chore(e2e-next): Migrate e2e_rootless to e2e-next framework

e2e-next/clusters/clusters.go

@@ -99,6 +99,24 @@ var (
 	)
 )
 
+var (
+	//go:embed vcluster-rootless.yaml
+	RootlessVClusterYAMLTemplate                      string
+	RootlessVClusterName                              = "rootless-test-vcluster"
+	RootlessVClusterYAML, RootlessVClusterYAMLCleanup = template.MustRender(
+		RootlessVClusterYAMLTemplate,
+		DefaultVClusterVars,
+	)
+	RootlessVCluster = vcluster.Define(
+		vcluster.WithName(RootlessVClusterName),
+		vcluster.WithVClusterYAML(RootlessVClusterYAML),
+		vcluster.WithOptions(
+			DefaultVClusterOptions...,
+		),
+		vcluster.WithDependencies(HostCluster),
+	)
+)
+
 var (
 	//go:embed vcluster-servicesync.yaml
 	ServiceSyncVClusterYAMLTemplate                         string

e2e-next/clusters/vcluster-rootless.yaml

@@ -0,0 +1,19 @@
+controlPlane:
+  statefulSet:
+    image:
+      registry: ""
+      repository: {{ .Repository }}
+      tag: {{ .Tag }}
+    security:
+      podSecurityContext:
+        fsGroup: 12345
+      containerSecurityContext:
+        runAsUser: 12345
+        runAsNonRoot: true
+  backingStore:
+    etcd:
+      deploy:
+        statefulSet:
+          security:
+            podSecurityContext:
+              fsGroup: 12345

e2e-next/e2e_suite_test.go

@@ -27,6 +27,7 @@ import (
 	_ "github.com/loft-sh/vcluster/e2e-next/test_core/sync"
 	_ "github.com/loft-sh/vcluster/e2e-next/test_core/sync/fromhost"
 	_ "github.com/loft-sh/vcluster/e2e-next/test_deploy"
+	_ "github.com/loft-sh/vcluster/e2e-next/test_security/rootless"
 )
 
 var (
@@ -89,6 +90,7 @@ var _ = SynchronizedBeforeSuite(
 		DeferCleanup(clusters.InitManifestsVClusterYAMLCleanup)
 		DeferCleanup(clusters.ServiceSyncVClusterYAMLCleanup)
 		DeferCleanup(clusters.FromHostConfigMapsVClusterYAMLCleanup)
+		DeferCleanup(clusters.RootlessVClusterYAMLCleanup)
 
 		ctx, err = setup.All(
 			clusters.HostCluster.Setup,
@@ -110,6 +112,7 @@ var _ = SynchronizedBeforeSuite(
 						clusters.InitManifestsVCluster.Setup,
 						clusters.ServiceSyncVCluster.Setup,
 						clusters.FromHostConfigMapsVCluster.Setup,
+						clusters.RootlessVCluster.Setup,
 					)(ctx)
 					Expect(err).NotTo(HaveOccurred())
 				})

e2e-next/test_security/rootless/rootless.go

@@ -0,0 +1,64 @@
+package rootless
+
+import (
+	"context"
+	"strings"
+
+	"github.com/loft-sh/e2e-framework/pkg/setup/cluster"
+	"github.com/loft-sh/vcluster/e2e-next/clusters"
+	"github.com/loft-sh/vcluster/e2e-next/constants"
+	"github.com/loft-sh/vcluster/e2e-next/labels"
+	"github.com/loft-sh/vcluster/pkg/util/podhelper"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+var _ = Describe("Rootless mode",
+	labels.Security,
+	cluster.Use(clusters.RootlessVCluster),
+	cluster.Use(clusters.HostCluster),
+	func() {
+		var (
+			hostClient        kubernetes.Interface
+			hostRestConfig    *rest.Config
+			vClusterNamespace = "vcluster-" + clusters.RootlessVClusterName
+		)
+
+		BeforeEach(func(ctx context.Context) {
+			hostClient = cluster.KubeClientFrom(ctx, constants.GetHostClusterName())
+			Expect(hostClient).NotTo(BeNil())
+			hostRestConfig = cluster.From(ctx, constants.GetHostClusterName()).KubernetesRestConfig()
+			Expect(hostRestConfig).NotTo(BeNil())
+		})
+
+		It("verifies the syncer container runs as non-root user", func(ctx context.Context) {
+			By("Listing vcluster pods in the rootless vcluster namespace", func() {
+				pods, err := hostClient.CoreV1().Pods(vClusterNamespace).List(ctx, metav1.ListOptions{
+					LabelSelector: "app=vcluster",
+				})
+				Expect(err).NotTo(HaveOccurred())
+				Expect(pods.Items).NotTo(BeEmpty(), "expected at least one vcluster pod")
+
+				By("Executing id -u in the syncer container", func() {
+					vclusterPod := pods.Items[0].Name
+					cmd := []string{"/bin/sh", "-c", "id -u"}
+					stdout, stderr, err := podhelper.ExecBuffered(
+						ctx,
+						hostRestConfig,
+						vClusterNamespace,
+						vclusterPod,
+						"syncer",
+						cmd,
+						nil,
+					)
+					Expect(err).NotTo(HaveOccurred())
+					Expect(stderr).To(BeEmpty(), "expected no stderr output")
+					Expect(strings.TrimSpace(string(stdout))).To(Equal("12345"), "expected syncer to run as UID 12345")
+				})
+			})
+		})
+	},
+)

test/e2e_rootless/e2e_rootless_mode_suite_test.go

@@ -25,7 +25,6 @@ import (
 	_ "github.com/loft-sh/vcluster/test/e2e/syncer/pvc"
 	_ "github.com/loft-sh/vcluster/test/e2e/syncer/services"
 	_ "github.com/loft-sh/vcluster/test/e2e/webhook"
-	_ "github.com/loft-sh/vcluster/test/e2e_rootless/rootless"
 )
 
 // TestRunE2ERootLessModeTests checks configuration parameters (specified through flags) and then runs