tests: add test for watching files labeled kubernetes_file_t #1064
Conversation
|
This might be overkill but I was thinking we might want to expand our SELinux coverage in the future with tests like this. Maybe even moving the existing SELinux tests from kola/mantle into the |
|
Seems reasonable to me. |
There was a problem hiding this comment.
I think having a test for this here is totally fine, but personally think the cost of starting a whole VM for such a simple check is high. This is why I've been pushing for https://github.com/coreos/fedora-coreos-config/tree/testing-devel/tests/kola/misc-ign-ro -- WDYT about folding that in there?
Yup, I was concerned about the cost of a VM for a simple check. I can fold this into that location. |
This triggered a memory of mine and I found the old discussion and started a new feature request to bring the best of both worlds together: https://github.com/coreos/fedora-coreos-config/issues/1067 |
miabbott
changed the title
|
Moved the original test for reading |
|
Looks sane to me but the test is failing. |
Yeah, these will both fail until we have a new |
|
The @dustymabe if you want, I can split that test out into another PR if you would like to get the "watch" part of the test merged in. |
|
ahh - sorry for the noise. don't worry about splitting it out (unless you want to 🙂) |
split out the |
miabbott
changed the title
| fi | ||
| ok "successfully created /etc/kubernetes/kubeconfig" | ||
|
|
||
| if [ "$(systemctl is-active kube-watch.service)" != "active" ]; then |
There was a problem hiding this comment.
what's the point of running systemctl is-active kube-watch.service twice?
There was a problem hiding this comment.
The first systemctl is-active is checking kube-watch.path
Adds a test for the ability of `systemd` to watch files labeled with `kubernetes_file_t`. See: coreos/fedora-coreos-tracker#861 See: containers/container-selinux#135 Co-authored-by: Dusty Mabe <dusty@dustymabe.com>
Adds a test for the ability of
systemdto watch fileslabeled with
kubernetes_file_t.See: coreos/fedora-coreos-tracker#861
See: containers/container-selinux#135