From cf1db1645019861a18054c53911081284febf10c Mon Sep 17 00:00:00 2001
From: Dan Winship <danwinship@redhat.com>
Date: Thu, 19 Feb 2026 06:58:49 -0500
Subject: [PATCH] Fix the NodeAuthenticator e2e tests

The tests were accidentally shadowing the nodeIPs variable, resulting
in them being no-ops.

Noticed while trying to fix them to only act on a single node IP
anyway, because there's no guarantee that kubelet is listening on
every reported node IP.
---
 test/e2e/auth/node_authn.go | 35 ++++++++++++++++-------------------
 1 file changed, 16 insertions(+), 19 deletions(-)

diff --git a/test/e2e/auth/node_authn.go b/test/e2e/auth/node_authn.go
index 9633ae4251c..c561d79a7ae 100644
--- a/test/e2e/auth/node_authn.go
+++ b/test/e2e/auth/node_authn.go
@@ -39,7 +39,7 @@ var _ = SIGDescribe("NodeAuthenticator", func() {
 	f := framework.NewDefaultFramework("node-authn")
 	f.NamespacePodSecurityLevel = admissionapi.LevelBaseline
 	var ns string
-	var nodeIPs []string
+	var nodeIP string
 	ginkgo.BeforeEach(func(ctx context.Context) {
 		ns = f.Namespace.Name
 
@@ -51,33 +51,30 @@ var _ = SIGDescribe("NodeAuthenticator", func() {
 			family = v1.IPv6Protocol
 		}
 
-		nodeIPs := e2enode.GetAddressesByTypeAndFamily(&nodes.Items[0], v1.NodeInternalIP, family)
-		gomega.Expect(nodeIPs).NotTo(gomega.BeEmpty())
+		nodeIP = e2enode.FirstAddressByTypeAndFamily(nodes, v1.NodeInternalIP, family)
+		gomega.Expect(nodeIP).NotTo(gomega.BeEmpty())
 	})
 
 	ginkgo.It("The kubelet's main port 10250 should reject requests with no credentials", func(ctx context.Context) {
 		pod := createNodeAuthTestPod(ctx, f)
-		for _, nodeIP := range nodeIPs {
-			// Anonymous authentication is disabled by default
-			host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
-			result := e2eoutput.RunHostCmdOrDie(ns, pod.Name, fmt.Sprintf("curl -sIk -o /dev/null -w '%s' https://%s/metrics", "%{http_code}", host))
-			gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet's main port 10250 should reject requests with no credentials")
-		}
+
+		// Anonymous authentication is disabled by default
+		host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
+		result := e2eoutput.RunHostCmdOrDie(ns, pod.Name, fmt.Sprintf("curl -sIk -o /dev/null -w '%s' https://%s/metrics", "%{http_code}", host))
+		gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet's main port 10250 should reject requests with no credentials")
 	})
 
 	ginkgo.It("The kubelet can delegate ServiceAccount tokens to the API server", func(ctx context.Context) {
 		pod := createNodeAuthTestPod(ctx, f)
 
-		for _, nodeIP := range nodeIPs {
-			host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
-			result := e2eoutput.RunHostCmdOrDie(ns,
-				pod.Name,
-				fmt.Sprintf("curl -sIk -o /dev/null -w '%s' --header \"Authorization: Bearer `%s`\" https://%s/metrics",
-					"%{http_code}",
-					"cat /var/run/secrets/kubernetes.io/serviceaccount/token",
-					host))
-			gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet can delegate ServiceAccount tokens to the API server")
-		}
+		host := net.JoinHostPort(nodeIP, strconv.Itoa(ports.KubeletPort))
+		result := e2eoutput.RunHostCmdOrDie(ns,
+			pod.Name,
+			fmt.Sprintf("curl -sIk -o /dev/null -w '%s' --header \"Authorization: Bearer `%s`\" https://%s/metrics",
+				"%{http_code}",
+				"cat /var/run/secrets/kubernetes.io/serviceaccount/token",
+				host))
+		gomega.Expect(result).To(gomega.Or(gomega.Equal("401"), gomega.Equal("403")), "the kubelet can delegate ServiceAccount tokens to the API server")
 	})
 })