Skip to content

Commit

Permalink
Hide mount enforcement behind a LCOWIntegrity feature flag
Browse files Browse the repository at this point in the history 
Signed-off-by: Maksim An <maksiman@microsoft.com>
  • Loading branch information
@anmaxvl
anmaxvl committed Mar 21, 2022
1 parent b4b0736 commit 05b8dc2
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions test/cri-containerd/policy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ func Test_RunSimpleAlpineContainer_WithPolicy_Allowed(t *testing.T) {
}

func Test_RunContainer_WithMountConstraints_Allowed(t *testing.T) {
requireFeatures(t, featureLCOW)
requireFeatures(t, featureLCOW, featureLCOWIntegrity)
pullRequiredLCOWImages(t, []string{imageLcowK8sPause, imageLcowAlpine})

client := newTestRuntimeClient(t)
Expand Down Expand Up @@ -222,7 +222,7 @@ func Test_RunContainer_WithMountConstraints_Allowed(t *testing.T) {
}

func Test_RunContainer_WithMountConstraints_NotAllowed(t *testing.T) {
requireFeatures(t, featureLCOW)
requireFeatures(t, featureLCOW, featureLCOWIntegrity)
pullRequiredLCOWImages(t, []string{imageLcowK8sPause, imageLcowAlpine})

client := newTestRuntimeClient(t)
Expand Down

4 comments on commit 05b8dc2

@SeanTAllen
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why hide the mount behind the integrity flag? You should be able to use policy without needing integrity.

@anmaxvl
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why hide the mount behind the integrity flag? You should be able to use policy without needing integrity.

I don't think I follow. for end to end tests, how would we skip root hash validation?

@SeanTAllen
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I reread. I think the commit title was misleading. I see what is going on now.

@SeanTAllen
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should talk about this and what I presented to Veeru.

Please sign in to comment.