Skip to content

Commit 403c5e9

Browse files
danmihai1danmihai1
committed
genpolicy: fix the sample/test scripts
Fix the scripts after rebase merge. Signed-off-by: Dan Mihai <dmihai@microsoft.com>
1 parent c378a2d commit 403c5e9

File tree

4 files changed

+177
-2
lines changed

4 files changed

+177
-2
lines changed

‎src/tools/genpolicy/genpolicy-settings.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,6 @@
341341
"cluster_config": {
342342
"pause_container_image": "mcr.microsoft.com/oss/kubernetes/pause:3.6"
343343
},
344-
"cluster_config": {},
345344
"request_defaults": {
346345
"CreateContainerRequest": {
347346
"allow_env_regex": [

‎src/tools/genpolicy/policy_samples.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"default": [
3+
"configmap/pod-cm1.yaml",
4+
"configmap/pod-cm2.yaml",
5+
"configmap/pod-cm3.yaml",
6+
"cron-job/test-cron-job.yaml",
7+
"deployment/deployment-back.yaml",
8+
"deployment/deployment-front.yaml",
9+
"deployment/deployment-busybox.yaml",
10+
"job/test-job.yaml",
11+
"job/test-job2.yaml",
12+
"kubernetes/conformance/conformance-e2e.yaml",
13+
"kubernetes/conformance/csi-hostpath-plugin.yaml",
14+
"kubernetes/conformance/csi-hostpath-testing.yaml",
15+
"kubernetes/conformance/etcd-statefulset.yaml",
16+
"kubernetes/conformance/hello-populator-deploy.yaml",
17+
"kubernetes/conformance/netexecrc.yaml",
18+
"kubernetes/conformance2/ingress-http-rc.yaml",
19+
"kubernetes/conformance2/ingress-http2-rc.yaml",
20+
"kubernetes/conformance2/ingress-multiple-certs-rc.yaml",
21+
"kubernetes/conformance2/ingress-nginx-rc.yaml",
22+
"kubernetes/conformance2/ingress-static-ip-rc.yaml",
23+
"kubernetes/fixtures/appsv1deployment.yaml",
24+
"kubernetes/fixtures/daemon.yaml",
25+
"kubernetes/fixtures/deploy-clientside.yaml",
26+
"kubernetes/fixtures/job.yaml",
27+
"kubernetes/fixtures/multi-resource-yaml.yaml",
28+
"kubernetes/fixtures/rc-lastapplied.yaml",
29+
"kubernetes/fixtures/rc-noexist.yaml",
30+
"kubernetes/fixtures/replication.yaml",
31+
"kubernetes/fixtures2/rc-service.yaml",
32+
"kubernetes/fixtures2/valid-pod.yaml",
33+
"pod/pod-exec.yaml",
34+
"pod/pod-lifecycle.yaml",
35+
"pod/pod-one-container.yaml",
36+
"pod/pod-persistent-volumes.yaml",
37+
"pod/pod-same-containers.yaml",
38+
"pod/pod-spark.yaml",
39+
"pod/pod-three-containers.yaml",
40+
"pod/pod-ubuntu.yaml",
41+
"replica-set/replica-busy.yaml",
42+
"replica-set/replica2.yaml",
43+
"secrets/azure-file-secrets.yaml",
44+
"stateful-set/web.yaml",
45+
"stateful-set/web2.yaml"
46+
],
47+
"incomplete_init": [
48+
"kubernetes/incomplete-init/cassandra-statefulset.yaml",
49+
"kubernetes/incomplete-init/controller.yaml"
50+
],
51+
"silently_ignored": [
52+
"webhook/webhook-pod1.yaml",
53+
"webhook/webhook-pod2.yaml",
54+
"webhook/webhook-pod3.yaml",
55+
"webhook/webhook-pod4.yaml",
56+
"webhook/webhook-pod5.yaml",
57+
"webhook/webhook-pod6.yaml",
58+
"webhook/webhook-pod7.yaml",
59+
"webhook2/webhook-pod8.yaml",
60+
"webhook2/webhook-pod9.yaml",
61+
"webhook2/webhook-pod10.yaml",
62+
"webhook2/webhook-pod11.yaml",
63+
"webhook2/webhook-pod12.yaml",
64+
"webhook2/webhook-pod13.yaml",
65+
"webhook3/dns-test.yaml",
66+
"webhook3/many-layers.yaml"
67+
],
68+
"no_policy": [
69+
"kubernetes/fixtures/limits.yaml",
70+
"kubernetes/fixtures/namespace.yaml",
71+
"kubernetes/fixtures/quota.yaml"
72+
],
73+
"needs_containerd_pull": [
74+
"pod/pod-many-layers.yaml"
75+
],
76+
"common_images": [
77+
"mcr.microsoft.com/azurelinux/busybox:1.36",
78+
"mcr.microsoft.com/azurelinux/base/nginx:1.25",
79+
"mcr.microsoft.com/mirror/docker/library/ubuntu:noble"
80+
]
81+
}

