This PR fixes the flaky TestApplyCRDuringCRDFinalization test that was failing
intermittently on slower systems (s390x architecture, race detector builds).
The root cause was a race condition where the test would attempt to apply a CR
immediately after requesting CRD deletion, without waiting for the CRD to
actually enter the terminating state. The fix explicitly waits for the CRD
to have the Terminating condition set to True before attempting the apply.
This is primarily useful in unit tests and therefore supported by
featuregate/testing. Without this, all warnings are emitted to stderr, with no
connection to the test which caused the warning to be emitted.
When a single test fails, `go test` started by showing all warnings triggered by
any test, not just the failed test:
I1121 18:50:28.112284 396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:true DRADeviceTaints:true]}
...
I1121 18:50:29.704907 396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:false DRADeviceTaints:false]}
--- FAIL: TestAll (1.58s)
--- FAIL: TestAll/Eviction (0.02s)
This warning was actually slightly broken: it passed an atomic.Value to Infof,
not the map. This violates the "must not be copied after first use" rule
for atomic.Value (thus wasn't thread-safe) and printed the value in an awkward
way (extra {}).
Now it shows that the feature gates are modified inside TestAll (in this example):
--- FAIL: TestAll (1.56s)
feature_gate.go:170: I1124 17:31:27.245108] Updated featureGates={"DRADeviceTaintRules":true,"DRADeviceTaints":true}
--- FAIL: TestAll/Eviction (0.02s)
--- FAIL: TestAll/Eviction/initial (0.00s)
...
feature_gate.go:170: I1124 17:31:28.821975] Updated featureGates={"DRADeviceTaintRules":false,"DRADeviceTaints":false}
FAIL
FAIL k8s.io/kubernetes/pkg/controller/devicetainteviction 1.602s
The test expects unauthorized pods to be blocked from accessing cached
private images, but the default policy (NeverVerifyPreloadedImages)
allows access to any image previously pulled by the kubelet.
Configure the kubelet to use AlwaysVerify policy for this test, which
enforces credential checks for all images regardless of pull history.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
When a container restarts before kubelet restarts, containerMap has
multiple entries (old exited + new running). GetContainerID() may
return the exited container, causing the running check to fail. Fixed
by checking if ANY container for the pod/name is running.
Also filter terminal pods from podresources since they no longer
consume resources, and fix test error handling to avoid exiting
Eventually immediately on transient errors.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
