Repository: kubernetes/kubernetes
File: pkg/volume/util/selinux_test.go (Go)

Code before:
		{
			name:                  "multiple different labels, Recursive policy",
			featureGates:          nil,
			pluginSupportsSELinux: true,
			volume:                &volume.Spec{PersistentVolume: pvRWOP},
			podSecurityContext:    &v1.PodSecurityContext{SELinuxChangePolicy: ptr.To(v1.SELinuxChangePolicyRecursive)},
			seLinuxOptions:        []*v1.SELinuxOptions{&seLinuxOpts1, &seLinuxOpts2, &seLinuxOpts3},
			expectError:           true,
			expectedInfo: SELinuxLabelInfo{
				SELinuxMountLabel:                 "",
				SELinuxProcessLabel:               "",
				PluginSupportsSELinuxContextMount: true,
			},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			// Arrange
			// Set feature gates for the test. *Disable* those that are not in tt.featureGates.
			allGates := []featuregate.Feature{features.SELinuxChangePolicy, features.SELinuxMount}
			enabledGates := sets.New(tt.featureGates...)
			for _, fg := range allGates {
				enable := enabledGates.Has(fg)
				if !enable {
					featuregatetesting.SetFeatureGateEmulationVersionDuringTest(t, utilfeature.DefaultFeatureGate, version.MustParse("1.35"))
				}
				featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, fg, enable)
			}
			seLinuxTranslator := NewFakeSELinuxLabelTranslator()
			pluginMgr, plugin := volumetesting.GetTestKubeletVolumePluginMgr(t)
			plugin.SupportsSELinux = tt.pluginSupportsSELinux

			// Act
			info, err := GetMountSELinuxLabel(tt.volume, tt.seLinuxOptions, tt.podSecurityContext, pluginMgr, seLinuxTranslator)

			// Assert
			if err != nil {
				if !tt.expectError {
					t.Errorf("GetMountSELinuxLabel() unexpected error: %v", err)
				}
				return
			}
			if tt.expectError {
				t.Errorf("GetMountSELinuxLabel() expected error, got none")
				return
			}

			if info != tt.expectedInfo {
				t.Errorf("GetMountSELinuxLabel() expected %+v, got %+v", tt.expectedInfo, info)
			}

Review comment (suggestion):
You need to do it only for SELinuxMountRWOP or SELinuxChangePolicy.

It would make sense to un-lock the feature gates globally before `for ... range tests` and they you don't need to un-lock them separately here.

Code after:
		{
			name:                  "multiple different labels, Recursive policy",
			featureGates:          nil,
			pluginSupportsSELinux: true,
			volume:                &volume.Spec{PersistentVolume: pvRWOP},
			podSecurityContext:    &v1.PodSecurityContext{SELinuxChangePolicy: ptr.To(v1.SELinuxChangePolicyRecursive)},
			seLinuxOptions:        []*v1.SELinuxOptions{&seLinuxOpts1, &seLinuxOpts2, &seLinuxOpts3},
			expectError:           true,
			expectedInfo: SELinuxLabelInfo{
				SELinuxMountLabel:                 "",
				SELinuxProcessLabel:               "",
				PluginSupportsSELinuxContextMount: true,
			},
		},
	}

	// Unlock GA feature gates (SELinuxChangePolicy, SELinuxMount) so they can be disabled in tests
	featuregatetesting.SetFeatureGateEmulationVersionDuringTest(t, utilfeature.DefaultFeatureGate, version.MustParse("1.35"))

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			// Arrange
			// Set feature gates for the test.
			allGates := []featuregate.Feature{features.SELinuxChangePolicy, features.SELinuxMount}
			enabledGates := sets.New(tt.featureGates...)
			for _, fg := range allGates {
				enable := enabledGates.Has(fg)
				featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, fg, enable)
			}
			seLinuxTranslator := NewFakeSELinuxLabelTranslator()
			pluginMgr, plugin := volumetesting.GetTestKubeletVolumePluginMgr(t)
			plugin.SupportsSELinux = tt.pluginSupportsSELinux

			// Act
			info, err := GetMountSELinuxLabel(tt.volume, tt.seLinuxOptions, tt.podSecurityContext, pluginMgr, seLinuxTranslator)

			// Assert
			if err != nil {
				if !tt.expectError {
					t.Errorf("GetMountSELinuxLabel() unexpected error: %v", err)
				}
				return
			}
			if tt.expectError {
				t.Errorf("GetMountSELinuxLabel() expected error, got none")
				return
			}

			if info != tt.expectedInfo {
				t.Errorf("GetMountSELinuxLabel() expected %+v, got %+v", tt.expectedInfo, info)
			}