Skip to content

Commit 2835f8d

Browse files
author
Oleg Bulatov
committed
Make image API admission extended tests dockerless
1 parent a7f822d commit 2835f8d

File tree

4 files changed

+147
-157
lines changed

4 files changed

+147
-157
lines changed

‎test/extended/imageapis/limitrange_admission.go

+22-54
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,19 @@ import (
1616
quotautil "github.com/openshift/origin/pkg/quota/util"
1717
imagesutil "github.com/openshift/origin/test/extended/images"
1818
exutil "github.com/openshift/origin/test/extended/util"
19-
testutil "github.com/openshift/origin/test/util"
2019
)
2120

22-
const limitRangeName = "limits"
21+
const (
22+
limitRangeName = "limits"
23+
imageSize = 100
24+
)
2325

24-
var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/registry/serial][local] Image limit range", func() {
26+
var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/registry/serial] Image limit range", func() {
2527
defer g.GinkgoRecover()
28+
2629
var oc = exutil.NewCLI("limitrange-admission", exutil.KubeConfigPath())
2730

28-
g.JustBeforeEach(func() {
31+
g.BeforeEach(func() {
2932
g.By("waiting for default service account")
3033
err := exutil.WaitForServiceAccount(oc.KubeClient().Core().ServiceAccounts(oc.Namespace()), "default")
3134
o.Expect(err).NotTo(o.HaveOccurred())
@@ -34,102 +37,77 @@ var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/regis
3437
o.Expect(err).NotTo(o.HaveOccurred())
3538
})
3639

37-
// needs to be run at the of of each It; cannot be run in AfterEach which is run after the project
38-
// is destroyed
39-
tearDown := func(oc *exutil.CLI) {
40-
g.By(fmt.Sprintf("Deleting limit range %s", limitRangeName))
41-
oc.AdminKubeClient().Core().LimitRanges(oc.Namespace()).Delete(limitRangeName, nil)
42-
43-
deleteTestImagesAndStreams(oc)
44-
}
45-
46-
g.It(fmt.Sprintf("[Skipped] should deny a push of built image exceeding %s limit", imageapi.LimitTypeImage), func() {
47-
g.Skip("FIXME: fill image metadata for schema1 in the registry")
48-
49-
defer tearDown(oc)
50-
51-
dClient, err := testutil.NewDockerClient()
52-
o.Expect(err).NotTo(o.HaveOccurred())
53-
54-
_, err = createLimitRangeOfType(oc, imageapi.LimitTypeImage, kapi.ResourceList{
40+
g.It(fmt.Sprintf("should deny a push of built image exceeding %s limit", imageapi.LimitTypeImage), func() {
41+
_, err := createLimitRangeOfType(oc, imageapi.LimitTypeImage, kapi.ResourceList{
5542
kapi.ResourceStorage: resource.MustParse("10Ki"),
5643
})
5744
o.Expect(err).NotTo(o.HaveOccurred())
5845

5946
g.By(fmt.Sprintf("trying to push an image exceeding size limit with just 1 layer"))
60-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "middle", 16000, 1, false)
47+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "middle", 16000, 1, false)
6148
o.Expect(err).NotTo(o.HaveOccurred())
6249

6350
g.By(fmt.Sprintf("trying to push an image exceeding size limit in total"))
64-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "middle", 16000, 5, false)
51+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "middle", 16000, 5, false)
6552
o.Expect(err).NotTo(o.HaveOccurred())
6653

6754
g.By(fmt.Sprintf("trying to push an image with one big layer below size limit"))
68-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "small", 8000, 1, true)
55+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "small", 8000, 1, true)
6956
o.Expect(err).NotTo(o.HaveOccurred())
7057

7158
g.By(fmt.Sprintf("trying to push an image below size limit"))
72-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "small", 8000, 2, true)
59+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "small", 8000, 2, true)
7360
o.Expect(err).NotTo(o.HaveOccurred())
7461
})
7562

7663
g.It(fmt.Sprintf("should deny a push of built image exceeding limit on %s resource", imageapi.ResourceImageStreamImages), func() {
77-
78-
defer tearDown(oc)
79-
8064
limits := kapi.ResourceList{
8165
imageapi.ResourceImageStreamTags: resource.MustParse("0"),
8266
imageapi.ResourceImageStreamImages: resource.MustParse("0"),
8367
}
8468
_, err := createLimitRangeOfType(oc, imageapi.LimitTypeImageStream, limits)
8569
o.Expect(err).NotTo(o.HaveOccurred())
8670

87-
dClient, err := testutil.NewDockerClient()
88-
o.Expect(err).NotTo(o.HaveOccurred())
89-
9071
g.By(fmt.Sprintf("trying to push image exceeding limits %v", limits))
91-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "refused", imageSize, 1, false)
72+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "refused", imageSize, 1, false)
9273
o.Expect(err).NotTo(o.HaveOccurred())
9374

9475
limits, err = bumpLimit(oc, imageapi.ResourceImageStreamImages, "1")
9576
o.Expect(err).NotTo(o.HaveOccurred())
9677

9778
g.By(fmt.Sprintf("trying to push image below limits %v", limits))
98-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "first", imageSize, 2, true)
79+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "first", imageSize, 2, true)
9980
o.Expect(err).NotTo(o.HaveOccurred())
10081

10182
g.By(fmt.Sprintf("trying to push image exceeding limits %v", limits))
102-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "sized", "second", imageSize, 2, false)
83+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "sized", "second", imageSize, 2, false)
10384
o.Expect(err).NotTo(o.HaveOccurred())
10485

10586
g.By(fmt.Sprintf("trying to push image below limits %v to another image stream", limits))
106-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "another", "second", imageSize, 1, true)
87+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "another", "second", imageSize, 1, true)
10788
o.Expect(err).NotTo(o.HaveOccurred())
10889

10990
limits, err = bumpLimit(oc, imageapi.ResourceImageStreamImages, "2")
11091
o.Expect(err).NotTo(o.HaveOccurred())
11192

11293
g.By(fmt.Sprintf("trying to push image below limits %v", limits))
113-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "another", "third", imageSize, 1, true)
94+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "another", "third", imageSize, 1, true)
11495
o.Expect(err).NotTo(o.HaveOccurred())
11596

11697
g.By(fmt.Sprintf("trying to push image exceeding limits %v", limits))
117-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "another", "fourth", imageSize, 1, false)
98+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "another", "fourth", imageSize, 1, false)
11899
o.Expect(err).NotTo(o.HaveOccurred())
119100

120101
g.By(`removing tag "second" from "another" image stream`)
121102
err = oc.ImageClient().Image().ImageStreamTags(oc.Namespace()).Delete("another:second", nil)
122103
o.Expect(err).NotTo(o.HaveOccurred())
123104

124105
g.By(fmt.Sprintf("trying to push image below limits %v", limits))
125-
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, dClient, oc.Namespace(), "another", "replenish", imageSize, 1, true)
106+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), "another", "replenish", imageSize, 1, true)
126107
o.Expect(err).NotTo(o.HaveOccurred())
127108
})
128109

129110
g.It(fmt.Sprintf("should deny a docker image reference exceeding limit on %s resource", imageapi.ResourceImageStreamTags), func() {
130-
131-
defer tearDown(oc)
132-
133111
tag2Image, err := buildAndPushTestImagesTo(oc, "src", "tag", 2)
134112
o.Expect(err).NotTo(o.HaveOccurred())
135113

@@ -187,15 +165,12 @@ var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/regis
187165
})
188166

189167
g.It(fmt.Sprintf("should deny an import of a repository exceeding limit on %s resource", imageapi.ResourceImageStreamTags), func() {
190-
191168
maxBulkImport, err := getMaxImagesBulkImportedPerRepository()
192169
if err != nil {
193170
g.Skip(err.Error())
194171
return
195172
}
196173

197-
defer tearDown(oc)
198-
199174
s1tag2Image, err := buildAndPushTestImagesTo(oc, "src1st", "tag", maxBulkImport+1)
200175
s2tag2Image, err := buildAndPushTestImagesTo(oc, "src2nd", "t", 2)
201176
o.Expect(err).NotTo(o.HaveOccurred())
@@ -234,25 +209,18 @@ var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/regis
234209
// buildAndPushTestImagesTo builds a given number of test images. The images are pushed to a new image stream
235210
// of given name under <tagPrefix><X> where X is a number of image starting from 1.
236211
func buildAndPushTestImagesTo(oc *exutil.CLI, isName string, tagPrefix string, numberOfImages int) (tag2Image map[string]imageapi.Image, err error) {
237-
dClient, err := testutil.NewDockerClient()
238-
if err != nil {
239-
return
240-
}
241212
tag2Image = make(map[string]imageapi.Image)
242213

