Bumping k8s dependencies to 1.13

vendor/k8s.io/kubernetes/test/e2e/apimachinery/webhook.go

@@ -52,21 +52,23 @@ const (
 	roleBindingName = "webhook-auth-reader"
 
 	// The webhook configuration names should not be reused between test instances.
-	crWebhookConfigName          = "e2e-test-webhook-config-cr"
-	webhookConfigName            = "e2e-test-webhook-config"
-	mutatingWebhookConfigName    = "e2e-test-mutating-webhook-config"
-	podMutatingWebhookConfigName = "e2e-test-mutating-webhook-pod"
-	crMutatingWebhookConfigName  = "e2e-test-mutating-webhook-config-cr"
-	webhookFailClosedConfigName  = "e2e-test-webhook-fail-closed"
-	webhookForWebhooksConfigName = "e2e-test-webhook-for-webhooks-config"
-	removableValidatingHookName  = "e2e-test-should-be-removable-validating-webhook-config"
-	removableMutatingHookName    = "e2e-test-should-be-removable-mutating-webhook-config"
-	crdWebhookConfigName         = "e2e-test-webhook-config-crd"
+	crWebhookConfigName           = "e2e-test-webhook-config-cr"
+	webhookConfigName             = "e2e-test-webhook-config"
+	attachingPodWebhookConfigName = "e2e-test-webhook-config-attaching-pod"
+	mutatingWebhookConfigName     = "e2e-test-mutating-webhook-config"
+	podMutatingWebhookConfigName  = "e2e-test-mutating-webhook-pod"
+	crMutatingWebhookConfigName   = "e2e-test-mutating-webhook-config-cr"
+	webhookFailClosedConfigName   = "e2e-test-webhook-fail-closed"
+	webhookForWebhooksConfigName  = "e2e-test-webhook-for-webhooks-config"
+	removableValidatingHookName   = "e2e-test-should-be-removable-validating-webhook-config"
+	removableMutatingHookName     = "e2e-test-should-be-removable-mutating-webhook-config"
+	crdWebhookConfigName          = "e2e-test-webhook-config-crd"
 
 	skipNamespaceLabelKey   = "skip-webhook-admission"
 	skipNamespaceLabelValue = "yes"
 	skippedNamespaceName    = "exempted-namesapce"
 	disallowedPodName       = "disallowed-pod"
+	toBeAttachedPodName     = "to-be-attached-pod"
 	hangingPodName          = "hanging-pod"
 	disallowedConfigMapName = "disallowed-configmap"
 	allowedConfigMapName    = "allowed-configmap"
@@ -117,6 +119,12 @@ var _ = SIGDescribe("AdmissionWebhook", func() {
 		testWebhook(f)
 	})
 
+	It("Should be able to deny attaching pod", func() {
+		webhookCleanup := registerWebhookForAttachingPod(f, context)
+		defer webhookCleanup()
+		testAttachingPodWebhook(f)
+	})
+
 	It("Should be able to deny custom resource creation", func() {
 		testcrd, err := framework.CreateTestCRD(f)
 		if err != nil {
@@ -405,6 +413,53 @@ func registerWebhook(f *framework.Framework, context *certContext) func() {
 	}
 }
 
