test/e2e*: Remove references to UserNamespacesSupport feature gate

It's GA now.

Signed-off-by: Rodrigo Campos <rodrigo@amutable.com>

test/e2e/common/node/security_context.go

@@ -88,7 +88,7 @@ var _ = SIGDescribe("Security Context", func() {
 			}
 		}
 
-		f.It("must create the user namespace if set to false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("must create the user namespace if set to false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			// with hostUsers=false the pod must use a new user namespace
 			podClient := e2epod.PodClientNS(f, f.Namespace.Name)
 
@@ -127,7 +127,7 @@ var _ = SIGDescribe("Security Context", func() {
 		})
 
 		f.It("must create a user namespace and use host network when hostUsers is false and hostNetwork is true [LinuxOnly]", feature.UserNamespacesHostNetworkSupport, framework.WithFeatureGate(features.UserNamespacesHostNetworkSupport),
-			feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+			feature.UserNamespacesSupport, func(ctx context.Context) {
 				// with hostUsers=false the pod must use a new user namespace.
 				// with hostNetwork=true the pod must use the host network namespace.
 				podClient := e2epod.PodClientNS(f, f.Namespace.Name)
@@ -201,7 +201,7 @@ var _ = SIGDescribe("Security Context", func() {
 				gomega.Expect(netNs1).To(gomega.Equal(netNs2), "two different pods with hostNetwork=true should be in the same network namespace, but they are not. NetNS1: %s, NetNS2: %s", netNs1, netNs2)
 			})
 
-		f.It("must create the user namespace in the configured hostUID/hostGID range [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("must create the user namespace in the configured hostUID/hostGID range [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			// We need to check with the binary "getsubuids" the mappings for the kubelet.
 			// If something is not present, we skip the test as the node wasn't configured to run this test.
 			id, length, err := kubeletUsernsMappings(getsubuidsBinary)
@@ -269,7 +269,7 @@ var _ = SIGDescribe("Security Context", func() {
 			}
 		})
 
-		f.It("must not create the user namespace if set to true [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("must not create the user namespace if set to true [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			// with hostUsers=true the pod must use the host user namespace
 			pod := makePod(true)
 			// When running in the host's user namespace, the /proc/self/uid_map file content looks like:
@@ -280,7 +280,7 @@ var _ = SIGDescribe("Security Context", func() {
 			})
 		})
 
-		f.It("should mount all volumes with proper permissions with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("should mount all volumes with proper permissions with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			// Create configmap.
 			name := "userns-volumes-test-" + string(uuid.NewUUID())
 			configMap := newConfigMap(f, name)
@@ -402,7 +402,7 @@ var _ = SIGDescribe("Security Context", func() {
 			})
 		})
 
-		f.It("should set FSGroup to user inside the container with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("should set FSGroup to user inside the container with hostUsers=false [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			// Create configmap.
 			name := "userns-volumes-test-" + string(uuid.NewUUID())
 			configMap := newConfigMap(f, name)
@@ -461,7 +461,7 @@ var _ = SIGDescribe("Security Context", func() {
 				strings.Repeat(fmt.Sprintf("=%v\n", fsGroup), len(configMap.Data)),
 			})
 		})
-		f.It("metrics should report count of started and failed user namespaced pods [LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
+		f.It("metrics should report count of started and failed user namespaced pods [LinuxOnly]", feature.UserNamespacesSupport, func(ctx context.Context) {
 			targetNode, err := findLinuxNode(ctx, f)
 			framework.ExpectNoError(err, "Error finding Linux node")
 			framework.Logf("Using node: %v", targetNode.Name)
@@ -976,32 +976,30 @@ var _ = SIGDescribe("User Namespaces for Restricted Pod Security Standards [Linu
 	f := framework.NewDefaultFramework("user-namespaces-pss-test")
 	f.NamespacePodSecurityLevel = admissionapi.LevelRestricted
 
-	ginkgo.Context("with UserNamespacesSupport enabled", func() {
-		f.It("should allow pod", feature.UserNamespacesSupport, framework.WithFeatureGate(features.UserNamespacesSupport), func(ctx context.Context) {
-			name := "pod-user-namespaces-pss-" + string(uuid.NewUUID())
-			pod := &v1.Pod{
-				ObjectMeta: metav1.ObjectMeta{Name: name},
-				Spec: v1.PodSpec{
-					RestartPolicy:   v1.RestartPolicyNever,
-					HostUsers:       ptr.To(false),
-					SecurityContext: &v1.PodSecurityContext{},
-					Containers: []v1.Container{
-						{
-							Name:    name,
-							Image:   imageutils.GetE2EImage(imageutils.BusyBox),
-							Command: []string{"whoami"},
-							SecurityContext: &v1.SecurityContext{
-								AllowPrivilegeEscalation: ptr.To(false),
-								Capabilities:             &v1.Capabilities{Drop: []v1.Capability{"ALL"}},
-								SeccompProfile:           &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault},
-							},
+	f.It("should allow userns pod", feature.UserNamespacesSupport, func(ctx context.Context) {
+		name := "pod-user-namespaces-pss-" + string(uuid.NewUUID())
+		pod := &v1.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: name},
+			Spec: v1.PodSpec{
+				RestartPolicy:   v1.RestartPolicyNever,
+				HostUsers:       ptr.To(false),
+				SecurityContext: &v1.PodSecurityContext{},
+				Containers: []v1.Container{
+					{
+						Name:    name,
+						Image:   imageutils.GetE2EImage(imageutils.BusyBox),
+						Command: []string{"whoami"},
+						SecurityContext: &v1.SecurityContext{
+							AllowPrivilegeEscalation: ptr.To(false),
+							Capabilities:             &v1.Capabilities{Drop: []v1.Capability{"ALL"}},
+							SeccompProfile:           &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault},
 						},
 					},
 				},
-			}
+			},
+		}
 
