Change:
} } <del> func TestGetSecurityOpts(t *testing.T) { const containerName = "bar" pod := func(annotations map[string]string) *v1.Pod { p := makePod("foo", &v1.PodSpec{ Containers: []v1.Container{ {Name: containerName}, }, }) p.Annotations = annotations return p } tests := []struct { msg          string pod          *v1.Pod expectedOpts []string }{{ msg:          "No security annotations", pod:          pod(nil), expectedOpts: []string{"seccomp=unconfined"}, }, { msg: "Seccomp default", pod: pod(map[string]string{ v1.SeccompContainerAnnotationKeyPrefix + containerName: "docker/default", }), expectedOpts: nil, }, { msg: "AppArmor runtime/default", pod: pod(map[string]string{ apparmor.ContainerAnnotationKeyPrefix + containerName: apparmor.ProfileRuntimeDefault, }), expectedOpts: []string{"seccomp=unconfined"}, }, { msg: "AppArmor local profile", pod: pod(map[string]string{ apparmor.ContainerAnnotationKeyPrefix + containerName: apparmor.ProfileNamePrefix + "foo", }), expectedOpts: []string{"seccomp=unconfined", "apparmor=foo"}, }, { msg: "AppArmor and seccomp profile", pod: pod(map[string]string{ v1.SeccompContainerAnnotationKeyPrefix + containerName: "docker/default", apparmor.ContainerAnnotationKeyPrefix + containerName:  apparmor.ProfileNamePrefix + "foo", }), expectedOpts: []string{"apparmor=foo"}, }} dm, _ := newTestDockerManagerWithVersion("1.11.1", "1.23") for i, test := range tests { securityOpts, err := dm.getSecurityOpts(test.pod, containerName) assert.NoError(t, err, "TestCase[%d]: %s", i, test.msg) opts, err := dm.fmtDockerOpts(securityOpts) assert.NoError(t, err, "TestCase[%d]: %s", i, test.msg) assert.Len(t, opts, len(test.expectedOpts), "TestCase[%d]: %s", i, test.msg) for _, opt := range test.expectedOpts { assert.Contains(t, opts, opt, "TestCase[%d]: %s", i, test.msg) } } } func TestSeccompIsUnconfinedByDefaultWithDockerV110(t *testing.T) { dm, fakeDocker := newTestDockerManagerWithVersion("1.10.1", "1.22") // We want to capture events. recorder := record.NewFakeRecorder(20) dm.recorder = recorder pod := makePod("foo", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar"}, }, }) runSyncPod(t, dm, fakeDocker, pod, nil, false) verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar.[a-f0-9]+_foo_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.Contains(t, newContainer.HostConfig.SecurityOpt, "seccomp:unconfined", "Pods with Docker versions >= 1.10 must not have seccomp disabled by default") cid := utilstrings.ShortenString(fakeDocker.Created[1], 12) assert.NoError(t, expectEvent(recorder, v1.EventTypeNormal, events.CreatedContainer, fmt.Sprintf("Created container with docker id %s; Security:[seccomp=unconfined]", cid))) } func TestUnconfinedSeccompProfileWithDockerV110(t *testing.T) { dm, fakeDocker := newTestDockerManagerWithVersion("1.10.1", "1.22") pod := makePod("foo4", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar4"}, }, }) pod.Annotations = map[string]string{ v1.SeccompPodAnnotationKey: "unconfined", } runSyncPod(t, dm, fakeDocker, pod, nil, false) verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo4_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar4.[a-f0-9]+_foo4_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.Contains(t, newContainer.HostConfig.SecurityOpt, "seccomp:unconfined", "Pods created with a secccomp annotation of unconfined should have seccomp:unconfined.") } func TestDefaultSeccompProfileWithDockerV110(t *testing.T) { dm, fakeDocker := newTestDockerManagerWithVersion("1.10.1", "1.22") pod := makePod("foo1", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar1"}, }, }) pod.Annotations = map[string]string{ v1.SeccompPodAnnotationKey: "docker/default", } runSyncPod(t, dm, fakeDocker, pod, nil, false) verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo1_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar1.