🌱 : e2e test: do tests with restricted pods #2732

camilamacedo86 · 2022-06-16T06:10:24Z

Description
do tests with restricted pods

motivation
Ensure that the default scaffold works with restricted pods

k8s-ci-robot · 2022-06-16T06:10:25Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

camilamacedo86 · 2022-06-16T07:26:28Z

/test pull-kubebuilder-e2e-k8s-1-18-20

everettraven

Overall looks good, just a couple minor nits

everettraven · 2022-06-17T13:25:41Z

test/e2e/v3/generate_test.go

@@ -130,7 +130,7 @@ Count int `+"`"+`json:"count,omitempty"`+"`"+`
 }

 // GenerateV3 implements a go/v3(-alpha) plugin project defined by a TestContext.
-func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string) {
+func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string, restrictived bool) {


just a nit, but I think the bool should either be restrictive or restricted

Suggested change

func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string, restrictived bool) {

func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string, restrictive bool) {

test/e2e/v3/generate_test.go

everettraven · 2022-06-17T13:32:08Z

test/e2e/v3/plugin_cluster_test.go

+			It("should generate a runnable project go/v3 with v1 CRDs and Webhooks with restricted pods", func() {
+				// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
+				// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
+				// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
+				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
+					Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks"+
+						"and securityContext.seccompProfile", srvVer.GitVersion))
+				}
+
+				GenerateV3(kbc, "v1", true)
+
+				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
+				// TODO: Remove this once a better implementation using something like the TokenRequest API
+				// is used in the e2e tests
+				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
+					sat = true
+				}
+
+				Run(kbc, sat)
+			})
+			It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha"+
+				" with restricted pods", func() {
+				// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
+				// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
+				// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
+				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 {
+					Skip(fmt.Sprintf("cluster version %s does not support v1 CRDs or webhooks "+
+						"and securityContext.seccompProfile", srvVer.GitVersion))
+				}
+
+				GenerateV3WithKustomizeV2(kbc, "v1", true)
+
+				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
+				// TODO: Remove this once a better implementation using something like the TokenRequest API
+				// is used in the e2e tests
+				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
+					sat = true
+				}
+
+				Run(kbc, sat)
+			})
+			It("should generate a runnable project with v1beta1 CRDs and Webhooks with restricted pods", func() {
+				// Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field.
+				// Skip if cluster version < 1.19, because securityContext.seccompProfile only works from 1.19
+				// Otherwise, unknown field "seccompProfile" in io.k8s.api.core.v1.PodSecurityContext will be faced
+				// Skip if cluster version >= 1.22 because pre v1 CRDs and webhooks no longer exist.
+				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() < 19 ||
+					srvVer.GetMajorInt() <= 1 && srvVer.GetMinorInt() >= 22 {
+					Skip(fmt.Sprintf("cluster version %s does not support project defaults "+
+						"and securityContext.seccompProfile", srvVer.GitVersion))
+				}
+
+				GenerateV3(kbc, "v1beta1", true)


Curious as to why these lines were added? These look to be the same as the above tests that have a minor change to enable the testing with restricted pods.

That is a test for an scaffold with CRD v1beta1

It looks like the lines:
https://github.com/kubernetes-sigs/kubebuilder/pull/2732/files/56f0ba5b2730702ed56b5e66d3b5e741ba016c55#diff-5f5cf1a838c4d92e543721d2697ea0e2b0cf57b9f9a3c72bc9fa51a030bc56b8R170-R224

are repeated tests. I may be wrong but I think all of these tests already exist in these lines:
https://github.com/kubernetes-sigs/kubebuilder/pull/2732/files/56f0ba5b2730702ed56b5e66d3b5e741ba016c55#diff-5f5cf1a838c4d92e543721d2697ea0e2b0cf57b9f9a3c72bc9fa51a030bc56b8R114-R168

the first one test the Operator with v1 CRDs/Webooks and pod restriction

the second one test the Operator with kustomze v2 changes and pod restriction

the third one test the Operator with v1beta1 CRDs/Webooks and pod restriction

In the long run we will need to refractory the tests. This code is confusing for sure.

rashmigottipati · 2022-06-17T15:56:07Z

test/e2e/v3/generate_test.go

+
+func uncommentPodStandards(kbc *utils.TestContext) {
+	configManager := filepath.Join(kbc.Dir, "config", "manager", "manager.yaml")
+	managerAuth := filepath.Join(kbc.Dir, "config", "default", "manager_auth_proxy_patch.yaml")


Nit:

Suggested change

managerAuth := filepath.Join(kbc.Dir, "config", "default", "manager_auth_proxy_patch.yaml")

managerAuth := filepath.Join(configManager, "default", "manager_auth_proxy_patch.yaml")

We cannot do this change.
Why?
configManager-> has the full path with the file

everettraven

Looks good to me

k8s-ci-robot · 2022-06-19T12:13:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: camilamacedo86, everettraven

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [camilamacedo86]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

camilamacedo86 · 2022-06-20T11:49:30Z

@rashmigottipati I am moving forward with this one but we can be working on any improvement that you see fit as a fallow up as well.

