From 0cd2976cabe7838794f6828c7d983bf13537508e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stanislav=20L=C3=A1zni=C4=8Dka?= Date: Wed, 6 Nov 2024 13:13:53 +0100 Subject: [PATCH] integration: ctb: apiserversigner test to use certbeta api --- .../apiserversigner_test.go | 25 ++++++++----------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/test/integration/clustertrustbundles/apiserversigner_test.go b/test/integration/clustertrustbundles/apiserversigner_test.go index 3d1a7918d59..320b800a057 100644 --- a/test/integration/clustertrustbundles/apiserversigner_test.go +++ b/test/integration/clustertrustbundles/apiserversigner_test.go @@ -30,7 +30,7 @@ import ( "testing" "time" - "k8s.io/api/certificates/v1alpha1" + "k8s.io/api/certificates/v1beta1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme" "k8s.io/apimachinery/pkg/runtime/schema" @@ -47,9 +47,6 @@ import ( ) func TestClusterTrustBundlesPublisherController(t *testing.T) { - // KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE allows for APIs pending removal to not block tests - // TODO: Remove this line once certificates v1alpha1 types to be removed in 1.32 are fully removed - t.Setenv("KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE", "true") ctx := ktesting.Init(t) certBytes := mustMakeCertificate(t, &x509.Certificate{ @@ -73,7 +70,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { "--disable-admission-plugins", "ServiceAccount", "--authorization-mode=RBAC", "--feature-gates", "ClusterTrustBundle=true", - fmt.Sprintf("--runtime-config=%s=true", v1alpha1.SchemeGroupVersion), + fmt.Sprintf("--runtime-config=%s=true", v1beta1.SchemeGroupVersion), } storageConfig := framework.SharedEtcd() server := kubeapiservertesting.StartTestServerOrDie(t, nil, apiServerFlags, storageConfig) @@ -108,12 +105,12 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { unrelatedPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: unrelatedSigner}) // set up a signer that's completely unrelated to the controller to check // it's not anyhow handled by it - unrelatedCTB, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx, - &v1alpha1.ClusterTrustBundle{ + unrelatedCTB, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx, + &v1beta1.ClusterTrustBundle{ ObjectMeta: metav1.ObjectMeta{ Name: "test.test:unrelated:0", }, - Spec: v1alpha1.ClusterTrustBundleSpec{ + Spec: v1beta1.ClusterTrustBundleSpec{ SignerName: "test.test/unrelated", TrustBundle: string(unrelatedPEM), }, @@ -127,11 +124,11 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM) t.Log("check that the controller deletes any additional bundles for the same signer") - if _, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx, &v1alpha1.ClusterTrustBundle{ + if _, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx, &v1beta1.ClusterTrustBundle{ ObjectMeta: metav1.ObjectMeta{ Name: "kubernetes.io:kube-apiserver-serving:testname", }, - Spec: v1alpha1.ClusterTrustBundleSpec{ + Spec: v1beta1.ClusterTrustBundleSpec{ SignerName: "kubernetes.io/kube-apiserver-serving", TrustBundle: string(certPEM), }, @@ -152,7 +149,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { }) differentSignerPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: differentSigner}) - ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{ + ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{ FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving", }) if err != nil || len(ctbList.Items) != 1 { @@ -162,13 +159,13 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { ctbToUpdate := ctbList.Items[0].DeepCopy() ctbToUpdate.Spec.TrustBundle = string(differentSignerPEM) - if _, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil { + if _, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil { t.Fatalf("failed to update ctb with new PEM bundle: %v", err) } waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM) - unrelatedCTB, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{}) + unrelatedCTB, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{}) if err != nil { t.Fatalf("failed to get the unrelated CTB back: %v", err) } @@ -184,7 +181,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) { func waitUntilSingleKASSignerCTB(ctx context.Context, t *testing.T, clientSet *clientset.Clientset, caPEM []byte) { err := wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 30*time.Second, true, func(ctx context.Context) (done bool, err error) { - ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{ + ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{ FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving", })