[export tests]: Specify fsGroup so we can write the exported PVC

As non-root out of the box, most storage's won't give us a PVC that is world writeable. Noticed this on OpenShift testing lanes where cephcsi is used instead of the "local" SC that is used in kubevirtci. Ceph stopping chmod 777 reference: ceph/ceph-csi#2697 Signed-off-by: Alex Kalenyuk <[email protected]>
akalenyu · Nov 9, 2022 · 62d5c46 · 62d5c46
1 parent 9d80854
commit 62d5c46
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/tests/storage/export.go b/tests/storage/export.go
@@ -112,6 +112,7 @@ var _ = SIGDescribe("Export", func() {
 	var err error
 	var token *k8sv1.Secret
 	var virtClient kubecli.KubevirtClient
+	var qemuGid = int64(107)
 
 	BeforeEach(func() {
 		virtClient, err = kubecli.GetKubevirtClient()
@@ -174,6 +175,10 @@ var _ = SIGDescribe("Export", func() {
 				},
 			},
 		})
+		if pod.Spec.SecurityContext == nil {
+			pod.Spec.SecurityContext = &k8sv1.PodSecurityContext{}
+		}
+		pod.Spec.SecurityContext.FSGroup = &qemuGid
 
 		volumeMode := pvc.Spec.VolumeMode
 		if volumeMode != nil && *volumeMode == k8sv1.PersistentVolumeBlock {
@@ -186,7 +191,6 @@ var _ = SIGDescribe("Export", func() {
 	}
 
 	createSourcePodChecker := func(pvc *k8sv1.PersistentVolumeClaim) *k8sv1.Pod {
-		nonRootUser := int64(107)
 		volumeName := pvc.GetName()
 		podName := "download-pod"
 		pod := tests.RenderPod(podName, []string{"/bin/sh", "-c", "sleep 360"}, []string{})
@@ -201,7 +205,7 @@ var _ = SIGDescribe("Export", func() {
 		if pod.Spec.SecurityContext == nil {
 			pod.Spec.SecurityContext = &k8sv1.PodSecurityContext{}
 		}
-		pod.Spec.SecurityContext.FSGroup = &nonRootUser
+		pod.Spec.SecurityContext.FSGroup = &qemuGid
 
 		volumeMode := pvc.Spec.VolumeMode
 		if volumeMode != nil && *volumeMode == k8sv1.PersistentVolumeBlock {