Add integration tests for containerd.selinuxEnabled

Add two integration tests that exercise spec.containerd.selinuxEnabled:
one AWS cluster (containerd-selinux) and one GCE cluster
(minimal_gce_selinux). They assert that enabling SELinux renders
seLinuxMount: true on the CSIDriver and adds the extra host mounts the
node CSI driver needs (/etc/selinux and, on AWS, /sys/fs).

Author: jsafrane

cmd/kops/integration_test.go

@@ -190,6 +190,15 @@ func TestMinimalGCE(t *testing.T) {
 		runTestTerraformGCE(t)
 }
 
+// TestMinimalGCESELinux runs a minimal GCE cluster with
+// spec.containerd.selinuxEnabled, which enables SELinux mount support in the
+// GCP PD CSI driver: the CSIDriver gets seLinuxMount: true and the node driver
+// pod gets the extra /etc/selinux host mount it needs.
+func TestMinimalGCESELinux(t *testing.T) {
+	newIntegrationTest("minimal-gce.example.com", "minimal_gce_selinux").
+		runTestTerraformGCE(t)
+}
+
 // TestMinimalGCEPrivate runs tests on a minimal GCE configuration with private topology.
 func TestMinimalGCEPrivate(t *testing.T) {
 	newIntegrationTest("minimal-gce-private.example.com", "minimal_gce_private").
@@ -569,6 +578,15 @@ func TestContainerdCustom(t *testing.T) {
 		runTestTerraformAWS(t)
 }
 
+// TestContainerdSELinux runs the test on a containerd configuration with
+// spec.containerd.selinuxEnabled, which enables SELinux mount support in the
+// AWS EBS CSI driver: the CSIDriver gets seLinuxMount: true and the node driver
+// pod gets the extra host mounts (/etc/selinux, /sys/fs) it needs.
+func TestContainerdSELinux(t *testing.T) {
+	newIntegrationTest("containerd.example.com", "containerd-selinux").
+		runTestTerraformAWS(t)
+}
+
 // TestAPIServerNodes runs a simple configuration with dedicated apiserver nodes
 func TestAPIServerNodes(t *testing.T) {
 	featureflag.ParseFlags("+APIServerNodes")

tests/integration/update_cluster/containerd-selinux/assets.yaml

@@ -0,0 +1,90 @@
+files:
+- canonical: https://artifacts.k8s.io/binaries/cloud-provider-aws/v1.37.0/linux/amd64/ecr-credential-provider-linux-amd64
+  download: https://artifacts.k8s.io/binaries/cloud-provider-aws/v1.37.0/linux/amd64/ecr-credential-provider-linux-amd64
+  sha: 842e0fd8159f5ed8df2f38e6521e1e4f0a1ee80cf1e1ac119bbf20bf9c20681c
+- canonical: https://artifacts.k8s.io/binaries/cloud-provider-aws/v1.37.0/linux/arm64/ecr-credential-provider-linux-arm64
+  download: https://artifacts.k8s.io/binaries/cloud-provider-aws/v1.37.0/linux/arm64/ecr-credential-provider-linux-arm64
+  sha: dd4748d167b0167cd4a66779dbbe4964e17a29a076aaa3d2b63cfc36ae84b52c
+- canonical: https://artifacts.k8s.io/binaries/kops/1.37.0-beta.1/linux/amd64/nodeup.xz
+  download: https://artifacts.k8s.io/binaries/kops/1.37.0-beta.1/linux/amd64/nodeup.xz
+  sha: a899417ddb4fa0bba91c07c8d10b10747088a1067ca3dfa83097c1720eeda9ea
+- canonical: https://artifacts.k8s.io/binaries/kops/1.37.0-beta.1/linux/arm64/nodeup.xz
+  download: https://artifacts.k8s.io/binaries/kops/1.37.0-beta.1/linux/arm64/nodeup.xz
+  sha: c2e424da38473c3ee1b9309e84e4167857fe8c01ea0df0328f49f6472aebac0e
+- canonical: https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl
+  download: https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl
+  sha: 646d58f6d98ee670a71d9cdffbf6625aeea2849d567f214bc43a35f8ccb7bf70
+- canonical: https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubelet
+  download: https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubelet
+  sha: 5ad4965598773d56a37a8e8429c3dc3d86b4c5c26d8417ab333ae345c053dae2
+- canonical: https://dl.k8s.io/release/v1.32.0/bin/linux/arm64/kubectl
+  download: https://dl.k8s.io/release/v1.32.0/bin/linux/arm64/kubectl
+  sha: ba4004f98f3d3a7b7d2954ff0a424caa2c2b06b78c17b1dccf2acc76a311a896
+- canonical: https://dl.k8s.io/release/v1.32.0/bin/linux/arm64/kubelet
+  download: https://dl.k8s.io/release/v1.32.0/bin/linux/arm64/kubelet
+  sha: bda9b2324c96693b38c41ecea051bab4c7c434be5683050b5e19025b50dbc0bf
+- canonical: https://github.com/containerd/containerd/releases/download/v2.3.4/containerd-2.3.4-linux-amd64.tar.gz
+  download: https://github.com/containerd/containerd/releases/download/v2.3.4/containerd-2.3.4-linux-amd64.tar.gz
+  sha: 9d68969855fbf676cdb8ed758e420fb048d61f984f61de3e53eddfebe484d168
+- canonical: https://github.com/containerd/containerd/releases/download/v2.3.4/containerd-2.3.4-linux-arm64.tar.gz
+  download: https://github.com/containerd/containerd/releases/download/v2.3.4/containerd-2.3.4-linux-arm64.tar.gz
+  sha: a985fbb7e18fc0362d31a055338f5d7b0e087a3e27f14c70d1c5965399a29f95
+- canonical: https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-amd64-v1.6.2.tgz
+  download: https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-amd64-v1.6.2.tgz
+  sha: b8e811578fb66023f90d2e238d80cec3bdfca4b44049af74c374d4fae0f9c090
+- canonical: https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-arm64-v1.6.2.tgz
+  download: https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-arm64-v1.6.2.tgz
+  sha: 01e0e22acc7f7004e4588c1fe1871cc86d7ab562cd858e1761c4641d89ebfaa4
+- canonical: https://github.com/opencontainers/runc/releases/download/v1.4.3/runc.amd64
+  download: https://github.com/opencontainers/runc/releases/download/v1.4.3/runc.amd64
+  sha: f6ae8efc0fa40079e1475e97cbe9d1bd3f106a28d6af78a11d9f1bd565515e60
+- canonical: https://github.com/opencontainers/runc/releases/download/v1.4.3/runc.arm64
+  download: https://github.com/opencontainers/runc/releases/download/v1.4.3/runc.arm64
+  sha: 633301e2e32f8a5ad54031aab4901eb00308bec677dd15faa2751e8f9dab5ca4
+images:
+- canonical: public.ecr.aws/aws-ec2/aws-node-termination-handler:v1.25.5
+  download: public.ecr.aws/aws-ec2/aws-node-termination-handler:v1.25.5
+- canonical: registry.k8s.io/coredns/coredns:v1.14.2
+  download: registry.k8s.io/coredns/coredns:v1.14.2
+- canonical: registry.k8s.io/cpa/cluster-proportional-autoscaler:v1.9.0
+  download: registry.k8s.io/cpa/cluster-proportional-autoscaler:v1.9.0
+- canonical: registry.k8s.io/etcd-manager/etcd-manager-slim:v3.0.20260707
+  download: registry.k8s.io/etcd-manager/etcd-manager-slim:v3.0.20260707
+- canonical: registry.k8s.io/etcd:v3.5.31
+  download: registry.k8s.io/etcd:v3.5.31
+- canonical: registry.k8s.io/etcd:v3.6.12
+  download: registry.k8s.io/etcd:v3.6.12
+- canonical: registry.k8s.io/etcd:v3.7.0
+  download: registry.k8s.io/etcd:v3.7.0
+- canonical: registry.k8s.io/kops/channels:1.37.0-beta.1
+  download: registry.k8s.io/kops/channels:1.37.0-beta.1
+- canonical: registry.k8s.io/kops/dns-controller:1.37.0-beta.1
+  download: registry.k8s.io/kops/dns-controller:1.37.0-beta.1
+- canonical: registry.k8s.io/kops/kops-controller:1.37.0-beta.1
+  download: registry.k8s.io/kops/kops-controller:1.37.0-beta.1
+- canonical: registry.k8s.io/kops/kube-apiserver-healthcheck:1.37.0-beta.1
+  download: registry.k8s.io/kops/kube-apiserver-healthcheck:1.37.0-beta.1
+- canonical: registry.k8s.io/kube-apiserver:v1.32.0
+  download: registry.k8s.io/kube-apiserver:v1.32.0
+- canonical: registry.k8s.io/kube-controller-manager:v1.32.0
+  download: registry.k8s.io/kube-controller-manager:v1.32.0
+- canonical: registry.k8s.io/kube-proxy:v1.32.0
+  download: registry.k8s.io/kube-proxy:v1.32.0
+- canonical: registry.k8s.io/kube-scheduler:v1.32.0
+  download: registry.k8s.io/kube-scheduler:v1.32.0
+- canonical: registry.k8s.io/pause:3.10.1
+  download: registry.k8s.io/pause:3.10.1
+- canonical: registry.k8s.io/provider-aws/aws-ebs-csi-driver:v1.65.0
+  download: registry.k8s.io/provider-aws/aws-ebs-csi-driver:v1.65.0
+- canonical: registry.k8s.io/provider-aws/cloud-controller-manager:v1.37.0
+  download: registry.k8s.io/provider-aws/cloud-controller-manager:v1.37.0
+- canonical: registry.k8s.io/sig-storage/csi-attacher:v4.12.0
+  download: registry.k8s.io/sig-storage/csi-attacher:v4.12.0
+- canonical: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0
+  download: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0
+- canonical: registry.k8s.io/sig-storage/csi-provisioner:v6.3.0
+  download: registry.k8s.io/sig-storage/csi-provisioner:v6.3.0
+- canonical: registry.k8s.io/sig-storage/csi-resizer:v2.2.1
+  download: registry.k8s.io/sig-storage/csi-resizer:v2.2.1
+- canonical: registry.k8s.io/sig-storage/livenessprobe:v2.19.0
+  download: registry.k8s.io/sig-storage/livenessprobe:v2.19.0

