blocked access to wordpress configuration file",
141+
}
142+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
143+
Expect(err).To(BeNil())
144+
Expect(res.Found).To(BeTrue())
136145
})
137146

138147
It("can block execution of access to service account token", func() {
@@ -154,11 +163,13 @@ var _ = Describe("Smoke", func() {
154163
Expect(sout).To(MatchRegexp("token.*Permission denied"))
155164

156165
// check policy violation alert
157-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
166+
expect := protobuf.Alert{
167+
PolicyName: "ksp-wordpress-block-sa",
168+
Severity: "7",
169+
}
170+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
158171
Expect(err).To(BeNil())
159-
Expect(len(alerts)).To(BeNumerically(">=", 1))
160-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-block-sa"))
161-
Expect(alerts[0].Severity).To(Equal("7"))
172+
Expect(res.Found).To(BeTrue())
162173
})
163174

164175
It("allow access for service account token to only cat", func() {
@@ -181,12 +192,14 @@ var _ = Describe("Smoke", func() {
181192
Expect(sout).To(MatchRegexp("token.*Permission denied"))
182193

183194
// check policy violation alert
184-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
195+
expect := protobuf.Alert{
196+
PolicyName: "ksp-wordpress-lenient-allow-sa",
197+
Severity: "7",
198+
Source: "head",
199+
}
200+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
185201
Expect(err).To(BeNil())
186-
Expect(len(alerts)).To(BeNumerically(">=", 1))
187-
fmt.Printf("---Alert---\n%s", alerts[0].String())
188-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-lenient-allow-sa"))
189-
Expect(alerts[0].Severity).To(Equal("7"))
202+
Expect(res.Found).To(BeTrue())
190203

191204
// trigger normal operations permitted by policy
192205
sout, _, err = K8sExecInPod(wp, "wordpress-mysql",
@@ -205,9 +218,14 @@ var _ = Describe("Smoke", func() {
205218
Expect(sout).To(Not(ContainSubstring("Permission denied")))
206219

207220
// check for no policy violation alert
208-
_, alerts, err = KarmorGetLogs(3*time.Second, 1)
209-
Expect(err).To(BeNil())
210-
Expect(len(alerts)).To(BeNumerically("==", 0))
221+
expect = protobuf.Alert{
222+
PolicyName: "ksp-wordpress-lenient-allow-sa",
223+
Severity: "7",
224+
Source: "cat",
225+
}
226+
res, err = KarmorGetTargetAlert(5*time.Second, &expect)
227+
Expect(err).To(BeNil())
228+
Expect(res.Found).To(BeFalse())
211229
})
212230

213231
It("can audit access to sensitive data path", func() {
@@ -229,12 +247,13 @@ var _ = Describe("Smoke", func() {
229247
fmt.Printf("OUTPUT: %s\n", sout)
230248

231249
// check policy violation alert
232-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
250+
expect := protobuf.Alert{
251+
PolicyName: "ksp-mysql-audit-dir",
252+
Severity: "5",
253+
}
254+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
233255
Expect(err).To(BeNil())
234-
Expect(len(alerts)).To(BeNumerically(">=", 1))
235-
fmt.Printf("---Alert---\n%s", alerts[0].String())
236-
Expect(alerts[0].PolicyName).To(Equal("ksp-mysql-audit-dir"))
237-
Expect(alerts[0].Severity).To(Equal("5"))
256+
Expect(res.Found).To(BeTrue())
238257

239258
_, _, err = K8sExecInPod(sql, "wordpress-mysql",
240259
[]string{"bash", "-c", fmt.Sprintf("rm %s", fname)})
@@ -283,10 +302,13 @@ var _ = Describe("Smoke", func() {
283302
Expect(sout).To(ContainSubstring("Permission denied"))
284303

285304
// check policy violation alert
286-
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
305+
expect := protobuf.Alert{
306+
PolicyName: "ksp-wordpress-block-mount-file",
307+
Severity: "5",
308+
}
309+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
287310
Expect(err).To(BeNil())
288-
Expect(alerts[0].PolicyName).To(Equal("ksp-wordpress-block-mount-file"))
289-
Expect(alerts[0].Severity).To(Equal("5"))
311+
Expect(res.Found).To(BeTrue())
290312
})
291313
It("will allow use of tcp network protocol by curl and bash", func() {
292314
err := util.AnnotateNS("wordpress-mysql", "kubearmor-network-posture", "audit")
@@ -323,11 +345,13 @@ var _ = Describe("Smoke", func() {
323345
Expect(sout).To(ContainSubstring("http://www.google.com/"))
324346

325347
// check alert
326-
_, alerts, err = KarmorGetLogs(5*time.Second, 1)
348+
expect := protobuf.Alert{
349+
PolicyName: "DefaultPosture",
350+
Result: "Passed",
351+
}
352+
res, err := KarmorGetTargetAlert(5*time.Second, &expect)
327353
Expect(err).To(BeNil())
328-
Expect(len(alerts)).To(BeNumerically(">=", 1))
329-
Expect(alerts[0].PolicyName).To(Equal("DefaultPosture"))
330-
Expect(alerts[0].Result).To(Equal("Passed"))
354+
Expect(res.Found).To(BeTrue())
331355
})
332356
})
333357
})

‎tests/util/karmorlog.go

+10
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,11 @@ func getAlertWithInfo(alert *pb.Alert, target *pb.Alert) bool {
124124
return false
125125
}
126126
}
127+
if target.Source != "" {
128+
if !strings.Contains(alert.Source, target.Source) {
129+
return false
130+
}
131+
}
127132
if target.NamespaceName != "" {
128133
if alert.NamespaceName != target.NamespaceName {
129134
return false
@@ -134,6 +139,11 @@ func getAlertWithInfo(alert *pb.Alert, target *pb.Alert) bool {
134139
return false
135140
}
136141
}
142+
if target.ContainerName != "" {
143+
if !strings.Contains(alert.ContainerName, target.ContainerName) {
144+
return false
145+
}
146+
}
137147

138148
return true
139149
}

0 commit comments

Comments
 (0)