Integration tests with reduced privileges

[corneliusweig]

Currently, integration tests always run with a user who has unconstrained privileges. This misses bugs that only manifest when a user has constrained privileges -- however enough privileges to reasonably expect a Skaffold run to succeed.

For example, #2495 describes a problem which only manifests when a user cannot list deployments at cluster scope.

It would be good to have some integration tests run with a reduced set of privileges, to catch these kind of issues early.

---

A reasonable restriction would be edit rights in a single namespace. This can be set up via [1]

kubectl config set-context reduced-privileges-context --user skaffold-test-user --cluster (..)

and define a RoleBinding in namespace tbd which references the default edit ClusterRole:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: skaffold-test-user
     namespace: tbd
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: edit
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
     name: default-user
     namespace: default

This new reduced-privileges-context can then be enabled with the new --kube-context flag.

Depends on #2447

[1]: probably incomplete instructions

[tstromberg]

@nkubala @balopat - Is there documentation on how the existing integration tests work? I google'd for skaffold integration tests but came up short.

I wouldn't mind trying to take this on as a lower-priority item.

[nkubala]

@tstromberg the best we have is https://github.com/GoogleContainerTools/skaffold/blob/master/DEVELOPMENT.md#integration-tests. it's definitely not a full guide though. if you do decide to go after this one, those docs could use a little love based on what you find :)

[nkubala]

closing due to inactivity.