Repository: containerd/containerd
File: integration/main_test.go (Go)

Code before:

// Add pod hostname.
func WithPodHostname(hostname string) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		p.Hostname = hostname
	}
}

// Add pod labels.
func WithPodLabels(kvs map[string]string) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		for k, v := range kvs {
			p.Labels[k] = v
		}
	}
}

// WithSecurityContext set container privileged.
func WithPodSecurityContext(privileged bool) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		if p.Linux == nil {
			p.Linux = &runtime.LinuxPodSandboxConfig{}
		}
		if p.Linux.SecurityContext == nil {
			p.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
				Privileged: privileged,
			}
		}
	}
}

// PodSandboxConfig generates a pod sandbox config for test.
func PodSandboxConfig(name, ns string, opts ...PodSandboxOpts) *runtime.PodSandboxConfig {
	var cgroupParent string
	runtimeConfig, err := runtimeService.RuntimeConfig(&runtime.RuntimeConfigRequest{})
	if err != nil {
		klog.Errorf("runtime service call RuntimeConfig error %s", err.Error())
	} else if runtimeConfig.GetLinux().GetCgroupDriver() == runtime.CgroupDriver_SYSTEMD {
		cgroupParent = defaultCgroupSystemdParent
	}
	config := &runtime.PodSandboxConfig{
		Metadata: &runtime.PodSandboxMetadata{
			Name: name,
			// Using random id as uuid is good enough for local
			// integration test.
			Uid:       util.GenerateID(),
			Namespace: Randomize(ns),
		},
		Linux: &runtime.LinuxPodSandboxConfig{
			CgroupParent: cgroupParent,
		},

Review comment (security):
nit: this means if `p.Linux.SecurityContext` is empty not nil, `privileged` will be skipped. maybe change to

```golang
if p.Linux.SecurityContext == nil {
  p.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{}
}
p.Linux.SecurityContext.Privileged = privileged
```

same for below

Code after:

// Add pod hostname.
func WithPodHostname(hostname string) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		p.Hostname = hostname
	}
}

// Add pod labels.
func WithPodLabels(kvs map[string]string) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		for k, v := range kvs {
			p.Labels[k] = v
		}
	}
}

// WithSecurityContext set container privileged.
func WithPodSecurityContext(privileged bool) PodSandboxOpts {
	return func(p *runtime.PodSandboxConfig) {
		if p.Linux == nil {
			p.Linux = &runtime.LinuxPodSandboxConfig{}
		}
		if p.Linux.SecurityContext == nil {
			p.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{}
		}
		p.Linux.SecurityContext.Privileged = privileged
	}
}

// PodSandboxConfig generates a pod sandbox config for test.
func PodSandboxConfig(name, ns string, opts ...PodSandboxOpts) *runtime.PodSandboxConfig {
	var cgroupParent string
	runtimeConfig, err := runtimeService.RuntimeConfig(&runtime.RuntimeConfigRequest{})
	if err != nil {
		klog.Errorf("runtime service call RuntimeConfig error %s", err.Error())
	} else if runtimeConfig.GetLinux().GetCgroupDriver() == runtime.CgroupDriver_SYSTEMD {
		cgroupParent = defaultCgroupSystemdParent
	}
	config := &runtime.PodSandboxConfig{
		Metadata: &runtime.PodSandboxMetadata{
			Name: name,
			// Using random id as uuid is good enough for local
			// integration test.
			Uid:       util.GenerateID(),
			Namespace: Randomize(ns),
		},
		Linux: &runtime.LinuxPodSandboxConfig{
			CgroupParent: cgroupParent,
		},
		Annotations: make(map[string]string),