Add TestBitFlipCorruptObjectDeletion to exercise the decoder error path
for KEP-3926 using Secrets (protobuf encoding). Unlike the existing
TestAllowUnsafeMalformedObjectDeletionFeature which tests transformer
errors (wrong encryption key), this test uses identity encryption and
corrupts stored bytes directly in etcd, triggering "undecodable" errors
at the protobuf decoder layer.
The informer is given an extended timeout (2 minutes) after deletion
to recover from the exponential backoff accumulated during the
corruption window. The reflector's backoff caps at [30s, 60s) with
jitter, so 2 minutes provides sufficient leeway.
The gate=false subtest is skipped because writing corrupt bytes directly
to etcd emits a watch event that the cacher cannot decode, breaking its
watch. Without the feature gate, the subsequent re-list aborts on the
first decode error (abortOnFirstError aggregator), so the cacher never
recovers and GET requests hang. This differs from the encryption-config
swap tests where no etcd data changes and no watch event is emitted.
This is a known issue to be addressed separately.
Add tests that exercise the AllowUnsafeMalformedObjectDeletion feature
gate for Custom Resources (foos.cr.bar.com), mirroring the existing
Secret-based tests. This covers the dynamic storage registry code path
that is distinct from built-in resources, including unsafe delete with
privilege escalation and LIST behavior for corrupt CR objects.
Refactoring as a preparation for the following commits.
Modernize the test file:
- interface{} -> any
- ioutil.ReadFile -> os.ReadFile
- ptr.To[bool](true) -> ptr.To(true)
- Extract grantUserVerbsOnResource from permitUserToDoVerbOnSecret
to support granting RBAC verbs on arbitrary resources, not just secrets
* Promote MutableCSINodeAllocatableCount to GA
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Lock MutableCSINodeAllocatableCount feature gate to default
Signed-off-by: Eddie Torres <torredil@amazon.com>
---------
Signed-off-by: Eddie Torres <torredil@amazon.com>
When rapidly processing informer events it can happen that a pod gets scheduled
twice (seen only in the TestEviction/update unit test):
- Claim update observed, pod from informer cache with NodeName from update -> queue pod for eviction.
- Pod update observed, claim from informer cache -> queue pod again.
The effect is one additional Get call to the apiserver. We can avoid it by
maintaining an LRU cache with the UIDs of the pods which we have evicted and
thus don't need to do anything for.
In these cases it's certain that no time needs to pass, so Wait can
replace polling with Eventually. This also means that locking is
not necessary to prevent data races.
In particular with the builtin tCtx.Assert/Expect the assertions are also short
when using gomega and often more readable (no more confusion in Equal which one
is the expected and which the actual value).
We can observe the delay in the metric histogram. Because we run in a synctest
bubble, the delay is 100% predictable.
Unfortunately we cannot use the reactor mechanism of the fake client: that
delays while holding the fake's mutex. When some other goroutine (in this case,
the event recorder) calls the client, it gets blocked without being considered
durably blocked by synctest, so time does not advance and the test gets stuck.
Thanks for waiting for cache sync via channels the random delays caused by
polling are gone, making the initial setup including cache sync happen
"immediately" when a test starts (= same virtual time). This makes the tests
more predictable and simplifies making further assertions about when something
happens or how long it takes.
While at it, restore previous performance by setting feature gates once and
running tests in parallel again.
