Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

USE AsserCommand instead of K8sExecInPod #1933

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

USE AsserCommand instead of K8sExecInPod #1933

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
46e28a3
checking if the CI works
hellspawn679 Jan 5, 2025
1f08d3e
testing on ci
hellspawn679 Jan 5, 2025
4597f9d
fixing ci
hellspawn679 Jan 5, 2025
c3dcb80
fixed ci
hellspawn679 Jan 5, 2025
36a140a
updated test
hellspawn679 Jan 5, 2025
c82f395
mirror import fix
hellspawn679 Jan 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
updated test 
Signed-off-by: mehul <mehulsharma4786@gmail.com>
  • Loading branch information
@hellspawn679 @Aryan-sharma11
hellspawn679 authored and Aryan-sharma11 committed Jan 21, 2025
commit 36a140a67990bebdc1a40ada4e5e22dcd9bed423
158 changes: 66 additions & 92 deletions tests/k8s_env/syscalls/syscalls_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,10 +58,8 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -86,13 +84,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"})
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -117,16 +111,13 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "mkdir -p /foo/bar"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "mkdir -p /foo/bar"}, MatchRegexp(".*"), true)

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /foo/bar/unlink"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /foo/bar/unlink"}, MatchRegexp(".*"), true)

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "/foo/bar/unlink /dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"}, MatchRegexp(".*"), true)

AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "/foo/bar/unlink /dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -151,13 +142,11 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /unlink"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /unlink"}, MatchRegexp(".*"), true)

AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "/unlink /dummy"}, MatchRegexp(".*"), true)

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "/unlink /dummy"})
Expect(err).To(BeNil())

// check policy alert
expect := protobuf.Alert{
Expand Down Expand Up @@ -185,10 +174,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), true)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -213,10 +201,8 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -237,17 +223,14 @@ var _ = Describe("Syscalls", func() {
err := K8sApply([]string{"manifests/matchpaths/unlink-dir-recursive-fromsource-path.yaml"})
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"}, MatchRegexp(".*"), true)

// Start Kubearmor Logs
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /home/dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -272,10 +255,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), true)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -296,17 +278,14 @@ var _ = Describe("Syscalls", func() {
err := K8sApply([]string{"manifests/matchpaths/unlink-dir-recursive-fromsource-dir.yaml"})
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "cp /usr/bin/unlink /bin/unlink"}, MatchRegexp(".*"), true)

// Start Kubearmor Logs
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "/bin/unlink /home/dummy"}, MatchRegexp(".*"), true)

// check policy alert
expect := protobuf.Alert{
Expand Down Expand Up @@ -334,10 +313,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), true)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -363,10 +341,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), true)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -392,10 +369,10 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())

AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), true)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), true)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -421,10 +398,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), false)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), false)


// check policy alert
expect := protobuf.Alert{
Expand Down Expand Up @@ -452,10 +428,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), false)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), false)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -481,10 +456,10 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())

AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), false)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), false)


// check policy alert
expect := protobuf.Alert{
Expand All @@ -510,10 +485,9 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())

AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), false)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), false)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -539,10 +513,8 @@ var _ = Describe("Syscalls", func() {
err = KarmorLogStart("policy", "syscalls", "Syscall", ubuntu)
Expect(err).To(BeNil())

_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"})
Expect(err).To(BeNil())
_, _, err = K8sExecInPod(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"})
Expect(err).To(BeNil())
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "touch /home/dummy"}, MatchRegexp(".*"), false)
AssertCommand(ubuntu, "syscalls", []string{"bash", "-c", "unlink /home/dummy"}, MatchRegexp(".*"), false)

// check policy alert
expect := protobuf.Alert{
Expand All @@ -567,13 +539,15 @@ var _ = Describe("Syscalls", func() {
Expect(err).To(BeNil())

// execute mount inside the pod
sout, _, err := K8sExecInPod(ubuntu, "syscalls",
[]string{"bash", "-c", "mkdir /mnt/test"})
Expect(err).To(BeNil())
sout, _, err = K8sExecInPod(ubuntu, "syscalls",
[]string{"bash", "-c", "mount /home /mnt/test"})
Expect(err).To(BeNil())
fmt.Printf("OUTPUT: %s\n", sout)
AssertCommand(
ubuntu, "syscalls", []string{"bash", "-c", "mkdir /mnt/test"},
MatchRegexp(".*"), true,
)

AssertCommand(
ubuntu, "syscalls", []string{"bash", "-c", "mount /home /mnt/test"},
MatchRegexp(".*"), true,
)

expect := protobuf.Alert{
PolicyName: "DefaultPosture",
Expand All @@ -596,10 +570,10 @@ var _ = Describe("Syscalls", func() {
Expect(err).To(BeNil())

// execute umount inside the pod
sout, _, err := K8sExecInPod(ubuntu, "syscalls",
[]string{"bash", "-c", "umount /mnt"})
Expect(err).To(BeNil())
fmt.Printf("OUTPUT: %s\n", sout)
AssertCommand(
ubuntu, "syscalls", []string{"bash", "-c", "umount /mnt"},
MatchRegexp(".*"), true,
)

expect := protobuf.Alert{
PolicyName: "DefaultPosture",
Expand Down
20 changes: 10 additions & 10 deletions tests/k8s_env/throttling/throttling_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,11 @@ var _ = Describe("Smoke", func() {
// wait for policy creation
time.Sleep(5 * time.Second)

sout, _, err := K8sExecInPod(wp, "wordpress-mysql",
[]string{"bash", "-c", "count=0; while [ $count -lt 5 ]; do apt; count=$((count + 1)); done;"})
Expect(err).To(BeNil())
fmt.Printf("OUTPUT: %s\n", sout)
Expect(sout).To(MatchRegexp("apt.*Permission denied"))
AssertCommand(
wp, "wordpress-mysql",
[]string{"bash", "-c", "count=0; while [ $count -lt 5 ]; do apt; count=$((count + 1)); done;"},
MatchRegexp("apt.*Permission denied"), true,
)

// check policy violation alert
_, alerts, err := KarmorGetLogs(5*time.Second, 1)
Expand All @@ -93,11 +93,11 @@ var _ = Describe("Smoke", func() {
Expect(err).To(BeNil())

// check for throttling, alerts should not be genrated
sout, _, err = K8sExecInPod(wp, "wordpress-mysql",
[]string{"bash", "-c", "apt update"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
Expect(sout).To(MatchRegexp("apt.*Permission denied"))
AssertCommand(
wp, "wordpress-mysql",
[]string{"bash", "-c", "apt update"},
MatchRegexp("apt.*Permission denied"), true,
)

_, alerts, err = KarmorGetLogs(5*time.Second, 1)
Expect(err).To(BeNil())
Expand Down
14 changes: 5 additions & 9 deletions tests/k8s_env/visibility/visibility_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,9 +60,8 @@ var _ = Describe("Visibility", func() {
err = KarmorLogStart("all", "wordpress-mysql", "", wp)
Expect(err).To(BeNil())

sout, _, err := K8sExecInPod(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
AssertCommand(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"}, MatchRegexp(".*"), true)


// check audit logs
logs, _, err := KarmorGetLogs(5*time.Second, 50)
Expand All @@ -89,9 +88,8 @@ var _ = Describe("Visibility", func() {
err = KarmorLogStart("all", "wordpress-mysql", "", wp)
Expect(err).To(BeNil())

sout, _, err := K8sExecInPod(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
AssertCommand(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"}, MatchRegexp(".*"), true)


// check audit logs
logs, _, err := KarmorGetLogs(5*time.Second, 50)
Expand All @@ -115,9 +113,7 @@ var _ = Describe("Visibility", func() {
err = KarmorLogStart("all", "wordpress-mysql", "", wp)
Expect(err).To(BeNil())

sout, _, err := K8sExecInPod(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"})
Expect(err).To(BeNil())
fmt.Printf("---START---\n%s---END---\n", sout)
AssertCommand(wp, "wordpress-mysql", []string{"bash", "-c", "ping google.com -c1"}, MatchRegexp(".*"), true)

// check audit logs
logs, _, err := KarmorGetLogs(5*time.Second, 50)
Expand Down