tests/integration/update_cluster/containerd-selinux/data/aws_cloudwatch_event_rule_containerd.example.com-ASGLifecycle_event_pattern

@@ -0,0 +1 @@
+{"source":["aws.autoscaling"],"detail-type":["EC2 Instance-terminate Lifecycle Action"]}

tests/integration/update_cluster/containerd-selinux/data/aws_cloudwatch_event_rule_containerd.example.com-InstanceScheduledChange_event_pattern

@@ -0,0 +1 @@
+{"source": ["aws.health"],"detail-type": ["AWS Health Event"],"detail": {"service": ["EC2"],"eventTypeCategory": ["scheduledChange"]}}

tests/integration/update_cluster/containerd-selinux/data/aws_cloudwatch_event_rule_containerd.example.com-InstanceStateChange_event_pattern

@@ -0,0 +1 @@
+{"source": ["aws.ec2"],"detail-type": ["EC2 Instance State-change Notification"]}

tests/integration/update_cluster/containerd-selinux/data/aws_cloudwatch_event_rule_containerd.example.com-SpotInterruption_event_pattern

@@ -0,0 +1 @@
+{"source": ["aws.ec2"],"detail-type": ["EC2 Spot Instance Interruption Warning"]}

tests/integration/update_cluster/containerd-selinux/data/aws_iam_role_masters.containerd.example.com_policy

@@ -0,0 +1,10 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "ec2.amazonaws.com"},
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}

tests/integration/update_cluster/containerd-selinux/data/aws_iam_role_nodes.containerd.example.com_policy

@@ -0,0 +1,10 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "ec2.amazonaws.com"},
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}