Skip to content

Commit 5eb7101

Browse files
dbasunagdbasunag
committed
include scc tests for model catalog, modelregisry postgres deployment and pod
1 parent 125893f commit 5eb7101

File tree

5 files changed

+256
-83
lines changed

5 files changed

+256
-83
lines changed

‎tests/model_registry/scc/conftest.py‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import pytest
2+
from _pytest.fixtures import FixtureRequest
3+
4+
from ocp_resources.namespace import Namespace
5+
from ocp_resources.pod import Pod
6+
from ocp_resources.deployment import Deployment
7+
from tests.model_registry.scc.constants import MR_POSTGRES_DEPLOYMENT_NAME_STR
8+
from tests.model_registry.scc.utils import get_pod_by_deployment_name
9+
from tests.model_registry.constants import MR_INSTANCE_NAME
10+
11+
from kubernetes.dynamic import DynamicClient
12+
from simple_logger.logger import get_logger
13+
14+
LOGGER = get_logger(name=__name__)
15+
16+
@pytest.fixture()
17+
def skip_if_not_valid_check(request) -> None:
18+
"""
19+
Fixture that skips the test if deployment name is model-registry-postgres
20+
and db_name is not set to 'default'
21+
"""
22+
deployment_name = request.node.callspec.params.get('deployment_model_registry_ns', {}).get('deployment_name') or \
23+
request.node.callspec.params.get('pod_model_registry_ns', {}).get('deployment_name')
24+
db_name = request.node.callspec.params.get('model_registry_metadata_db_resources', {}).get('db_name', "mysql")
25+
LOGGER.info(f"Deployment name:{deployment_name}, db selection: {db_name}",)
26+
27+
if deployment_name == MR_POSTGRES_DEPLOYMENT_NAME_STR and db_name != "default":
28+
pytest.skip(reason=f"{MR_POSTGRES_DEPLOYMENT_NAME_STR} deployment only valid when db_name is 'default'")
29+
30+
31+
@pytest.fixture(scope="class")
32+
def model_registry_scc_namespace(model_registry_namespace: str):
33+
mr_annotations = Namespace(name=model_registry_namespace).instance.metadata.annotations
34+
return {
35+
"seLinuxOptions": mr_annotations.get("openshift.io/sa.scc.mcs"),
36+
"uid-range": mr_annotations.get("openshift.io/sa.scc.uid-range"),
37+
}
38+
39+
40+
@pytest.fixture(scope="function")
41+
def deployment_model_registry_ns(
42+
request: FixtureRequest, model_registry_namespace: str
43+
) -> Deployment:
44+
return Deployment(name=request.param.get("deployment_name", MR_INSTANCE_NAME),
45+
namespace=model_registry_namespace, ensure_exists=True)
46+
47+
48+
@pytest.fixture(scope="function")
49+
def pod_model_registry_ns(
50+
request: FixtureRequest, admin_client: DynamicClient, model_registry_namespace: str
51+
) -> Pod:
52+
return get_pod_by_deployment_name(
53+
admin_client=admin_client,
54+
namespace=model_registry_namespace,
55+
deployment_name=request.param.get("deployment_name", MR_INSTANCE_NAME)
56+
)
57+
58+
59+
60+

‎tests/model_registry/scc/constants.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
from tests.model_registry.constants import MR_INSTANCE_NAME
2+
3+
MODEL_CATALOG_STR = "model-catalog"
4+
MR_POSTGRES_DEPLOYMENT_NAME_STR = f"{MR_INSTANCE_NAME}-postgres"

