Test that assert on metrics use the returned status to sync the test, if
the metric is updated AFTER the state is returned the test will flake
because the assertion on the metric will race.
Change-Id: I317708a22cb47256c37dac3cab0463a2f925ad6b
Reset metrics per status code also allow to log the particular status
code that flake, in case the problem comes from an specific one.
Change-Id: I29f67d4c5d76449350f45049f45ce8325a2d0ddd
Other validation errors, like using hostNetwork, don't put
pod.spec.HostNetwork in the error message.
Let's remove align with that.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Now if a pod tries to use user namespaces (hostUsers: false) and a
volume device, it will see this error:
$ kubectl apply -f pod.yaml
...
* spec.ephemeralContainers[0].volumeDevices: Forbidden: when `pod.Spec.HostUsers` is false
* spec.initContainers[0].volumeDevices: Forbidden: when `pod.Spec.HostUsers` is false
* spec.containers[0].volumeDevices: Forbidden: when `pod.Spec.HostUsers` is false
Note that if a pod is already created with volumeDevices and userns,
then we allow modifications to that object.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
The test needs to schedule 256 pods at once, which only works with three
nodes (default limit is 100, but could also be lower). It's also a stress test
which flaked recently.
For now it gets removed without a replacement. A similar integration test is in
development, but too big (needs some infrastructure changes in
test/integration/dra) to add during code freeze.
* Reject pod when attachment limit is exceeded
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Record admission rejection
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Fix pull-kubernetes-linter-hints
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Fix AD Controller unit test failure
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Consolidate error handling logic in WaitForAttachAndMount
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Improve error context
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Update admissionRejectionReasons to include VolumeAttachmentLimitExceededReason
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Update status message
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Add TestWaitForAttachAndMountVolumeAttachLimitExceededError unit test
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Add e2e test
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Fix pull-kubernetes-linter-hints
Signed-off-by: Eddie Torres <torredil@amazon.com>
---------
Signed-off-by: Eddie Torres <torredil@amazon.com>
* apiextensions: Treat whitespace-only caBundle as empty for webhook client config and validation
- Updates webhookClientConfigForCRD to treat caBundle values containing only whitespace as empty, ensuring system trust roots are used in this case.
- Updates ValidateCABundle to treat whitespace-only caBundle as valid, consistent with empty or nil values.
- Adds/updates unit tests to verify that whitespace-only caBundle is handled equivalently to empty or nil.
- Ensures consistent and user-friendly handling of caBundle across CRD conversion webhook configuration and validation.
* Revert validation logic
* Add integration test for webhook bypass
* Fix linting
