1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
#!/usr/bin/env bats
load helpers
@test "bind secrets mounts to container" {
skip_if_no_runtime
# Setup
SECRETS_DIR=$TESTDIR/rhel/secrets
mkdir -p $SECRETS_DIR
TESTFILE1=$SECRETS_DIR/test.txt
TESTFILE_CONTENT="Testing secrets mounts. I am mounted!"
echo $TESTFILE_CONTENT > $TESTFILE1
TESTFILE2=$SECRETS_DIR/file.txt
touch $TESTFILE2
chmod 604 $TESTFILE2
TESTDIR1=$SECRETS_DIR/test-dir
mkdir -m704 $TESTDIR1
TESTFILE3=$TESTDIR1/file.txt
touch $TESTFILE3
chmod 777 $TESTFILE3
mkdir -p $TESTDIR/symlink/target
touch $TESTDIR/symlink/target/key.pem
ln -s $TESTDIR/symlink/target $SECRETS_DIR/mysymlink
# prepare the test mounts file
mkdir $TESTDIR/containers
MOUNTS_PATH=$TESTDIR/containers/mounts.conf
# add the mounts entries
echo "$SECRETS_DIR:/run/secrets" > $MOUNTS_PATH
echo "$SECRETS_DIR" >> $MOUNTS_PATH
echo "$TESTFILE1:/test.txt" >> $MOUNTS_PATH
# setup the test container
_prefetch alpine
run_buildah --default-mounts-file "$MOUNTS_PATH" \
from --quiet --pull --signature-policy ${TESTSDIR}/policy.json alpine
cid=$output
# test a standard mount to /run/secrets
run_buildah run $cid ls /run/secrets
expect_output --substring "test.txt"
# test a mount without destination
run_buildah run $cid ls "$TESTDIR"/rhel/secrets
expect_output --substring "test.txt"
# test a file-based mount
run_buildah run $cid cat /test.txt
expect_output "$TESTFILE_CONTENT"
# test permissions for a file-based mount
run_buildah run $cid stat -c %a /run/secrets/file.txt
expect_output 604
# test permissions for a directory-based mount
run_buildah run $cid stat -c %a /run/secrets/test-dir
expect_output 704
# test permissions for a file-based mount within a sub-directory
run_buildah run $cid stat -c %a /run/secrets/test-dir/file.txt
expect_output 777
# test a symlink
run_buildah run $cid ls /run/secrets/mysymlink
expect_output --substring "key.pem"
}
|