‎tests/model_registry/scc/test_model_catalog_scc.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
import pytest
2+
from typing import Self
3+
4+
from simple_logger.logger import get_logger
5+
from _pytest.fixtures import FixtureRequest
6+
7+
from ocp_resources.namespace import Namespace
8+
from ocp_resources.pod import Pod
9+
from ocp_resources.deployment import Deployment
10+
from tests.model_registry.scc.constants import MODEL_CATALOG_STR
11+
from tests.model_registry.scc.utils import (
12+
get_uid_from_namespace,
13+
validate_pod_security_context,
14+
KEYS_TO_VALIDATE,
15+
validate_containers_pod_security_context,
16+
get_pod_by_deployment_name,
17+
validate_deployment_scc,
18+
validate_pod_scc,
19+
)
20+
from tests.model_registry.constants import MODEL_DICT, MR_INSTANCE_NAME, MODEL_REGISTRY_POD_FILTER
21+
22+
from kubernetes.dynamic import DynamicClient
23+
24+
LOGGER = get_logger(name=__name__)
25+
26+
27+
@pytest.mark.usefixtures(
28+
"updated_dsc_component_state_scope_session",
29+
)
30+
@pytest.mark.custom_namespace
31+
class TestModelCatalogSecurityContextValidation:
32+
@pytest.mark.parametrize(
33+
"deployment_model_registry_ns",
34+
[
35+
pytest.param({"deployment_name": MODEL_CATALOG_STR}),
36+
pytest.param({"deployment_name": f"{MODEL_CATALOG_STR}-postgres"}),
37+
],
38+
indirect=["deployment_model_registry_ns"],
39+
)
40+
@pytest.mark.sanity
41+
def test_model_catalog_deployment_security_context_validation(
42+
self: Self,
43+
deployment_model_registry_ns: Deployment,
44+
):
45+
"""
46+
Validate that model catalog deployment does not set runAsUser/runAsGroup
47+
"""
48+
validate_deployment_scc(deployment=deployment_model_registry_ns)
49+
50+
@pytest.mark.parametrize(
51+
"pod_model_registry_ns",
52+
[
53+
pytest.param({"deployment_name": MODEL_CATALOG_STR}),
54+
pytest.param({"deployment_name": f"{MODEL_CATALOG_STR}-postgres"}),
55+
],
56+
indirect=["pod_model_registry_ns"],
57+
)
58+
@pytest.mark.sanity
59+
def test_model_catalog_pod_security_context_validation(
60+
self: Self,
61+
pod_model_registry_ns: Pod,
62+
model_registry_scc_namespace: dict[str, str],
63+
):
64+
"""
65+
Validate that model catalog pod gets runAsUser/runAsGroup from openshift and the values matches namespace
66+
annotations
67+
"""
68+
validate_pod_scc(pod=pod_model_registry_ns, model_registry_scc_namespace=model_registry_scc_namespace)

‎tests/model_registry/scc/test_model_registry_scc.py‎

Lines changed: 22 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -2,129 +2,73 @@
22
from typing import Self
33

44
from simple_logger.logger import get_logger
5-
from _pytest.fixtures import FixtureRequest
65

7-
from ocp_resources.namespace import Namespace
86
from ocp_resources.pod import Pod
97
from ocp_resources.deployment import Deployment
108
from tests.model_registry.scc.utils import (
11-
get_uid_from_namespace,
12-
validate_pod_security_context,
13-
KEYS_TO_VALIDATE,
14-
validate_containers_pod_security_context,
9+
validate_deployment_scc,
10+
validate_pod_scc,
1511
)
16-
from tests.model_registry.constants import MODEL_DICT, MR_INSTANCE_NAME, MODEL_REGISTRY_POD_FILTER
12+
from tests.model_registry.constants import MR_INSTANCE_NAME
1713

18-
from kubernetes.dynamic import DynamicClient
1914

2015
LOGGER = get_logger(name=__name__)
2116

22-
23-
@pytest.fixture(scope="class")
24-
def model_registry_scc_namespace(model_registry_namespace: str):
25-
mr_annotations = Namespace(name=model_registry_namespace).instance.metadata.annotations
26-
return {
27-
"seLinuxOptions": mr_annotations.get("openshift.io/sa.scc.mcs"),
28-
"uid-range": mr_annotations.get("openshift.io/sa.scc.uid-range"),
29-
}
30-
31-
32-
@pytest.fixture(scope="class")
33-
def model_registry_resource(
34-
request: FixtureRequest, admin_client: DynamicClient, model_registry_namespace: str
35-
) -> Deployment | Pod:
36-
if request.param["kind"] == Deployment:
37-
return Deployment(name=MR_INSTANCE_NAME, namespace=model_registry_namespace, ensure_exists=True)
38-
elif request.param["kind"] == Pod:
39-
pods = list(
40-
Pod.get(
41-
dyn_client=admin_client,
42-
namespace=model_registry_namespace,
43-
label_selector=MODEL_REGISTRY_POD_FILTER,
44-
)
45-
)
46-
if len(pods) != 1:
47-
pytest.fail(
48-
"Expected one model registry pod. Found: {[{pod.name: pod.status} for pod in pods] if pods else None}"
49-
)
50-
return pods[0]
51-
else:
52-
raise AssertionError(f"Invalid resource: {request.param['kind']}. Valid options: Deployment and Pod")
17+
MODEL_CATALOG_STR = "model-catalog"
18+
MR_POSTGRES_DEPLOYMENT_NAME_STR = f"{MR_INSTANCE_NAME}-postgres"
5319

5420

5521
@pytest.mark.parametrize(
56-
"registered_model",
22+
"model_registry_metadata_db_resources, model_registry_instance",
5723
[
58-
pytest.param(
59-
MODEL_DICT,
60-
),
24+
pytest.param({}, {}),
25+
pytest.param({"db_name": "default"}, {"db_name": "default"}),
6126
],
6227
indirect=True,
6328
)
6429
@pytest.mark.usefixtures(
6530
"updated_dsc_component_state_scope_session",
6631
"model_registry_metadata_db_resources",
6732
"model_registry_instance",
68-
"registered_model",
6933
)
7034
@pytest.mark.custom_namespace
7135
class TestModelRegistrySecurityContextValidation:
7236
@pytest.mark.parametrize(
73-
"model_registry_resource",
37+
"deployment_model_registry_ns",
7438
[
75-
pytest.param({"kind": Deployment}),
39+
pytest.param({"deployment_name": MR_INSTANCE_NAME}),
40+
pytest.param({"deployment_name": MR_POSTGRES_DEPLOYMENT_NAME_STR}),
7641
],
77-
indirect=["model_registry_resource"],
42+
indirect=["deployment_model_registry_ns"],
7843
)
7944
@pytest.mark.sanity
8045
def test_model_registry_deployment_security_context_validation(
8146
self: Self,
82-
model_registry_resource: Deployment,
47+
skip_if_not_valid_check: None,
48+
deployment_model_registry_ns: Deployment,
8349
):
8450
"""
8551
Validate that model registry deployment does not set runAsUser/runAsGroup
8652
"""
87-
error = []
88-
for container in model_registry_resource.instance.spec.template.spec.containers:
89-
if not all([True for key in KEYS_TO_VALIDATE if not container.get(key)]):
90-
error.append({container.name: container.securityContext})
91-
92-
if error:
93-
pytest.fail(
94-
f"{model_registry_resource.name} {model_registry_resource.kind} containers expected to not "
95-
f"set {KEYS_TO_VALIDATE}, actual: {error}"
96-
)
53+
validate_deployment_scc(deployment=deployment_model_registry_ns)
9754

9855
@pytest.mark.parametrize(
99-
"model_registry_resource",
56+
"pod_model_registry_ns",
10057
[
101-
pytest.param({"kind": Pod}),
58+
pytest.param({"deployment_name": MR_INSTANCE_NAME}),
59+
pytest.param({"deployment_name": MR_POSTGRES_DEPLOYMENT_NAME_STR}),
10260
],
103-
indirect=["model_registry_resource"],
61+
indirect=["pod_model_registry_ns"],
10462
)
10563
@pytest.mark.sanity
10664
def test_model_registry_pod_security_context_validation(
10765
self: Self,
108-
model_registry_resource: Pod,
66+
skip_if_not_valid_check: None,
67+
pod_model_registry_ns: Pod,
10968
model_registry_scc_namespace: dict[str, str],
11069
):
11170
"""
11271
Validate that model registry pod gets runAsUser/runAsGroup from openshift and the values matches namespace
11372
annotations
11473
"""
115-
ns_uid = get_uid_from_namespace(namespace_scc=model_registry_scc_namespace)
116-
pod_spec = model_registry_resource.instance.spec
117-
errors = validate_pod_security_context(
118-
pod_security_context=pod_spec.securityContext,
119-
namespace_scc=model_registry_scc_namespace,
120-
model_registry_pod=model_registry_resource,
121-
ns_uid=ns_uid,
122-
)
123-
errors.extend(
124-
validate_containers_pod_security_context(model_registry_pod=model_registry_resource, namespace_uid=ns_uid)
125-
)
126-
if errors:
127-
pytest.fail(
128-
f"{model_registry_resource.name} {model_registry_resource.kind} pod security context validation failed"
129-
f" with error: {errors}"
130-
)
74+
validate_pod_scc(pod=pod_model_registry_ns, model_registry_scc_namespace=model_registry_scc_namespace)

0 commit comments

Comments
 (0)