Automated cherry pick of #132502: Fix flake caused by invalid detection of active policies in VAP integration tests #132862
Conversation
Writes to policy resources don't instantaneously take effect in admission. ValidatingAdmissionPolicy integration tests determine that the policies under test have taken effect by adding a sentinel policy rule and polling until that rule is applied to a request. If the marker resource names are the same for each test case in a series of test cases, then observing a policy's effect on a marker request only indicates that _any_ test policy is in effect, but it's not necessarily the policy the current test case is waiting for. For example: 1. Test 1 creates a policy and binding. 2. The policy and binding are observed by the admission plugin and take effect. 3. Test 1 observes that a policy is in effect via marker requests. 4. Test 1 exercises the behavior under test and successfully deletes the policy and binding it created. 5. Test 2 creates a policy and binding. 6. Test 2 observes that a policy is in effect via marker requests, but the policy in effect is still the one created by Test 1. 7. Test 2 exercises the behavior under test, which fails because it was evaluated against Test 1's policy. Generating a per-policy name for the marker resource in each test resolves the timing issue. In the example, step (6) will not proceed until the admission plugin has observed the policy and binding created in (5).
k8s-ci-robot
added
release-note-none
|
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the The Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
needs-triage
k8s-ci-robot
added
area/test
sig/testing
|
/kind flake |
k8s-ci-robot
added
kind/flake
|
/sig apimachinery |
|
@mimowo: The label(s) In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/sig api-machinery |
k8s-ci-robot
added
the
sig/api-machinery
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
LGTM label has been added. Git tree hash: d008709a806742899b0843ede66811bdb93a7328
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liggitt, mimowo The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
jeremyrickard
added
cherry-pick-approved
mimowo
deleted the
automated-cherry-pick-of-#132502-upstream-release-1.31
branch
6 participants
Cherry pick of #132502 on release-1.31.
To fix: #132735
#132502: Fix flake caused by invalid detection of active policies in VAP integration tests
For details on the cherry pick process, see the cherry pick requests page.