camilamacedo86 · 2022-06-20T11:52:09Z

/hold

to rebase with master

k8s-ci-robot · 2022-06-20T12:12:23Z

New changes are detected. LGTM label has been removed.

camilamacedo86 · 2022-06-20T12:17:35Z

/hold cancel

…crease the coverage)

rashmigottipati

/lgtm

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 16, 2022

k8s-ci-robot requested review from joelanford and pwittrock June 16, 2022 06:10

camilamacedo86 marked this pull request as ready for review June 16, 2022 06:10

k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Jun 16, 2022

camilamacedo86 force-pushed the test-improvements branch from f0d128a to 56f0ba5 Compare June 16, 2022 07:02

camilamacedo86 changed the title ~~🌱 : clean up and improve ci to test with Pod Standards restricted (increase the coverage)~~ 🌱 : e2e test: do tests with restricted pods Jun 16, 2022

kubernetes-sigs deleted a comment from k8s-ci-robot Jun 16, 2022

camilamacedo86 added this to the 3.5.0 milestone Jun 16, 2022

everettraven suggested changes Jun 17, 2022

View reviewed changes

rashmigottipati reviewed Jun 17, 2022

View reviewed changes

camilamacedo86 force-pushed the test-improvements branch from 56f0ba5 to 948ec04 Compare June 18, 2022 20:19

camilamacedo86 requested a review from rashmigottipati June 19, 2022 11:24

everettraven approved these changes Jun 19, 2022

View reviewed changes

camilamacedo86 added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 20, 2022

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 20, 2022

camilamacedo86 force-pushed the test-improvements branch from 948ec04 to c3e2276 Compare June 20, 2022 12:12

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 20, 2022

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 20, 2022

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 20, 2022

camilamacedo86 added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Jun 20, 2022

🌱 : clean up and improve ci to test with Pod Standards restricted (in…

793161d

…crease the coverage)

camilamacedo86 force-pushed the test-improvements branch from c3e2276 to 793161d Compare June 20, 2022 12:22

camilamacedo86 added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 20, 2022

k8s-ci-robot merged commit dcc5bb4 into kubernetes-sigs:master Jun 20, 2022

camilamacedo86 deleted the test-improvements branch June 20, 2022 13:42

rashmigottipati reviewed Jun 20, 2022

View reviewed changes

everettraven mentioned this pull request Jun 24, 2022

REQUEST: New membership for @everettraven kubernetes/org#3522

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🌱 : e2e test: do tests with restricted pods #2732

🌱 : e2e test: do tests with restricted pods #2732

camilamacedo86 commented Jun 16, 2022 •

edited

Loading

k8s-ci-robot commented Jun 16, 2022

camilamacedo86 commented Jun 16, 2022

everettraven left a comment

everettraven Jun 17, 2022

everettraven Jun 17, 2022

camilamacedo86 Jun 17, 2022 •

edited

Loading

everettraven Jun 17, 2022

camilamacedo86 Jun 18, 2022

rashmigottipati Jun 17, 2022

camilamacedo86 Jun 18, 2022

everettraven left a comment

k8s-ci-robot commented Jun 19, 2022

camilamacedo86 commented Jun 20, 2022

camilamacedo86 commented Jun 20, 2022

k8s-ci-robot commented Jun 20, 2022

camilamacedo86 commented Jun 20, 2022

rashmigottipati left a comment

	func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string, restrictived bool) {
	func GenerateV3(kbc *utils.TestContext, crdAndWebhookVersion string, restrictive bool) {

	managerAuth := filepath.Join(kbc.Dir, "config", "default", "manager_auth_proxy_patch.yaml")
	managerAuth := filepath.Join(configManager, "default", "manager_auth_proxy_patch.yaml")

🌱 : e2e test: do tests with restricted pods #2732

🌱 : e2e test: do tests with restricted pods #2732

Conversation

camilamacedo86 commented Jun 16, 2022 • edited Loading

k8s-ci-robot commented Jun 16, 2022

camilamacedo86 commented Jun 16, 2022

everettraven left a comment

Choose a reason for hiding this comment

everettraven Jun 17, 2022

Choose a reason for hiding this comment

everettraven Jun 17, 2022

Choose a reason for hiding this comment

camilamacedo86 Jun 17, 2022 • edited Loading

Choose a reason for hiding this comment

everettraven Jun 17, 2022

Choose a reason for hiding this comment

camilamacedo86 Jun 18, 2022

Choose a reason for hiding this comment

rashmigottipati Jun 17, 2022

Choose a reason for hiding this comment

camilamacedo86 Jun 18, 2022

Choose a reason for hiding this comment

everettraven left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jun 19, 2022

camilamacedo86 commented Jun 20, 2022

camilamacedo86 commented Jun 20, 2022

k8s-ci-robot commented Jun 20, 2022

camilamacedo86 commented Jun 20, 2022

rashmigottipati left a comment

Choose a reason for hiding this comment

camilamacedo86 commented Jun 16, 2022 •

edited

Loading

camilamacedo86 Jun 17, 2022 •

edited

Loading