tests: Add CRI tests for integrity protection of LCOW layers #1193
Conversation
| t, | ||
| []string{imageLcowAlpine}, | ||
| WithSandboxAnnotations(map[string]string{ | ||
| "containerd.io/diff/io.microsoft.storage.lcow.append-dm-verity": "true", |
There was a problem hiding this comment.
yup, that too. added a feature flag to enable local testing at least.
|
I think we should hold off to see if anyone has opinions on the labels vs annotations for the containerd PR, as that would change this slightly. The tests LGTM though so if the ctrd one goes in feel free to check in |
anmaxvl
force-pushed
the
lcow-layer-integrity-tests
branch
from
9d8f078 to
e77c84e
Compare
Add tests that validate that integrity protection is checked when LCOW layers have dm-verity hashes appended. Signed-off-by: Maksim An <[email protected]>
Signed-off-by: Maksim An <[email protected]>
Signed-off-by: Maksim An <[email protected]>
anmaxvl
force-pushed
the
lcow-layer-integrity-tests
branch
from
e77c84e to
e38656e
Compare
|
I think we shouldn't wait for the upstream PR here. The tests are hidden behind a feature flag which is not added to |
|
@dcantah lmk if you have any concerns with merging this. |
|
Sure, I was mainly hesitant on the labels vs annotations discussion. I still don't have a great view of which to use. I'd ping Mike Brown on the PR for his opinion. |
|
If anything it's a one line change depending on what is decided between the two. |
Related work items: microsoft#1067, microsoft#1097, microsoft#1119, microsoft#1170, microsoft#1176, microsoft#1180, microsoft#1181, microsoft#1182, microsoft#1183, microsoft#1184, microsoft#1185, microsoft#1186, microsoft#1187, microsoft#1188, microsoft#1189, microsoft#1191, microsoft#1193, microsoft#1194, microsoft#1195, microsoft#1196, microsoft#1197, microsoft#1200, microsoft#1201, microsoft#1202, microsoft#1203, microsoft#1204, microsoft#1205, microsoft#1206, microsoft#1207, microsoft#1209, microsoft#1210, microsoft#1211, microsoft#1218, microsoft#1219, microsoft#1220, microsoft#1223
3 participants
Add tests that validate that integrity protection is checked when
LCOW layers have dm-verity hashes appended.
Depends on:
Signed-off-by: Maksim An [email protected]