+func registerWebhookForAttachingPod(f *framework.Framework, context *certContext) func() {
+	client := f.ClientSet
+	By("Registering the webhook via the AdmissionRegistration API")
+
+	namespace := f.Namespace.Name
+	configName := attachingPodWebhookConfigName
+	// A webhook that cannot talk to server, with fail-open policy
+	failOpenHook := failingWebhook(namespace, "fail-open.k8s.io")
+	policyIgnore := v1beta1.Ignore
+	failOpenHook.FailurePolicy = &policyIgnore
+
+	_, err := client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Create(&v1beta1.ValidatingWebhookConfiguration{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: configName,
+		},
+		Webhooks: []v1beta1.Webhook{
+			{
+				Name: "deny-attaching-pod.k8s.io",
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{v1beta1.Connect},
+					Rule: v1beta1.Rule{
+						APIGroups:   []string{""},
+						APIVersions: []string{"v1"},
+						Resources:   []string{"pods/attach"},
+					},
+				}},
+				ClientConfig: v1beta1.WebhookClientConfig{
+					Service: &v1beta1.ServiceReference{
+						Namespace: namespace,
+						Name:      serviceName,
+						Path:      strPtr("/pods/attach"),
+					},
+					CABundle: context.signingCert,
+				},
+			},
+		},
+	})
+	framework.ExpectNoError(err, "registering webhook config %s with namespace %s", configName, namespace)
+
+	// The webhook configuration is honored in 10s.
+	time.Sleep(10 * time.Second)
+
+	return func() {
+		client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Delete(configName, nil)
+	}
+}
+
 func registerMutatingWebhookForConfigMap(f *framework.Framework, context *certContext) func() {
 	client := f.ClientSet
 	By("Registering the mutating configmap webhook via the AdmissionRegistration API")
@@ -576,7 +631,7 @@ func testWebhook(f *framework.Framework) {
 	pod = hangingPod(f)
 	_, err = client.CoreV1().Pods(f.Namespace.Name).Create(pod)
 	Expect(err).NotTo(BeNil())
-	expectedTimeoutErr := "request did not complete within allowed duration"
+	expectedTimeoutErr := "request did not complete within"
 	if !strings.Contains(err.Error(), expectedTimeoutErr) {
 		framework.Failf("expect timeout error %q, got %q", expectedTimeoutErr, err.Error())
 	}
@@ -642,6 +697,21 @@ func testWebhook(f *framework.Framework) {
 	Expect(err).To(BeNil())
 }
 
+func testAttachingPodWebhook(f *framework.Framework) {
+	By("create a pod")
+	client := f.ClientSet
+	pod := toBeAttachedPod(f)
+	_, err := client.CoreV1().Pods(f.Namespace.Name).Create(pod)
+	Expect(err).To(BeNil())
+
+	By("'kubectl attach' the pod, should be denied by the webhook")
+	_, err = framework.NewKubectlCommand("attach", fmt.Sprintf("--namespace=%v", f.Namespace.Name), pod.Name, "-i", "-c=container1").Exec()
+	Expect(err).NotTo(BeNil())
+	if e, a := "attaching to pod 'to-be-attached-pod' is not allowed", err.Error(); !strings.Contains(a, e) {
+		framework.Failf("unexpected 'kubectl attach' error message. expected to contain %q, got %q", e, a)
+	}
+}
+
 // failingWebhook returns a webhook with rule of create configmaps,
 // but with an invalid client config so that server cannot communicate with it
 func failingWebhook(namespace, name string) v1beta1.Webhook {
@@ -930,6 +1000,22 @@ func hangingPod(f *framework.Framework) *v1.Pod {
 	}
 }
 
+func toBeAttachedPod(f *framework.Framework) *v1.Pod {
+	return &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: toBeAttachedPodName,
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "container1",
+					Image: imageutils.GetPauseImageName(),
+				},
+			},
+		},
+	}
+}
+
 func nonCompliantConfigMap(f *framework.Framework) *v1.ConfigMap {
 	return &v1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1100,7 +1186,7 @@ func testCustomResourceWebhook(f *framework.Framework, crd *apiextensionsv1beta1
 			},
 		},
 	}
-	_, err := customResourceClient.Create(crInstance)
+	_, err := customResourceClient.Create(crInstance, metav1.CreateOptions{})
 	Expect(err).NotTo(BeNil())
 	expectedErrMsg := "the custom resource contains unwanted data"
 	if !strings.Contains(err.Error(), expectedErrMsg) {
@@ -1123,7 +1209,7 @@ func testMutatingCustomResourceWebhook(f *framework.Framework, crd *apiextension
 			},
 		},
 	}
-	mutatedCR, err := customResourceClient.Create(cr)
+	mutatedCR, err := customResourceClient.Create(cr, metav1.CreateOptions{})
 	Expect(err).To(BeNil())
 	expectedCRData := map[string]interface{}{
 		"mutation-start":   "yes",