-			e2epodoutput.TestContainerOutput(ctx, f, "RunAsUser-RunAsNonRoot", pod, 0, []string{"root"})
-		})
+		e2epodoutput.TestContainerOutput(ctx, f, "RunAsUser-RunAsNonRoot", pod, 0, []string{"root"})
 	})
 })
 

test/e2e_node/user_namespaces_test.go

@@ -27,18 +27,14 @@ import (
 	"os/user"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/onsi/ginkgo/v2"
-	"github.com/onsi/gomega"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/uuid"
-	kubefeatures "k8s.io/kubernetes/pkg/features"
 	kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config"
 	"k8s.io/kubernetes/test/e2e/feature"
 	"k8s.io/kubernetes/test/e2e/framework"
-	e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
 	e2eoutput "k8s.io/kubernetes/test/e2e/framework/pod/output"
 	e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
 	imageutils "k8s.io/kubernetes/test/utils/image"
@@ -52,59 +48,7 @@ var (
 	getsubuidsBinary            = "getsubids"
 )
 
-var _ = SIGDescribe("UserNamespaces", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithSerial(), func() {
-	f := framework.NewDefaultFramework("user-namespace-off-test")
-	f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
-	f.Context("when UserNamespacesSupport=false in the kubelet", func() {
-		// Turn off UserNamespacesSupport for this test
-		// TODO: once the UserNamespacesSupport feature is removed, this test should be removed too
-		tempSetCurrentKubeletConfig(f, func(ctx context.Context, initialConfig *kubeletconfig.KubeletConfiguration) {
-			if initialConfig.FeatureGates == nil {
-				initialConfig.FeatureGates = make(map[string]bool)
-			}
-			initialConfig.FeatureGates[string(kubefeatures.UserNamespacesSupport)] = false
-			initialConfig.FeatureGates[string(kubefeatures.ProcMountType)] = false
-		})
-		f.It("will fail to create a hostUsers=false pod", func(ctx context.Context) {
-			if on, ok := serviceFeatureGates[string(kubefeatures.UserNamespacesSupport)]; !ok || !on {
-				e2eskipper.Skipf("services do not have user namespaces on")
-			}
-			falseVar := false
-			podClient := e2epod.NewPodClient(f)
-			pod, err := podClient.PodInterface.Create(ctx, &v1.Pod{
-				ObjectMeta: metav1.ObjectMeta{Name: "userns-pod"},
-				Spec: v1.PodSpec{
-					Containers: []v1.Container{
-						{
-							Name:    "test-container-1",
-							Image:   imageutils.GetE2EImage(imageutils.BusyBox),
-							Command: []string{"/bin/sleep"},
-							Args:    []string{"10000"},
-						},
-					},
-					HostUsers: &falseVar,
-				},
-			}, metav1.CreateOptions{})
-			framework.ExpectNoError(err)
-
-			// Pod should stay in pending
-			// Events would be a better way to tell this, as we could actually read the event,
-			// but history proves events aren't reliable enough to base a test on.
-			gomega.Consistently(ctx, func() error {
-				p, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Get(ctx, pod.Name, metav1.GetOptions{})
-				if err != nil {
-					return err
-				}
-				if p.Status.Phase != v1.PodPending {
-					return fmt.Errorf("Pod phase isn't pending")
-				}
-				return nil
-			}, 30*time.Second, 5*time.Second).ShouldNot(gomega.HaveOccurred())
-		})
-	})
-})
-
-var _ = SIGDescribe("user namespaces kubeconfig tests", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithFeatureGate(kubefeatures.UserNamespacesSupport), framework.WithSerial(), func() {
+var _ = SIGDescribe("user namespaces kubeconfig tests", "[LinuxOnly]", feature.UserNamespacesSupport, framework.WithSerial(), func() {
 	f := framework.NewDefaultFramework("userns-kubeconfig")
 	f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
 	f.Context("test config using userNamespaces.idsPerPod", func() {

test/integration/auth/podsecurity_test.go

@@ -53,8 +53,7 @@ import (
 func TestPodSecurity(t *testing.T) {
 	// Enable all feature gates needed to allow all fields to be exercised
 	featuregatetesting.SetFeatureGatesDuringTest(t, utilfeature.DefaultFeatureGate, featuregatetesting.FeatureOverrides{
-		features.ProcMountType:         true,
-		features.UserNamespacesSupport: true,
+		features.ProcMountType: true,
 	})
 	// Start server
 	server := startPodSecurityServer(t)
@@ -101,8 +100,7 @@ func TestPodSecurityGAOnly(t *testing.T) {
 func TestPodSecurityWebhook(t *testing.T) {
 	// Enable all feature gates needed to allow all fields to be exercised
 	featuregatetesting.SetFeatureGatesDuringTest(t, utilfeature.DefaultFeatureGate, featuregatetesting.FeatureOverrides{
-		features.ProcMountType:         true,
-		features.UserNamespacesSupport: true,
+		features.ProcMountType: true,
 	})
 
 	// Start test API server.