243214
for i := 1; i <= numberOfImages; i++ {
244215
tag := fmt.Sprintf("%s%d", tagPrefix, i)
245-
dgst, _, err := imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, isName, tag, imageSize, 2, g.GinkgoWriter, true, true)
216+
err = imagesutil.BuildAndPushImageOfSizeWithBuilder(oc, nil, oc.Namespace(), isName, tag, imageSize, 2, true)
246217
if err != nil {
247218
return nil, err
248219
}
249220
ist, err := oc.ImageClient().Image().ImageStreamTags(oc.Namespace()).Get(isName+":"+tag, metav1.GetOptions{})
250221
if err != nil {
251222
return nil, err
252223
}
253-
if dgst != ist.Image.Name {
254-
return nil, fmt.Errorf("digest of built image does not match stored: %s != %s", dgst, ist.Image.Name)
255-
}
256224
tag2Image[tag] = ist.Image
257225
}
258226

@@ -316,7 +284,7 @@ func bumpLimit(oc *exutil.CLI, resourceName kapi.ResourceName, limit string) (ka
316284
func getMaxImagesBulkImportedPerRepository() (int, error) {
317285
max := os.Getenv("MAX_IMAGES_BULK_IMPORTED_PER_REPOSITORY")
318286
if len(max) == 0 {
319-
return 0, fmt.Errorf("MAX_IMAGES_BULK_IMAGES_IMPORTED_PER_REPOSITORY is not set")
287+
return 0, fmt.Errorf("MAX_IMAGES_BULK_IMPORTED_PER_REPOSITORY is not set")
320288
}
321289
return strconv.Atoi(max)
322290
}

‎test/extended/imageapis/quota_admission.go

+52-69
Original file line numberDiff line numberDiff line change
@@ -4,33 +4,32 @@ import (
44
"fmt"
55
"time"
66

7+
kerrors "k8s.io/apimachinery/pkg/api/errors"
78
"k8s.io/apimachinery/pkg/api/resource"
89
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
910
kutilerrors "k8s.io/apimachinery/pkg/util/errors"
1011
kapi "k8s.io/kubernetes/pkg/apis/core"
12+
e2e "k8s.io/kubernetes/test/e2e/framework"
1113

1214
g "github.com/onsi/ginkgo"
1315
o "github.com/onsi/gomega"
1416

17+
imageapiv1 "github.com/openshift/api/image/v1"
1518
imageapi "github.com/openshift/origin/pkg/image/apis/image"
16-
imagesutil "github.com/openshift/origin/test/extended/images"
1719
exutil "github.com/openshift/origin/test/extended/util"
1820
testutil "github.com/openshift/origin/test/util"
1921
)
2022

2123
const (
22-
imageSize = 100
23-
24-
quotaName = "isquota"
25-
24+
quotaName = "isquota"
2625
waitTimeout = time.Second * 600
2726
)
2827

29-
var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/registry/serial][local] Image resource quota", func() {
28+
var _ = g.Describe("[Feature:ImageQuota][registry] Image resource quota", func() {
3029
defer g.GinkgoRecover()
3130
var oc = exutil.NewCLI("resourcequota-admission", exutil.KubeConfigPath())
3231

33-
g.JustBeforeEach(func() {
32+
g.BeforeEach(func() {
3433
g.By("waiting for default service account")
3534
err := exutil.WaitForServiceAccount(oc.KubeClient().Core().ServiceAccounts(oc.Namespace()), "default")
3635
o.Expect(err).NotTo(o.HaveOccurred())
@@ -39,65 +38,53 @@ var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/regis
3938
o.Expect(err).NotTo(o.HaveOccurred())
4039
})
4140

