github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 13:57:38 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #137129 from danwinship/node-authn-fix

Browse Source 
Fix the NodeAuthenticator e2e tests to not be no-ops
This commit is contained in:
Kubernetes Prow Robot
2026-02-20 00:57:50 +05:30
committed by GitHub
parent 8812ec563c cf1db16450
commit ca40b5ba19
1 changed files with 16 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
test/e2e/auth/node_authn.go
View File

@@ -39,7 +39,7 @@ var _ = SIGDescribe("NodeAuthenticator", func() {
f := framework.NewDefaultFramework("node-authn")
f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
var ns string
var nodeIPs []string
var nodeIP string
ginkgo.BeforeEach(func(ctx context.Context) {
ns = f.Namespace.Name
@@ -51,33 +51,30 @@ var _ = SIGDescribe("NodeAuthenticator", func() {
family = v1.IPv6Protocol
}
nodeIPs := e2enode.GetAddressesByTypeAndFamily(&nodes.Items[0], v1.NodeInternalIP, family)
gomega.Expect(nodeIPs).NotTo(gomega.BeEmpty())
nodeIP = e2enode.FirstAddressByTypeAndFamily(nodes, v1.NodeInternalIP, family)
gomega.Expect(nodeIP).NotTo(gomega.BeEmpty())
})
ginkgo.It("The kubelet's main port 10250 should reject requests with no credentials", func(ctx context.Context) {
pod := createNodeAuthTestPod(ctx, f)
for _, nodeIP := range nodeIPs {
// Anonymous authentication is disabled by default
host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
result := e2eoutput.RunHostCmdOrDie(ns, pod.Name, fmt.Sprintf("curl -sIk -o /dev/null -w '%s' https://%s/metrics", "%{http_code}", host))
gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet's main port 10250 should reject requests with no credentials")
}
// Anonymous authentication is disabled by default
host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
result := e2eoutput.RunHostCmdOrDie(ns, pod.Name, fmt.Sprintf("curl -sIk -o /dev/null -w '%s' https://%s/metrics", "%{http_code}", host))
gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet's main port 10250 should reject requests with no credentials")
})
ginkgo.It("The kubelet can delegate ServiceAccount tokens to the API server", func(ctx context.Context) {
pod := createNodeAuthTestPod(ctx, f)
for _, nodeIP := range nodeIPs {
host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
result := e2eoutput.RunHostCmdOrDie(ns,
pod.Name,
fmt.Sprintf("curl -sIk -o /dev/null -w '%s' --header \"Authorization: Bearer `%s`\" https://%s/metrics",
"%{http_code}",
"cat /var/run/secrets/kubernetes.io/serviceaccount/token",
host))
gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet can delegate ServiceAccount tokens to the API server")
}
host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
result := e2eoutput.RunHostCmdOrDie(ns,
pod.Name,
fmt.Sprintf("curl -sIk -o /dev/null -w '%s' --header \"Authorization: Bearer `%s`\" https://%s/metrics",
"%{http_code}",
"cat /var/run/secrets/kubernetes.io/serviceaccount/token",
host))
gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet can delegate ServiceAccount tokens to the API server")
})
})