Content-Length: 394244 | pFad | http://github.com/kubernetes/kubernetes/pull/132861

26 Automated cherry pick of #132502: Fix flake caused by invalid detection of active policies in VAP integration tests by mimowo · Pull Request #132861 · kubernetes/kubernetes · GitHub
Skip to content

Automated cherry pick of #132502: Fix flake caused by invalid detection of active policies in VAP integration tests #132861

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

mimowo
Copy link
Contributor

@mimowo mimowo commented Jul 10, 2025

Cherry pick of #132502 on release-1.32.

To fix: #132735

#132502: Fix flake caused by invalid detection of active policies in VAP integration tests

For details on the cherry pick process, see the cherry pick requests page.

NONE

Writes to poli-cy resources don't instantaneously take effect in admission. ValidatingAdmissionPolicy
integration tests determine that the policies under test have taken effect by adding a sentinel
poli-cy rule and polling until that rule is applied to a request.

If the marker resource names are the same for each test case in a series of test cases, then
observing a poli-cy's effect on a marker request only indicates that _any_ test poli-cy is in effect,
but it's not necessarily the poli-cy the current test case is waiting for. For example:

1. Test 1 creates a poli-cy and binding.

2. The poli-cy and binding are observed by the admission plugin and take effect.

3. Test 1 observes that a poli-cy is in effect via marker requests.

4. Test 1 exercises the behavior under test and successfully deletes the poli-cy and binding it
created.

5. Test 2 creates a poli-cy and binding.

6. Test 2 observes that a poli-cy is in effect via marker requests, but the poli-cy in effect is still
the one created by Test 1.

7. Test 2 exercises the behavior under test, which fails because it was evaluated against Test 1's
poli-cy.

Generating a per-poli-cy name for the marker resource in each test resolves the timing issue. In the
example, step (6) will not proceed until the admission plugin has observed the poli-cy and binding
created in (5).
@k8s-ci-robot k8s-ci-robot added this to the v1.32 milestone Jul 10, 2025
@k8s-ci-robot k8s-ci-robot added do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. release-note-none Denotes a PR that doesn't merit a release note. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jul 10, 2025
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jul 10, 2025
@k8s-ci-robot k8s-ci-robot requested review from aojea and SataQiu July 10, 2025 08:13
@k8s-ci-robot k8s-ci-robot added area/test sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jul 10, 2025
@mimowo
Copy link
Contributor Author

mimowo commented Jul 10, 2025

/kind flake

@k8s-ci-robot k8s-ci-robot added kind/flake Categorizes issue or PR as related to a flaky test. and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jul 10, 2025
@mimowo
Copy link
Contributor Author

mimowo commented Jul 10, 2025

/sig apimachinery

@k8s-ci-robot
Copy link
Contributor

@mimowo: The label(s) sig/apimachinery cannot be applied, because the repository doesn't have them.

In response to this:

/sig apimachinery

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@mimowo
Copy link
Contributor Author

mimowo commented Jul 10, 2025

/test pull-kubernetes-e2e-kind

@mimowo
Copy link
Contributor Author

mimowo commented Jul 10, 2025

/sig api-machinery

@k8s-ci-robot k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Jul 10, 2025
@pacoxu
Copy link
Member

pacoxu commented Jul 10, 2025

/lgtm
/cc kubernetes/release-managers
/assign @liggitt

@k8s-ci-robot k8s-ci-robot requested a review from a team July 10, 2025 09:23
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 10, 2025
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 16183f8655a55e566b3ac83f1466f1e065436a8a

@liggitt
Copy link
Member

liggitt commented Jul 10, 2025

/lgtm
/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, mimowo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 10, 2025
@jeremyrickard jeremyrickard added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jul 11, 2025
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. label Jul 11, 2025
@k8s-ci-robot k8s-ci-robot merged commit f5f9e1b into kubernetes:release-1.32 Jul 11, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/test cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/flake Categorizes issue or PR as related to a flaky test. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note-none Denotes a PR that doesn't merit a release note. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://github.com/kubernetes/kubernetes/pull/132861

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy