This change adds the StructuredAuthenticationConfigurationEgressSelector
beta feature (default on). When enabled, each JWT authenticator
specified via the AuthenticationConfiguration.jwt array can
optionally specify either the controlplane or cluster egress
selector by setting the issuer.egressSelectorType field. When
unset, the prior behavior of using no egress selector is retained.
Egress selection is valuable when the persona configuring the JWT
authenticator and the persona managing the control plane are
different individuals. This change allows the latter to protect
control plane network services from unexpected connections.
Signed-off-by: Monis Khan <mok@microsoft.com>
They were deprecated in etcd 3.6.0 and were removed in 3.7.0:
https://github.com/etcd-io/etcd/pull/19959
InitialCorruptCheck is now a behind Etcd feature gate. The new flags are
set based on provided k8s version.
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
We want to fix and enhance lanes which exercise
the podresources API tests. The first step is to clarify
the label and made it specific to podresources API,
minimzing the clash and the ambiguity with the "PodLevelResources"
feature.
Note we change the label names, but the label name is backward
compatible (filtering for "Feature:PodResources" will still
get the tests). This turns out to be not a problem because
these tests are no longer called out explicitly in the lane
definitions. We want to change this ASAP.
The new name is more specific and allows us to clearly
call out tests for this feature in the lane definitions.
Signed-off-by: Francesco Romani <fromani@redhat.com>
The test brings up the cluster and uses that power to run through
an upgrade/downgrade scenario. Version skew testing (running tests while the cluster
is partially up- or downgraded) could be added.
The new helper code for managing the cluster is written so that it could be
used both in an integration test and an E2E
test. https://github.com/kubernetes/kubernetes/pull/122481 could make that a
bit easier in an E2E test, but is not absolutely required.
In contrast to running on a normal cluster, pods need no privileges.
Instead, the caller has to make sure that the test itself can write
into system directories used by the cluster.
The helper code is useful for a separate Ginkgo suite for upgrade/downgrade
testing. We don't want to import test/e2e/dra there because that would also
define additional tests.
If we know that the test binary shares the filesystem with the cluster (for
example, when using local-up-cluster.sh), then we can avoid the whole
complicated portproxy solution and work directly with the paths on the
host.
Only works with suitable permissions! /var/lib/kubelet/plugins,
/var/lib/kubelet/plugin_registry, and /var/run/cdi must be writable.
portproxy remains the default because it automatically gains sufficient
permissions also when combined with local-up-cluster.sh.
This closes a gap compared to the context package. It's useful when combined
with Ginkgo to keep something running beyond the end of the Ginkgo BeforeEach
or It node.
That WithCancel added a deferred cleanup which cancels on test termination was
unexpected. This automatic cancellation makes sense only for the initial root
TContext.
This is a DRA-specific stop-gap solution for using the E2E framework together
with ktesting. Long-term this should better land in the E2E framework itself.
This allows declaring a code region as one step without having to use
an anonymous callback function, which has the advantage that variables
set during the step are visible afterwards.
In Python, this would be done as
with ktesting.Step(tctx) as tcxt:
// some code code inside step
// code not in the same step
But Go has no such construct.
In contrast to WithStep, the start and end of the step are logged, including
timing information.
Hiding the error in WithError is the right choice for example
when it is used inside ktesting.Eventually. Most callers probably want to deal
with the unexpected error themselves. For those who don't, WithErrorLogging
continues to log it.
During upgrade/downgrade testing, errors are encountered while the apiserver is
down. This is normal and handled via retrying, so we don't need to be verbose.
A special test (for example, one which manages its own cluster) could almost
construct a Framework instance because most fields are exported. The
`clientConfig` field isn't because REST configs often need to be deep-copied to
avoid accidentally updating some shared copy, so for this special case a
SetClientConfig is needed.
