Integration: Add a test to validate userns IP restore

dcantah · dcantah · commit 3f9c70c6cbd6 · 2024-07-15T18:34:46.000-07:00
Add a new case to TestContainerdRestartSandboxRecover that will launch
a userns pod if the host and runtime supports it. The new case will just
test that we have networking info in the pod metadata on restart.

Signed-off-by: Danny Canter &lt;danny@dcantah.dev&gt;
diff --git a/integration/restart_linux_test.go b/integration/restart_linux_test.go
@@ -22,17 +22,40 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
 )
 
+func setupUserNSPod(t *testing.T) {
+	supportsUserNs := supportsUserNS() && supportsIDMap(defaultRoot) && supportsRuncIDMap() == nil
+	if !supportsUserNs {
+		t.Log("host or runtime doesn't support userns, skipping pod setup")
+		return
+	}
+
+	t.Log("adding userns pods for containerd restart test")
+
+	containerID := uint32(0)
+	hostID := uint32(65536)
+	size := uint32(65536)
+
+	sOpts := []PodSandboxOpts{WithPodUserNs(containerID, hostID, size)}
+	sbCfg := PodSandboxConfig("sandbox_ready_userns", "sandbox_ready_userns", sOpts...)
+	_, err := runtimeService.RunPodSandbox(sbCfg, *runtimeHandler)
+	assert.NoError(t, err)
+}
+
 func TestContainerdRestartSandboxRecover(t *testing.T) {
 	sbStatuses := map[string]runtime.PodSandboxState{
 		// Sandbox with unknown status will be NotReady when returned from ListPodSandbox
-		"sandbox_unknown":   runtime.PodSandboxState_SANDBOX_NOTREADY,
-		"sandbox_not_ready": runtime.PodSandboxState_SANDBOX_NOTREADY,
-		"sandbox_ready":     runtime.PodSandboxState_SANDBOX_READY,
+		"sandbox_unknown":      runtime.PodSandboxState_SANDBOX_NOTREADY,
+		"sandbox_not_ready":    runtime.PodSandboxState_SANDBOX_NOTREADY,
+		"sandbox_ready":        runtime.PodSandboxState_SANDBOX_READY,
+		"sandbox_ready_userns": runtime.PodSandboxState_SANDBOX_READY,
 	}
 
+	setupUserNSPod(t)
+
 	sbReadyConfig := PodSandboxConfig("sandbox_ready", "sandbox_ready")
 	_, err := runtimeService.RunPodSandbox(sbReadyConfig, *runtimeHandler)
 	assert.NoError(t, err)
@@ -67,6 +90,17 @@ func TestContainerdRestartSandboxRecover(t *testing.T) {
 			foundUnkownSb = true
 		}
 		if status, ok := sbStatuses[sb.Metadata.Name]; ok {
+			// See: https://github.com/containerd/containerd/issues/10363
+			//
+			// Test that sandbox IP is still present after restart.
+			if sb.State == runtime.PodSandboxState_SANDBOX_READY {
+				status, _, err := SandboxInfo(sb.Id)
+				require.NoError(t, err)
+
+				assert.NotNil(t, status.Network)
+				assert.NotEmpty(t, status.Network.Ip)
+			}
+
 			assert.Equal(t, status, sb.State)
 			err = runtimeService.StopPodSandbox(sb.Id)
 			assert.NoError(t, err)
