From 11f3a1bdece8ccebf3a393936d9a0c93e6471d81 Mon Sep 17 00:00:00 2001 From: Chandan Maurya Date: Wed, 1 Apr 2026 11:16:42 +0530 Subject: [PATCH] Automate OCP-70987: Allow dev fuse by default in CRI-O --- test/extended/node/node_e2e/node.go | 41 +++++++++++++++++- test/extended/testdata/bindata.go | 42 +++++++++++++++++++ .../testdata/node/node_e2e/pod-dev-fuse.yaml | 20 +++++++++ 3 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml diff --git a/test/extended/node/node_e2e/node.go b/test/extended/node/node_e2e/node.go index 9dfc56962cc8..f88aff4001bb 100644 --- a/test/extended/node/node_e2e/node.go +++ b/test/extended/node/node_e2e/node.go @@ -1,6 +1,7 @@ package node import ( + "path/filepath" "strings" "time" @@ -14,7 +15,9 @@ import ( var _ = g.Describe("[sig-node] [Jira:Node/Kubelet] Kubelet, CRI-O, CPU manager", func() { var ( - oc = exutil.NewCLIWithoutNamespace("node") + oc = exutil.NewCLIWithoutNamespace("node") + nodeE2EBaseDir = exutil.FixturePath("testdata", "node", "node_e2e") + podDevFuseYAML = filepath.Join(nodeE2EBaseDir, "pod-dev-fuse.yaml") ) // Skip all tests on MicroShift clusters as MachineConfig resources are not available @@ -103,4 +106,40 @@ var _ = g.Describe("[sig-node] [Jira:Node/Kubelet] Kubelet, CRI-O, CPU manager", o.Expect(err).Should(o.HaveOccurred()) o.Expect(output).To(o.ContainSubstring("spec.cgroupMode: Unsupported value: \"v1\": supported values: \"v2\", \"\"")) }) + + //author: cmaurya@redhat.com + g.It("[OTP] Allow dev fuse by default in CRI-O [OCP-70987]", func() { + podName := "pod-devfuse" + ns := "devfuse-test" + + g.By("Create a test namespace") + err := oc.AsAdmin().WithoutNamespace().Run("create").Args("namespace", ns).Execute() + o.Expect(err).NotTo(o.HaveOccurred()) + defer oc.AsAdmin().WithoutNamespace().Run("delete").Args("namespace", ns, "--ignore-not-found").Execute() + + g.By("Create a pod with dev fuse annotation") + err = oc.AsAdmin().WithoutNamespace().Run("apply").Args("-f", podDevFuseYAML, "-n", ns).Execute() + o.Expect(err).NotTo(o.HaveOccurred()) + + g.By("Wait for pod to be ready") + err = wait.Poll(5*time.Second, 1*time.Minute, func() (bool, error) { + status, pollErr := oc.AsAdmin().WithoutNamespace().Run("get").Args("pod", podName, "-n", ns, "-o=jsonpath={.status.conditions[?(@.type=='Ready')].status}").Output() + if pollErr != nil { + e2e.Logf("Error polling pod status: %v", pollErr) + return false, nil + } + return status == "True", nil + }) + if err != nil { + podStatus, _ := oc.AsAdmin().WithoutNamespace().Run("get").Args("pod", podName, "-n", ns, "-o=jsonpath={.status}").Output() + e2e.Logf("Pod status on timeout: %s", podStatus) + } + o.Expect(err).NotTo(o.HaveOccurred(), "pod did not become ready") + + g.By("Check /dev/fuse is mounted inside the pod") + output, err := oc.AsAdmin().WithoutNamespace().Run("exec").Args(podName, "-n", ns, "--", "stat", "/dev/fuse").Output() + o.Expect(err).NotTo(o.HaveOccurred()) + e2e.Logf("/dev/fuse mount output: %s", output) + o.Expect(output).To(o.ContainSubstring("fuse"), "dev fuse is not mounted inside pod") + }) }) diff --git a/test/extended/testdata/bindata.go b/test/extended/testdata/bindata.go index fa539ff00652..b2e4da20390a 100644 --- a/test/extended/testdata/bindata.go +++ b/test/extended/testdata/bindata.go @@ -457,6 +457,7 @@ // test/extended/testdata/node/nested_container/containers.conf // test/extended/testdata/node/nested_container/run_tests.sh // test/extended/testdata/node/nested_container/skip_tests.sh +// test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml // test/extended/testdata/node_tuning/nto-stalld.yaml // test/extended/testdata/oauthserver/cabundle-cm.yaml // test/extended/testdata/oauthserver/oauth-network.yaml @@ -50593,6 +50594,43 @@ func testExtendedTestdataNodeNested_containerSkip_testsSh() (*asset, error) { return a, nil } +var _testExtendedTestdataNodeNode_e2ePodDevFuseYaml = []byte(`apiVersion: v1 +kind: Pod +metadata: + name: pod-devfuse + annotations: + io.kubernetes.cri-o.Devices: "/dev/fuse" +spec: + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: pod-devfuse + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: ["sleep", "infinity"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL +`) + +func testExtendedTestdataNodeNode_e2ePodDevFuseYamlBytes() ([]byte, error) { + return _testExtendedTestdataNodeNode_e2ePodDevFuseYaml, nil +} + +func testExtendedTestdataNodeNode_e2ePodDevFuseYaml() (*asset, error) { + bytes, err := testExtendedTestdataNodeNode_e2ePodDevFuseYamlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + var _testExtendedTestdataNode_tuningNtoStalldYaml = []byte(`apiVersion: tuned.openshift.io/v1 kind: Tuned metadata: @@ -56726,6 +56764,7 @@ var _bindata = map[string]func() (*asset, error){ "test/extended/testdata/node/nested_container/containers.conf": testExtendedTestdataNodeNested_containerContainersConf, "test/extended/testdata/node/nested_container/run_tests.sh": testExtendedTestdataNodeNested_containerRun_testsSh, "test/extended/testdata/node/nested_container/skip_tests.sh": testExtendedTestdataNodeNested_containerSkip_testsSh, + "test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml": testExtendedTestdataNodeNode_e2ePodDevFuseYaml, "test/extended/testdata/node_tuning/nto-stalld.yaml": testExtendedTestdataNode_tuningNtoStalldYaml, "test/extended/testdata/oauthserver/cabundle-cm.yaml": testExtendedTestdataOauthserverCabundleCmYaml, "test/extended/testdata/oauthserver/oauth-network.yaml": testExtendedTestdataOauthserverOauthNetworkYaml, @@ -57526,6 +57565,9 @@ var _bintree = &bintree{nil, map[string]*bintree{ "run_tests.sh": {testExtendedTestdataNodeNested_containerRun_testsSh, map[string]*bintree{}}, "skip_tests.sh": {testExtendedTestdataNodeNested_containerSkip_testsSh, map[string]*bintree{}}, }}, + "node_e2e": {nil, map[string]*bintree{ + "pod-dev-fuse.yaml": {testExtendedTestdataNodeNode_e2ePodDevFuseYaml, map[string]*bintree{}}, + }}, }}, "node_tuning": {nil, map[string]*bintree{ "nto-stalld.yaml": {testExtendedTestdataNode_tuningNtoStalldYaml, map[string]*bintree{}}, diff --git a/test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml b/test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml new file mode 100644 index 000000000000..69e1f5b6b3f8 --- /dev/null +++ b/test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Pod +metadata: + name: pod-devfuse + annotations: + io.kubernetes.cri-o.Devices: "/dev/fuse" +spec: + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: pod-devfuse + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: ["sleep", "infinity"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL