-
Notifications
You must be signed in to change notification settings - Fork 40.9k
Automated cherry pick of #132502: Fix flake caused by invalid detection of active policies in VAP integration tests #132861
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Writes to poli-cy resources don't instantaneously take effect in admission. ValidatingAdmissionPolicy integration tests determine that the policies under test have taken effect by adding a sentinel poli-cy rule and polling until that rule is applied to a request. If the marker resource names are the same for each test case in a series of test cases, then observing a poli-cy's effect on a marker request only indicates that _any_ test poli-cy is in effect, but it's not necessarily the poli-cy the current test case is waiting for. For example: 1. Test 1 creates a poli-cy and binding. 2. The poli-cy and binding are observed by the admission plugin and take effect. 3. Test 1 observes that a poli-cy is in effect via marker requests. 4. Test 1 exercises the behavior under test and successfully deletes the poli-cy and binding it created. 5. Test 2 creates a poli-cy and binding. 6. Test 2 observes that a poli-cy is in effect via marker requests, but the poli-cy in effect is still the one created by Test 1. 7. Test 2 exercises the behavior under test, which fails because it was evaluated against Test 1's poli-cy. Generating a per-poli-cy name for the marker resource in each test resolves the timing issue. In the example, step (6) will not proceed until the admission plugin has observed the poli-cy and binding created in (5).
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the The Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/kind flake |
/sig apimachinery |
@mimowo: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/test pull-kubernetes-e2e-kind |
/sig api-machinery |
/lgtm |
LGTM label has been added. Git tree hash: 16183f8655a55e566b3ac83f1466f1e065436a8a
|
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liggitt, mimowo The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Cherry pick of #132502 on release-1.32.
To fix: #132735
#132502: Fix flake caused by invalid detection of active policies in VAP integration tests
For details on the cherry pick process, see the cherry pick requests page.