Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug fix: adjust logic in testPodClusterRoleBindings #1792

Merged
merged 2 commits into from
Jan 10, 2024
Merged

Bug fix: adjust logic in testPodClusterRoleBindings #1792

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9260f8c
Bug fix: remove wrong logic in testPodClusterRoleBindings
jmontesi Jan 9, 2024
3fc0142
Merge branch 'main' into bug_fix_pod_cluster_role_bindings
jmontesi Jan 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 4 additions & 16 deletions cnf-certification-test/accesscontrol/suite.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -610,26 +610,12 @@ func testPodClusterRoleBindings(check *checksdb.Check, env *provider.TestEnviron

for _, put := range env.Pods {
check.LogInfo("Testing Pod %q", put)
podIsCompliant := true
result, roleRefName, err := put.IsUsingClusterRoleBinding(env.ClusterRoleBindings, check.GetLoggger())
if err != nil {
check.LogError("Failed to determine if Pod %q is using a cluster role binding, err=%v", put, err)
podIsCompliant = false
}

// Pod was found to be using a cluster role binding. This is not allowed.
// Flagging this pod as a failed pod.
if result {
podIsCompliant = false
}

if podIsCompliant {
check.LogInfo("Pod %q is not using a cluster role binding", put)
compliantObjects = append(compliantObjects, testhelper.NewPodReportObject(put.Namespace, put.Name, "Pod is not using a cluster role binding", true))
} else {
check.LogError("Pod %q is using a cluster role binding", put)
nonCompliantObjects = append(nonCompliantObjects, testhelper.NewPodReportObject(put.Namespace, put.Name, "Pod is using a cluster role binding", false).
nonCompliantObjects = append(nonCompliantObjects, testhelper.NewPodReportObject(put.Namespace, put.Name, fmt.Sprintf("failed to determine if pod is using a cluster role binding: %v", err), false).
AddField(testhelper.ClusterRoleName, roleRefName))
continue
}

topOwners, err := put.GetTopOwner()
Expand All @@ -650,10 +636,12 @@ func testPodClusterRoleBindings(check *checksdb.Check, env *provider.TestEnviron
if result {
// Pod was found to be using a cluster role binding. This is not allowed.
// Flagging this pod as a failed pod.
check.LogError("Pod %q is using a cluster role binding (roleRefName=%q)", put, roleRefName)
nonCompliantObjects = append(nonCompliantObjects, testhelper.NewPodReportObject(put.Namespace, put.Name, "Pod is using a cluster role binding", false).
AddField(testhelper.ClusterRoleName, roleRefName))
continue
}
check.LogInfo("Pod %q is not using a cluster role binding", put)
compliantObjects = append(compliantObjects, testhelper.NewPodReportObject(put.Namespace, put.Name, "Pod is not using a cluster role binding", true))
}
check.SetResult(compliantObjects, nonCompliantObjects)
Expand Down
Loading