‎src/tools/genpolicy/tests/adapt_settings_for_tests.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@
66

77
# usage: ./tests/adapt_settings_for_tests.sh
88

9+
set -x
10+
911
jq '.request_defaults.CreateContainerRequest.allow_env_regex_map = {
1012
"JOB_COMPLETION_INDEX": "^[0-9]*$",
1113
"CPU_LIMIT": "^[0-9]+$",
1214
"MEMORY_LIMIT": "^[0-9]+$"
13-
}' genpolicy-settings.json > tmp-genpolicy-settings.json && mv tmp-genpolicy-settings.json genpolicy-settings.json
15+
}' genpolicy-settings.json > tmp-genpolicy-settings.json && mv tmp-genpolicy-settings.json genpolicy-settings.json

‎src/tools/genpolicy/update_policy_samples.py‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
import concurrent.futures
2+
import os
3+
import subprocess
4+
import sys
5+
import json
6+
import time
7+
from pathlib import Path
8+
9+
# runs genpolicy tools on the following files
10+
# should run this after any change to genpolicy
11+
# usage: python3 update_policy_samples.py
12+
13+
with open('policy_samples.json') as f:
14+
samples = json.load(f)
15+
16+
default_yamls = samples["default"]
17+
incomplete_init = samples["incomplete_init"]
18+
silently_ignored = samples["silently_ignored"]
19+
no_policy = samples["no_policy"]
20+
needs_containerd_pull = samples["needs_containerd_pull"]
21+
22+
file_base_path = "../../agent/samples/policy/yaml"
23+
24+
def runCmd(arg):
25+
log = [f"========== COMMAND: {arg}"]
26+
return subprocess.run([arg], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True, input="", shell=True, check=True)
27+
28+
def timeRunCmd(arg):
29+
log = [f"========== COMMAND: {arg}"]
30+
start = time.time()
31+
32+
try:
33+
p = runCmd(arg)
34+
except subprocess.CalledProcessError as e:
35+
log.append(e.stdout)
36+
log.append(f"+++++ Failed with exit code {e.returncode}")
37+
raise
38+
else:
39+
if p.stdout:
40+
log.append(p.stdout)
41+
finally:
42+
end = time.time()
43+
log.append(f"Time taken: {round(end - start, 2)} seconds")
44+
print("\n".join(log))
45+
46+
# check we can access all files we are about to update
47+
for file in default_yamls + incomplete_init + silently_ignored + no_policy:
48+
filepath = os.path.join(file_base_path, file)
49+
if not os.path.exists(filepath):
50+
sys.exit(f"filepath does not exists: {filepath}")
51+
52+
# build tool
53+
next_command = "LIBC=gnu BUILD_TYPE= make"
54+
print("========== COMMAND: " + next_command)
55+
runCmd(next_command)
56+
57+
# allow all users to pull container images by using containerd
58+
next_command = "sudo chmod a+rw /var/run/containerd/containerd.sock"
59+
print("========== COMMAND: " + next_command)
60+
runCmd(next_command)
61+
62+
print("Modifying settings for testing")
63+
runCmd("cp genpolicy-settings.json default-genpolicy-settings.json")
64+
runCmd("./tests/adapt_settings_for_tests.sh")
65+
66+
# update files
67+
genpolicy_path = "./target/x86_64-unknown-linux-gnu/debug/genpolicy"
68+
69+
total_start = time.time()
70+
71+
with concurrent.futures.ThreadPoolExecutor(max_workers=os.cpu_count()) as executor:
72+
futures = []
73+
74+
for file in default_yamls + incomplete_init + no_policy + needs_containerd_pull:
75+
rego_file = "/tmp/" + Path(os.path.basename(file)).stem + "-rego.txt"
76+
cmd = f"{genpolicy_path} -r -d -u -y {os.path.join(file_base_path, file)} > {rego_file}"
77+
futures.append(executor.submit(timeRunCmd, cmd))
78+
79+
for file in silently_ignored:
80+
rego_file = "/tmp/" + Path(os.path.basename(file)).stem + "-rego.txt"
81+
cmd = f"{genpolicy_path} -r -d -u -s -y {os.path.join(file_base_path, file)} > {rego_file}"
82+
futures.append(executor.submit(timeRunCmd, cmd))
83+
84+
for future in concurrent.futures.as_completed(futures):
85+
# Surface any potential exception thrown by the future.
86+
future.result()
87+
88+
total_end = time.time()
89+
90+
print(f"Total time taken: {total_end - total_start} seconds")
91+
92+
print("Restoring settings to default")
93+
runCmd("mv default-genpolicy-settings.json genpolicy-settings.json")

0 commit comments

Comments
 (0)