[a-f0-9]+_foo1_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.NotContains(t, newContainer.HostConfig.SecurityOpt, "seccomp:unconfined", "Pods created with a secccomp annotation of docker/default should have empty security opt.") } func TestSeccompContainerAnnotationTrumpsPod(t *testing.T) { dm, fakeDocker := newTestDockerManagerWithVersion("1.10.1", "1.22") pod := makePod("foo2", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar2"}, }, }) pod.Annotations = map[string]string{ v1.SeccompPodAnnotationKey:                      "unconfined", v1.SeccompContainerAnnotationKeyPrefix + "bar2": "docker/default", } runSyncPod(t, dm, fakeDocker, pod, nil, false) verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo2_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar2.[a-f0-9]+_foo2_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.NotContains(t, newContainer.HostConfig.SecurityOpt, "seccomp:unconfined", "Container annotation should trump the pod annotation for seccomp.") } func TestSeccompLocalhostProfileIsLoaded(t *testing.T) { tests := []struct { annotations    map[string]string expectedSecOpt string expectedSecMsg string expectedError  string }{ { annotations: map[string]string{ v1.SeccompPodAnnotationKey: "localhost/test", }, expectedSecOpt: `seccomp={"foo":"bar"}`, expectedSecMsg: "seccomp=test(md5:21aeae45053385adebd25311f9dd9cb1)", }, { annotations: map[string]string{ v1.SeccompPodAnnotationKey: "localhost/sub/subtest", }, expectedSecOpt: `seccomp={"abc":"def"}`, expectedSecMsg: "seccomp=sub/subtest(md5:07c9bcb4db631f7ca191d6e0bca49f76)", }, { annotations: map[string]string{ v1.SeccompPodAnnotationKey: "localhost/not-existing", }, expectedError: "cannot load seccomp profile", }, } for i, test := range tests { dm, fakeDocker := newTestDockerManagerWithVersion("1.11.0", "1.23") // We want to capture events. recorder := record.NewFakeRecorder(20) dm.recorder = recorder dm.seccompProfileRoot = path.Join("fixtures", "seccomp") pod := makePod("foo2", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar2"}, }, }) pod.Annotations = test.annotations result := runSyncPod(t, dm, fakeDocker, pod, nil, test.expectedError != "") if test.expectedError != "" { assert.Contains(t, result.Error().Error(), test.expectedError) continue } verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo2_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar2.[a-f0-9]+_foo2_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.Contains(t, newContainer.HostConfig.SecurityOpt, test.expectedSecOpt, "The compacted seccomp json profile should be loaded.") cid := utilstrings.ShortenString(fakeDocker.Created[1], 12) assert.NoError(t, expectEvent(recorder, v1.EventTypeNormal, events.CreatedContainer, fmt.Sprintf("Created container with docker id %s; Security:[%s]", cid, test.expectedSecMsg)), "testcase %d", i) } } func TestSecurityOptsAreNilWithDockerV19(t *testing.T) { dm, fakeDocker := newTestDockerManagerWithVersion("1.9.1", "1.21") pod := makePod("foo", &v1.PodSpec{ Containers: []v1.Container{ {Name: "bar"}, }, }) runSyncPod(t, dm, fakeDocker, pod, nil, false) verifyCalls(t, fakeDocker, []string{ // Create pod infra container. "create", "start", "inspect_container", "inspect_container", // Create container. "create", "start", "inspect_container", }) fakeDocker.Lock() if len(fakeDocker.Created) != 2 || !matchString(t, "/k8s_POD.[a-f0-9]+_foo_new_", fakeDocker.Created[0]) || !matchString(t, "/k8s_bar.[a-f0-9]+_foo_new_", fakeDocker.Created[1]) { t.Errorf("unexpected containers created %v", fakeDocker.Created) } fakeDocker.Unlock() newContainer, err := fakeDocker.InspectContainer(fakeDocker.Created[1]) if err != nil { t.Fatalf("unexpected error %v", err) } assert.NotContains(t, newContainer.HostConfig.SecurityOpt, "seccomp:unconfined", "Pods with Docker versions < 1.10 must not have seccomp disabled by default") } </del> func TestCheckVersionCompatibility(t *testing.T) { type test struct { version    string

Discussion:
go test -v This is because there are a few test cases in dockertools are linux-specific.