pkg: validate: validate Username not empty in ImageStatus

Kubernetes rely on that Username field to provide RunAsUser, we need to
validate runtimes correctly return it. We had recently an issue in
CRI-O for that.

Signed-off-by: Antonio Murdaca <[email protected]>

images/image-user/Dockerfile

@@ -0,0 +1,17 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM busybox
+ARG USER
+USER ${USER}

images/image-user/Makefile

@@ -0,0 +1,24 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+.PHONY: all test-image-user-list
+
+all: test-image-user-list
+
+TEST_USER = 1002 www-data 1003:users www-data:100
+NLIST = $(shell for x in {1..$(words $(TEST_USER))}; do echo $$x; done)
+IMAGES_LIST = test-image-user-uid test-image-user-username test-image-user-uid-group test-image-user-username-group
+test-image-user-list:
+	$(foreach x,$(NLIST),docker build . -t gcr.io/cri-tools/$(word $(x),$(IMAGES_LIST)) --build-arg USER=$(word $(x),$(TEST_USER));)
+	$(foreach x,$(NLIST),gcloud docker -- push gcr.io/cri-tools/$(word $(x),$(IMAGES_LIST));)

pkg/validate/image.go

@@ -66,6 +66,18 @@ var _ = framework.KubeDescribe("Image Manager", func() {
 		})
 	})
 
+	It("image status get image fields should not have Uid empty [Conformance]", func() {
+		// runcom/imageuser has been built with a dockerfile having USER 1002
+		// we test that that user is returned in image status
+		framework.PullPublicImage(c, "runcom/imageuser")
+
+		defer removeImage(c, "runcom/imageuser")
+
+		status := framework.ImageStatus(c, "runcom/imageuser")
+		Expect(status.GetUid()).NotTo(BeNil(), "Image Uid should not be empty")
+		Expect(status.GetUid().GetValue()).To(Equal(int64(1002)), "Image Uid should be 1002")
+	})
+
 	It("listImage should get exactly 3 image in the result list [Conformance]", func() {
 		// different tags refer to different images
 		testImageList := []string{