From 3b242193100da3b3d084a5eac0a2937a2e0f029f Mon Sep 17 00:00:00 2001
From: Dan Mihai <dmihai@microsoft.com>
Date: Mon, 30 Sep 2024 18:02:31 +0000
Subject: [PATCH] tests: k8s-policy-rc: remove default UID from YAML

The nginx container seems to error out when using UID=123.

Depending on the timing between container initialization and "kubectl
wait", the test might have gotten lucky and found the pod briefly in
Ready state before nginx errored out. But on some of the nodes, the pod
never got reported as Ready.

Also, don't block in "kubectl wait --for=condition=Ready" when wrapping
that command in a waitForProcess call, because waitForProcess is
designed for short-lived commands.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
---
 tests/common.bash                             |  6 +++++
 .../integration/kubernetes/k8s-policy-rc.bats | 22 ++++++++++++++-----
 .../runtimeclass_workloads/k8s-policy-rc.yaml |  2 --
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/tests/common.bash b/tests/common.bash
index 7374d0942..ca8b59bbf 100644
--- a/tests/common.bash
+++ b/tests/common.bash
@@ -74,6 +74,12 @@ function info() {
 	echo -e "[$(basename $0):${BASH_LINENO[0]}] INFO: $msg"
 }
 
+function bats_unbuffered_info() {
+	local msg="$*"
+	# Ask bats to print this text immediately rather than buffering until the end of a test case.
+	echo -e "[$(basename $0):${BASH_LINENO[0]}] UNBUFFERED: INFO: $msg" >&3
+}
+
 function handle_error() {
 	local exit_code="${?}"
 	local line_number="${1:-}"
diff --git a/tests/integration/kubernetes/k8s-policy-rc.bats b/tests/integration/kubernetes/k8s-policy-rc.bats
index 590d56536..b7928980b 100644
--- a/tests/integration/kubernetes/k8s-policy-rc.bats
+++ b/tests/integration/kubernetes/k8s-policy-rc.bats
@@ -44,6 +44,7 @@ setup() {
 # Common function for all test cases from this bats script.
 test_rc_policy() {
     expect_denied_create_container=$1
+    bats_unbuffered_info "test_rc_policy: denied=${expect_denied_create_container}: starting"
 
     # Create replication controller
     if [ "${expect_denied_create_container}" = "true" ]; then
@@ -54,21 +55,29 @@ test_rc_policy() {
 
     # Check replication controller
     local cmd="kubectl describe rc ${replication_name} | grep replication-controller"
-    info "Waiting for: ${cmd}"
+    bats_unbuffered_info "Waiting for: ${cmd}"
     waitForProcess "$wait_time" "$sleep_time" "$cmd"
 
+    bats_unbuffered_info "Getting number of replicas"
     number_of_replicas=$(kubectl get rc ${replication_name} \
         --output=jsonpath='{.spec.replicas}')
+    bats_unbuffered_info "number_of_replicas=${number_of_replicas}"
     [ "${number_of_replicas}" -gt 0 ]
 
     # Wait for all the expected pods to be created.
+    local pod_creation_sleep="10"
     local count=0
     local launched_pods=()
     while [ $count -lt 6 ] && [ "${#launched_pods[@]}" -ne "${number_of_replicas}" ]; do
-        count=$((count + 1))
-        sleep 10
+        bats_unbuffered_info "sleep count=${count}, launched ${#launched_pods[@]} pods, sleeping ${pod_creation_sleep}..."
+        sleep "${pod_creation_sleep}"
+
+        bats_unbuffered_info "Getting the list of launched pods"
         launched_pods=($(kubectl get pods "--selector=app=${app_name}" \
             --output=jsonpath={.items..metadata.name}))
+        bats_unbuffered_info "Launched ${#launched_pods[@]} pods: ${launched_pods}"
+
+        count=$((count + 1))
     done
 
     # Check that the number of pods created for the replication controller
@@ -78,13 +87,16 @@ test_rc_policy() {
     # Check pod creation
     for pod_name in ${launched_pods[@]}; do
         if [ "${expect_denied_create_container}" = "true" ]; then
+            bats_unbuffered_info "Waiting for blocked pod: ${pod_name}"
             wait_for_blocked_request "CreateContainerRequest" "${pod_name}"
         else
-            cmd="kubectl wait --for=condition=Ready --timeout=${timeout} pod ${pod_name}"
-            info "Waiting for: ${cmd}"
+            cmd="kubectl wait --for=condition=Ready --timeout=0s pod ${pod_name}"
+            bats_unbuffered_info "Waiting for: ${cmd}"
             waitForProcess "${wait_time}" "${sleep_time}" "${cmd}"
         fi
     done
+
+    bats_unbuffered_info "test_rc_policy: denied=${expect_denied_create_container}: success"
 }
 
 @test "Successful replication controller with auto-generated policy" {
diff --git a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml
index 62bcdebcd..52c39ae31 100644
--- a/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml
+++ b/tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml
@@ -17,8 +17,6 @@ spec:
       labels:
         app: policy-nginx-rc
     spec:
-      securityContext:
-        runAsUser: 123
       terminationGracePeriodSeconds: 0
       runtimeClassName: kata
       containers: