Commit Graph

75 Commits

Author SHA1 Message Date
Patrick Ohly
ad79e479c2 build: remove deprecated '// +build' tag
This has been replaced by `//build:...` for a long time now.

Removal of the old build tag was automated with:

    for i in $(git grep -l '^// +build' | grep -v -e '^vendor/'); do if ! grep -q '^// Code generated' "$i"; then sed -i -e '/^\/\/ +build/d' "$i"; fi; done
2025-12-18 12:16:21 +01:00
Tim Allclair
4986abe0b8 Automated refactoring to use SetFeatureGatesDuringTest 2025-10-01 21:10:53 -07:00
Anish Ramasekar
480fad996d kmsv2: run TestKMSv2ProviderKeyIDStaleness in parallel
This change updates the NowFunc to be per KMS provider instead of global
to the API server. This allows integration tests that use distinct
provider names to run in parallel when simulating key expiry.

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2025-09-10 14:15:43 -07:00
Kubernetes Prow Robot
ef4add4509 Merge pull request #133356 from mayuka-c/issue-133175
Replace usage of deprecated ErrWaitTimeout with recommended method across all Pkgs
2025-09-05 06:43:34 -07:00
Patrick Ohly
ad9ae3ab9d test: fix data race in test/integration/controlplane/transformation
TestKMSv2ProviderKeyIDStaleness runs two tests which both modify
kmsv2.NowFunc temporarily. Those two cannot run in parallel. They can be run in
parallel with other tests because nothing else changes kmsv2.NowFunc.

Found during local testing.
2025-09-02 21:01:04 +02:00
Mayuka Channankaiah
6c56d2fd1b Replace usage of deprecated ErrWaitTimeout with recommended method across all Pkgs 2025-08-01 14:18:06 +05:30
Anish Ramasekar
21e2fcea9e Add automatic_reload_last_config_info metric for auth configs
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2025-07-17 17:47:51 -05:00
Sascha Grunert
8e6651520e Convert k8s.io/kms/apis from gogo to protoc
Use standard protoc for the kms APIs instead of gogo.

Part of kubernetes#96564

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2025-07-16 16:46:39 +02:00
PatrickLaabs
1802c55652 chore: depr. pointer pkg replacement for test integration 2025-07-06 22:02:04 +02:00
Anish Ramasekar
dc3836c49e Remove deprecated encryption config controller metrics
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2025-06-11 15:31:37 -07:00
Marek Siarkowicz
506e4fed14 In TestListCorruptObject corrupt the object in etcd instead of changing encryption key
Changing the encryption key doesn't work with watch cache as it doesn't
break decoding newly written objects. A new object will be written using
a new key, and decoded using a new key.
2025-03-18 21:49:17 +01:00
Patrick Ohly
56bd8d86a5 test/integration: use default API groups in test apiserver
The goal is to make the test apiserver behave as much as kube-apiserver as
possible. This ensures that tests are as realistic as possible out-of-the-box.
If a test needs a special setup, then that should be visible in the test
because it passes additional flags or options.

One historic deviation from that goal was enabling all API groups. That
change (from 7185624688) gets reverted and tests
which happened to rely on this get updated.
2025-02-24 10:20:06 +01:00
Siyuan Zhang
8fc3a33454 Refactor compatibility version code
Replace DefaultComponentGlobalsRegistry with new instance of componentGlobalsRegistry in test api server.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move kube effective version validation out of component base.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move DefaultComponentGlobalsRegistry out of component base.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move ComponentGlobalsRegistry out of featuregate pkg.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

remove usage of DefaultComponentGlobalsRegistry in test files.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

change non-test DefaultKubeEffectiveVersion to use DefaultBuildEffectiveVersion.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Restore useDefaultBuildBinaryVersion in effective version.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

rename DefaultKubeEffectiveVersion to DefaultKubeEffectiveVersionForTest.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

pass options.ComponentGlobalsRegistry into config for controller manager and scheduler.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Pass apiserver effective version to DefaultResourceEncodingConfig.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

change statusz registry to take effective version from the components.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Address review comments

Signed-off-by: Siyuan Zhang <sizhang@google.com>

update vendor

Signed-off-by: Siyuan Zhang <sizhang@google.com>
2025-02-05 16:10:53 -08:00
Jefftree
6c94adcc63 expand etcd storage tests to test for 1.31..1.33 2024-12-20 19:07:54 +00:00
Abu Kashem
25efc8f2d1 handle watch for unsafe delete 2024-11-07 17:37:59 -05:00
Abu Kashem
9932dbef57 add access control check for unsafe delete
add access control check to ensure that the user has permission to do
'unsafe-delete-ignore-read-error' on the resource being deleted
2024-11-07 17:37:59 -05:00
Abu Kashem
367a265c0e add an integration test that exercises the unsafe delete flow
- add an integration test that exercises the unsafe delete flow
- extend newTransformTest to enable RBAC
- add integration test to verify that LIST returns corrupt object keys
2024-11-07 17:37:59 -05:00
Ben Luddy
439d2f7b40 Wire serving codecs to CBOR feature gate.
Integration testing has to this point relied on patching serving codecs for built-in APIs. The
test-only patching is removed and replaced by feature gated checks at runtime.
2024-11-06 15:41:39 -05:00
Ben Luddy
88c9dd7534 Update AllAlpha integration tests to recognize CBOR.
Setting AllAlpha=true in integration tests changes the dynamic client request encoding and the
custom resource storage encoding to CBOR. The etcd storage path is updated to accept either JSON or
CBOR as storage encoding. The client feature gate controlling the dynamic client request encoding is
temporarily disabled until the serving codecs for builtin APIs are wired to the CBOR apiserver
feature gate.
2024-11-05 15:09:12 -05:00
Monis Khan
43740c0def kmsv2: run KDF tests in parallel
This change updates the KDF "feature flag" to be per KMS provider
instead of global to the API server.  This allows integration tests
that use distinct provider names to run in parallel.

Locally this change reduced the runtime of
test/integration/controlplane/transformation by 3.5 minutes.

Signed-off-by: Monis Khan <mok@microsoft.com>
2024-10-16 16:58:19 -04:00
Aaron Prindle
701e6c7ab1 chore: bump DefaultKubeBinaryVersion to 1.32, make 1.32 CEL changes, fix int tests to handle 1 version off API deprecation, and fix prerelease-lifecycle-gen for # of APIs 2024-09-17 19:32:14 +00:00
Keerthan Reddy Mala
3a8df1efdd add resource to the transformation metrics 2024-08-21 09:52:24 -07:00
Monis Khan
6398b8a19f Remove KMSv2 and KMSv2KDF feature gates
These have been GA since v1.29 and can be safely removed.

Signed-off-by: Monis Khan <mok@microsoft.com>
2024-08-14 17:05:18 -04:00
Joe Betz
0be8f9ff63 Stop using binaryVersion=0.0 in tests and delete fixtures for kinds no longer served. 2024-07-03 13:52:18 -04:00
Siyuan Zhang
403301bfdf apiserver: Add API emulation versioning.
Co-authored-by: Siyuan Zhang <sizhang@google.com>
Co-authored-by: Joe Betz <jpbetz@google.com>
Co-authored-by: Alex Zielenski <zielenski@google.com>

Signed-off-by: Siyuan Zhang <sizhang@google.com>
2024-06-25 22:12:11 +00:00
Patrick Ohly
b92273a760 apiserver + controllers: enhance context support
27a68aee3a introduced context support for events. Creating an event
broadcaster with context makes tests more resilient against leaking goroutines
when that context gets canceled at the end of a test and enables per-test
output via ktesting.

The context could get passed to the constructor. A cleaner solution is to
enhance context support for the apiserver and then pass the context into the
controller's run method. This ripples up the call stack to all places which
start an apiserver.
2024-04-29 20:59:21 +02:00
Marek Siarkowicz
3ee8178768 Cleanup defer from SetFeatureGateDuringTest function call 2024-04-24 20:25:29 +02:00
Anish Ramasekar
8d563c2cde Revert "Run controlplane/transformation integration tests in parallel" 2024-04-23 13:48:33 -07:00
Anish Ramasekar
689363be06 Run transformation integration tests in parallel
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-04-22 09:46:42 -07:00
Anish Ramasekar
1e048d5f24 generate unique UDS path for transformation integration tests
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-04-22 09:42:16 -07:00
Anish Ramasekar
77241d3125 Add apiserver_encryption_config_controller_automatic_reloads_total
metric

- Adds `apiserver_encryption_config_controller_automatic_reloads_total`
  metric with status label for encryption config reload success/failure.
- Deprecated `apiserver_encryption_config_controller_automatic_reload_failures_total` and `apiserver_encryption_config_controller_automatic_reload_success_total`

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-02-12 21:47:46 -08:00
Anish Ramasekar
75695dae10 move encryption config types to standard API server config location
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2023-12-18 20:54:24 +00:00
Nilekh Chaudhari
e95b7c6d8b feat: updates encryption config file watch logic to polling
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

fix (#2)

Signed-off-by: Monis Khan <mok@microsoft.com>
2023-10-30 16:20:39 +00:00
Kubernetes Prow Robot
ebf46ce1b4 Merge pull request #121485 from ritazh/kmsv2-ga
[KMSv2] promote KMSv2 and KMSv2KDF to GA
2023-10-27 02:23:50 +02:00
Rita Zhang
a9b1adbafc [KMSv2] promote KMSv2 and KMSv2KDF to GA
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-10-26 15:05:31 -07:00
Nilekh Chaudhari
a92c1269e2 test: fixes hot reload flake
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2023-10-25 01:14:00 +00:00
Nilekh Chaudhari
71a1565d06 revert: reverts fixes for TestEncryptionConfigHotReload flake
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2023-10-25 01:08:04 +00:00
Nilekh Chaudhari
d9c967113f tests: fixes flake in TestEncryptionConfigHotReload
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2023-10-23 18:03:05 +00:00
Rita Zhang
7710128636 kms: remove livez check
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-09-12 08:48:26 -07:00
Rita Zhang
43ccf6c4e8 kmsv2: add apiserver identity to metrics
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-09-09 15:31:32 -07:00
Monis Khan
657cc2045e kmsv2: enable KMSv2KDF feature gate by default
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-09-05 15:20:10 -04:00
Monis Khan
95121fe846 kmsv2: add legacy data integration test
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-09-01 15:33:28 -04:00
Monis Khan
b10697c788 kmsv2: fix race in simpleCache.set when setting cache size metric
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-08-31 16:26:58 -04:00
Rita Zhang
d86e72202c kmsv2 test feature enablement unit test
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-08-18 15:28:32 -07:00
Rita Zhang
67769438e1 kmsv2 test feature enablement disablement and restart
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-07-25 09:50:59 -07:00
Kubernetes Prow Robot
773a6b1e46 Merge pull request #118828 from enj/enj/f/kms_v2_hkdf_expand
kmsv2: KDF based nonce extension
2023-07-21 16:10:19 -07:00
Monis Khan
bf49c727ba kmsv2: KDF based nonce extension
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-07-21 15:25:52 -04:00
Richa Banker
cd5f3d9f9d Add impl for uvip 2023-07-18 17:36:22 -07:00
Nilekh Chaudhari
131216fa8f chore: hashes keyID
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2023-07-13 20:42:09 +00:00
Nilekh Chaudhari
9d19c207d2 fix: fixes flake in TestKMSv2Healthz
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2023-05-02 21:01:48 +00:00