github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-19 09:52:49 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #132862 from mimowo/automated-cherry-pick-of-#132502-upstream-release-1.31

Browse Source 
Automated cherry pick of #132502: Fix flake caused by invalid detection of active policies in VAP integration tests
This commit is contained in:
Kubernetes Prow Robot 2025-07-11 13:35:28 -07:00 committed by GitHub
commit 2d515779bd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
test/integration/apiserver/cel/validatingadmissionpolicy_test.go
View File

@ -64,6 +64,8 @@ import (
authorizationv1 "k8s.io/api/authorization/v1"
v1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
utilrand "k8s.io/apimachinery/pkg/util/rand"
utilvalidation "k8s.io/apimachinery/pkg/util/validation"
)
// Test_ValidateNamespace_NoParams tests a ValidatingAdmissionPolicy that validates creation of a Namespace with no params.
@ -2870,8 +2872,17 @@ func serviceAccountClient(namespace, name string) clientFn {
func withWaitReadyConstraintAndExpression(policy *admissionregistrationv1.ValidatingAdmissionPolicy) *admissionregistrationv1.ValidatingAdmissionPolicy {
policy = policy.DeepCopy()
testMarkerName := fmt.Sprintf("test-marker-%s", utilrand.String(utilvalidation.DNS1123SubdomainMaxLength-len("test-marker-")))
annotations := policy.GetAnnotations()
if annotations == nil {
annotations = make(map[string]string)
}
annotations["test-marker-name"] = testMarkerName
policy.SetAnnotations(annotations)
policy.Spec.MatchConstraints.ResourceRules = append(policy.Spec.MatchConstraints.ResourceRules, admissionregistrationv1.NamedRuleWithOperations{
ResourceNames: []string{"test-marker"},
ResourceNames: []string{testMarkerName},
RuleWithOperations: admissionregistrationv1.RuleWithOperations{
Operations: []admissionregistrationv1.OperationType{
"UPDATE",
@ -2890,7 +2901,7 @@ func withWaitReadyConstraintAndExpression(policy *admissionregistrationv1.Valida
},
})
policy.Spec.Validations = append([]admissionregistrationv1.Validation{{
Expression: "object.metadata.name != 'test-marker'",
Expression: fmt.Sprintf("object.metadata.name != '%s'", testMarkerName),
Message: "marker denied; policy is ready",
}}, policy.Spec.Validations...)
return policy
@ -2905,14 +2916,23 @@ func createAndWaitReadyNamespaced(t *testing.T, client clientset.Interface, bind
}
func createAndWaitReadyNamespacedWithWarnHandler(t *testing.T, client clientset.Interface, binding *admissionregistrationv1.ValidatingAdmissionPolicyBinding, matchLabels map[string]string, ns string, handler *warningHandler) error {
marker := &v1.Endpoints{ObjectMeta: metav1.ObjectMeta{Name: "test-marker", Namespace: ns, Labels: matchLabels}}
policy, err := client.AdmissionregistrationV1().ValidatingAdmissionPolicies().Get(context.TODO(), binding.Spec.PolicyName, metav1.GetOptions{})
if err != nil {
t.Fatal(err)
}
testMarkerName := "test-marker"
if testMarkerNameAnnotation, ok := policy.GetAnnotations()["test-marker-name"]; ok {
testMarkerName = testMarkerNameAnnotation
}
marker := &v1.Endpoints{ObjectMeta: metav1.ObjectMeta{Name: testMarkerName, Namespace: ns, Labels: matchLabels}}
defer func() {
err := client.CoreV1().Endpoints(ns).Delete(context.TODO(), marker.Name, metav1.DeleteOptions{})
if err != nil {
t.Logf("error deleting marker: %v", err)
}
}()
marker, err := client.CoreV1().Endpoints(ns).Create(context.TODO(), marker, metav1.CreateOptions{})
marker, err = client.CoreV1().Endpoints(ns).Create(context.TODO(), marker, metav1.CreateOptions{})
if err != nil {
return err
}