Fix tests

knative · Jul 11, 2023 · c8063c3 · c8063c3
1 parent 7f51c74
commit c8063c3
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 5 deletions.
diff --git a/config/core/configmaps/features.yaml b/config/core/configmaps/features.yaml
@@ -40,10 +40,10 @@ data:
     # this example block and unindented to be in the data block
     # to actually change the configuration.
 
-    # Default SecurityContext settings to secure-by-default values
-    # if unset.
-    #
     # Indicates whether secure-pod-defaults support is enabled
+
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: TBD
     secure-pod-defaults: "enabled"
 
     # Indicates whether multi container support is enabled

diff --git a/pkg/apis/config/features.go b/pkg/apis/config/features.go
@@ -71,7 +71,7 @@ func defaultFeaturesConfig() *Features {
 		PodSpecInitContainers:            Disabled,
 		PodSpecDNSPolicy:                 Disabled,
 		PodSpecDNSConfig:                 Disabled,
-		SecurePodDefaults:                Disabled,
+		SecurePodDefaults:                Enabled,
 		TagHeaderBasedRouting:            Disabled,
 		AutoDetectHTTP2:                  Disabled,
 	}

diff --git a/pkg/apis/serving/fieldmask_test.go b/pkg/apis/serving/fieldmask_test.go
@@ -719,7 +719,11 @@ func TestPodSecurityContextMask(t *testing.T) {
 		},
 	}
 
-	want := &corev1.PodSecurityContext{}
+	want := &corev1.PodSecurityContext{
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+	}
 	ctx := context.Background()
 
 	got := PodSecurityContextMask(ctx, in)