From 84be8353160d29b810929467cd515f53e18ec708 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Tue, 31 Mar 2026 10:07:02 -0400 Subject: [PATCH] Deflake TestPodSubresourceAuth by waiting for effective permissions before testing --- test/integration/apiserver/subresource_auth_test.go | 8 ++++++++ test/integration/authutil/authutil.go | 1 + 2 files changed, 9 insertions(+) diff --git a/test/integration/apiserver/subresource_auth_test.go b/test/integration/apiserver/subresource_auth_test.go index 285343bfb6f..4f8586d7174 100644 --- a/test/integration/apiserver/subresource_auth_test.go +++ b/test/integration/apiserver/subresource_auth_test.go @@ -25,9 +25,12 @@ import ( rbacv1 "k8s.io/api/rbac/v1" "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/apimachinery/pkg/util/wait" "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" "k8s.io/kubernetes/cmd/kube-apiserver/app/options" + "k8s.io/kubernetes/test/integration/authutil" "k8s.io/kubernetes/test/integration/framework" "k8s.io/kubernetes/test/utils/ktesting" ) @@ -140,6 +143,11 @@ func TestPodSubresourceAuth(t *testing.T) { t.Fatal(err) } + // Wait for the permissions to become effective by ensuring a create request is allowed + waitContext, cancel := context.WithTimeout(context.TODO(), wait.ForeverTestTimeout) + defer cancel() + authutil.WaitForNamedAuthorizationUpdate(t, waitContext, adminClientset.AuthorizationV1(), podCreatorUsername, ns, "create", "", schema.GroupResource{Group: "", Resource: "pods/exec"}, true) + subresources := []string{"exec", "attach", "portforward"} for _, subresource := range subresources { t.Run(fmt.Sprintf("subresource=%s", subresource), func(t *testing.T) { diff --git a/test/integration/authutil/authutil.go b/test/integration/authutil/authutil.go index 6bd169e86a7..56353de2d7b 100644 --- a/test/integration/authutil/authutil.go +++ b/test/integration/authutil/authutil.go @@ -62,6 +62,7 @@ func WaitForNamedAuthorizationUpdate(t *testing.T, ctx context.Context, c author } return true, nil }); err != nil { + t.Logf("did not see expected allowed response %v for user=%s,namespace=%s,verb=%s,resourceName=%s,resource=%v", allowed, user, namespace, verb, resourceName, resource) t.Fatal(err) } }