[release-4.20] OCPBUGS-72395:Unrevert tls tests with fixes #30665
Conversation
…)" This reverts commit 10dab7a.
This commit refactors TestTLSDefaults to use the same port-forwarding approach as TestTLSMinimumVersions, which fixes DNS resolution failures when running in CI as a pod. Problem: When the test runs as a pod in the cluster, it attempted to connect directly to the external API server hostname from the kubeconfig (e.g., api.cluster5.ocpci.eng.rdu2.redhat.com). However, the pod's internal DNS cannot resolve this external hostname, resulting in: dial tcp: lookup api.cluster5.ocpci.eng.rdu2.redhat.com on 172.30.0.10:53: no such host Solution: Use forwardPortAndExecute() to create a port-forward tunnel to the apiserver service in openshift-kube-apiserver namespace, then test against localhost:<forwarded-port>. This approach: - Works both in-cluster (CI) and externally (with kubeconfig) - Eliminates DNS resolution issues entirely - Is consistent with TestTLSMinimumVersions pattern - Includes built-in retry logic (3 attempts) - Simplifies the code by removing URL parsing and env var detection Changes: - Removed net/url and os imports (no longer needed) - Wrapped TLS version and cipher tests in forwardPortAndExecute callback - Changed error reporting from t.Errorf() to returning errors for retry support - Tests now connect to localhost via port-forward tunnel 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
Remove the IPv4-only restriction from TLS tests to support IPv6 clusters. The tests use port-forwarding to localhost, which works for both IPv4 and IPv6 environments since localhost resolves appropriately in both cases. Changes: - Removed IPv4-only check in BeforeEach that skipped tests on IPv6 clusters - Removed unused networking import This allows the TLS configuration tests to run on: - IPv4-only clusters - IPv6-only clusters - Dual-stack (IPv4+IPv6) clusters 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
Update the comment explaining why cipher suite tests are constrained to TLS 1.2 to be more technically accurate. The previous comment suggested this was about "Go 1.23+ behavior", but the real issue is fundamental to how TLS 1.3 works: - The intermediate profile allows both TLS 1.2 and TLS 1.3 - Clients negotiate TLS 1.3 when MaxVersion is unspecified and server supports it - TLS 1.3 spec predefines cipher suites and doesn't support configuration - Therefore, specifying any cipher suite has no effect with TLS 1.3 - Forcing TLS 1.2 allows actual testing of cipher suite restrictions This makes the reasoning clearer for future maintainers.
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-71229 has been cloned as Jira Issue OCPBUGS-72395. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
changed the title
openshift-ci-robot
added
jira/severity-important
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-72395, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/payload 4.20 nightly blocking |
|
@wangke19: trigger 13 job(s) of type blocking for the nightly release of OCP 4.20
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/37707c00-ecc0-11f0-961d-a7aa3e55bccc-0 |
|
Closing this PR in favor of #30668 which includes the following fixes:
Both CI failures have been resolved: /close |
|
@wangke19: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-72395. The bug has been updated to no longer refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
This is an automated cherry-pick of #30660
/assign wangke19