42-
// needs to be run at the of of each It; cannot be run in AfterEach which is run after the project
43-
// is destroyed
44-
tearDown := func(oc *exutil.CLI) {
45-
g.By(fmt.Sprintf("Deleting quota %s", quotaName))
46-
oc.AdminKubeClient().Core().ResourceQuotas(oc.Namespace()).Delete(quotaName, nil)
47-
48-
deleteTestImagesAndStreams(oc)
49-
}
50-
5141
g.It(fmt.Sprintf("should deny a push of built image exceeding %s quota", imageapi.ResourceImageStreams), func() {
52-
53-
defer tearDown(oc)
54-
dClient, err := testutil.NewDockerClient()
55-
o.Expect(err).NotTo(o.HaveOccurred())
56-
57-
outSink := g.GinkgoWriter
58-
5942
quota := kapi.ResourceList{
6043
imageapi.ResourceImageStreams: resource.MustParse("0"),
6144
}
62-
_, err = createResourceQuota(oc, quota)
45+
_, err := createResourceQuota(oc, quota)
46+
o.Expect(err).NotTo(o.HaveOccurred())
47+
used, err := waitForResourceQuotaSync(oc, quotaName, quota)
6348
o.Expect(err).NotTo(o.HaveOccurred())
49+
o.Expect(assertQuotasEqual(used, quota)).NotTo(o.HaveOccurred())
6450

6551
g.By(fmt.Sprintf("trying to push image exceeding quota %v", quota))
66-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "first", "refused", imageSize, 1, outSink, false, true)
67-
o.Expect(err).NotTo(o.HaveOccurred())
52+
err = createImageStreamMapping(oc, oc.Namespace(), "first", "refused")
53+
assertQuotaExceeded(err)
6854

6955
quota, err = bumpQuota(oc, imageapi.ResourceImageStreams, 1)
7056
o.Expect(err).NotTo(o.HaveOccurred())
7157

7258
g.By(fmt.Sprintf("trying to push image below quota %v", quota))
73-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "first", "tag1", imageSize, 1, outSink, true, true)
59+
err = createImageStreamMapping(oc, oc.Namespace(), "first", "tag1")
7460
o.Expect(err).NotTo(o.HaveOccurred())
75-
used, err := waitForResourceQuotaSync(oc, quotaName, quota)
61+
used, err = waitForResourceQuotaSync(oc, quotaName, quota)
7662
o.Expect(err).NotTo(o.HaveOccurred())
7763
o.Expect(assertQuotasEqual(used, quota)).NotTo(o.HaveOccurred())
7864

7965
g.By(fmt.Sprintf("trying to push image to existing image stream %v", quota))
80-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "first", "tag2", imageSize, 1, outSink, true, true)
66+
err = createImageStreamMapping(oc, oc.Namespace(), "first", "tag2")
8167
o.Expect(err).NotTo(o.HaveOccurred())
8268

8369
g.By(fmt.Sprintf("trying to push image exceeding quota %v", quota))
84-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "second", "refused", imageSize, 1, outSink, false, true)
70+
err = createImageStreamMapping(oc, oc.Namespace(), "second", "refused")
71+
assertQuotaExceeded(err)
8572

8673
quota, err = bumpQuota(oc, imageapi.ResourceImageStreams, 2)
8774
o.Expect(err).NotTo(o.HaveOccurred())
8875
used, err = waitForResourceQuotaSync(oc, quotaName, used)
8976
o.Expect(err).NotTo(o.HaveOccurred())
9077

9178
g.By(fmt.Sprintf("trying to push image below quota %v", quota))
92-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "second", "tag1", imageSize, 1, outSink, true, true)
79+
err = createImageStreamMapping(oc, oc.Namespace(), "second", "tag1")
9380
o.Expect(err).NotTo(o.HaveOccurred())
9481
used, err = waitForResourceQuotaSync(oc, quotaName, quota)
9582
o.Expect(err).NotTo(o.HaveOccurred())
9683
o.Expect(assertQuotasEqual(used, quota)).NotTo(o.HaveOccurred())
9784

9885
g.By(fmt.Sprintf("trying to push image exceeding quota %v", quota))
99-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "third", "refused", imageSize, 1, outSink, false, true)
100-
o.Expect(err).NotTo(o.HaveOccurred())
86+
err = createImageStreamMapping(oc, oc.Namespace(), "third", "refused")
87+
assertQuotaExceeded(err)
10188

10289
g.By("deleting first image stream")
10390
err = oc.ImageClient().Image().ImageStreams(oc.Namespace()).Delete("first", nil)
@@ -113,7 +100,7 @@ var _ = g.Describe("[Feature:ImageQuota][registry][Serial][Suite:openshift/regis
113100
o.Expect(assertQuotasEqual(used, kapi.ResourceList{imageapi.ResourceImageStreams: resource.MustParse("1")})).NotTo(o.HaveOccurred())
114101

115102
g.By(fmt.Sprintf("trying to push image below quota %v", quota))
116-
_, _, err = imagesutil.BuildAndPushImageOfSizeWithDocker(oc, dClient, "third", "tag", imageSize, 1, outSink, true, true)
103+
err = createImageStreamMapping(oc, oc.Namespace(), "third", "tag")
117104
o.Expect(err).NotTo(o.HaveOccurred())
118105
used, err = waitForResourceQuotaSync(oc, quotaName, quota)
119106
o.Expect(err).NotTo(o.HaveOccurred())
@@ -213,42 +200,38 @@ func waitForLimitSync(oc *exutil.CLI, hardLimit kapi.ResourceList) error {
213200
waitTimeout)
214201
}
215202

216-
// deleteTestImagesAndStreams deletes test images built in current and shared
217-
// namespaces. It also deletes shared projects.
218-
func deleteTestImagesAndStreams(oc *exutil.CLI) {
219-
for _, projectName := range []string{
220-
oc.Namespace() + "-s2",
221-
oc.Namespace() + "-s1",
222-
oc.Namespace() + "-shared",
223-
oc.Namespace(),
224-
} {
225-
g.By(fmt.Sprintf("Deleting images and image streams in project %q", projectName))
226-
iss, err := oc.AdminInternalImageClient().Image().ImageStreams(projectName).List(metav1.ListOptions{})
203+
func createImageStreamMapping(oc *exutil.CLI, namespace, name, tag string) error {
204+
e2e.Logf("Creating image stream mapping for %s/%s:%s...", namespace, name, tag)
205+
_, err := oc.AdminImageClient().Image().ImageStreams(namespace).Get(name, metav1.GetOptions{})
206+
if kerrors.IsNotFound(err) {
207+
_, err = oc.AdminImageClient().Image().ImageStreams(namespace).Create(&imageapiv1.ImageStream{
208+
ObjectMeta: metav1.ObjectMeta{
209+
Name: name,
210+
Namespace: namespace,
211+
},
212+
})
227213
if err != nil {
228-
continue
229-
}
230-
for _, is := range iss.Items {
231-
for _, history := range is.Status.Tags {
232-
for i := range history.Items {
233-
oc.AdminInternalImageClient().Image().Images().Delete(history.Items[i].Image, nil)
234-
}
235-
}
236-
for _, tagRef := range is.Spec.Tags {
237-
switch tagRef.From.Kind {
238-
case "ImageStreamImage":
239-
_, id, err := imageapi.ParseImageStreamImageName(tagRef.From.Name)
240-
if err != nil {
241-
continue
242-
}
243-
oc.AdminInternalImageClient().Image().Images().Delete(id, nil)
244-
}
245-
}
246-
}
247-
248-
// let the extended framework take care of the current namespace
249-
if projectName != oc.Namespace() {
250-
g.By(fmt.Sprintf("Deleting project %q", projectName))
251-
oc.AdminProjectClient().Project().Projects().Delete(projectName, nil)
214+
return err
252215
}
216+
} else if err != nil {
217+
return err
253218
}
219+
_, err = oc.AdminImageClient().Image().ImageStreamMappings(namespace).Create(&imageapiv1.ImageStreamMapping{
220+
ObjectMeta: metav1.ObjectMeta{
221+
Name: name,
222+
Namespace: namespace,
223+
},
224+
Image: imageapiv1.Image{
225+
ObjectMeta: metav1.ObjectMeta{
226+
Name: "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
227+
},
228+
},
229+
Tag: tag,
230+
})
231+
return err
232+
}
233+
234+
func assertQuotaExceeded(err error) {
235+
o.Expect(kerrors.ReasonForError(err)).To(o.Equal(metav1.StatusReasonForbidden))
236+
o.Expect(err.Error()).To(o.ContainSubstring("exceeded quota"))
254237
}

0 commit comments

Comments
 (0)