AUTH-428: add PSa labelsyncer managed labels e2e tests #28257

liouk · 2023-09-13T08:38:18Z

Adds e2e tests for the behavior added here:

AUTH-413: ps syncer: only sync labels if noone else is managing them cluster-policy-controller#127

openshift-ci-robot · 2023-09-13T08:38:21Z

@liouk: This pull request references AUTH-428 which is a valid jira issue.

In response to this:

Adds e2e tests for the behavior added here:

AUTH-413: ps syncer: only sync labels if noone else is managing them cluster-policy-controller#127

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-09-13T08:39:41Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: liouk
Once this PR has been reviewed and has the lgtm label, please assign stlaz for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liouk · 2023-09-21T14:37:35Z

/retest

liouk · 2023-09-25T10:38:21Z

/retest-required

test/extended/authorization/podsecurity_admission.go

ibihim · 2023-10-06T19:27:58Z

test/extended/authorization/podsecurity_admission.go

+}
+
+func waitAndGetNamespace(ctx context.Context, oc *exutil.CLI, nsName string) (*corev1.Namespace, error) {
+	time.Sleep(2 * time.Second)


Wait until something happens is always better.

A hardcoded timelimit is always the worst case. It can also introduce a spiral of longer and longer test durations. If the cluster is slow, it will cause flakiness, which will then lead to an increase of the static sleep in all cases.

I've added a generic polling function that waits for the namespace object to be updated by the labelsyncer after the original create/update, in 9418921.

I chose a generic equality condition, as what the labelsyncer is expected to do varies per test and test case (and in some cases no change is expected at all).

A polling function is a great idea.

Test frameworks that offer a "wait" function are doing exactly that.

test/extended/authorization/podsecurity_admission.go

liouk · 2023-10-18T07:49:14Z

added review fixes as fixups for clarity; will squash once reviewed
/hold

openshift-bot · 2024-01-17T01:00:29Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

liouk · 2024-01-24T10:36:02Z

/remove-lifecycle stale

liouk · 2024-01-25T09:00:29Z

/retest

liouk · 2024-01-30T13:06:02Z

/retest

liouk · 2024-01-31T10:34:53Z

/hold cancel
all fixups squashed

liouk · 2024-02-08T09:10:16Z

/retest

liouk · 2024-02-08T11:11:07Z

/hold
test is failing

openshift-bot · 2024-06-04T01:00:40Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

liouk · 2024-06-04T09:45:00Z

/remove-lifecycle stale

openshift-bot · 2024-09-03T01:00:36Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2024-11-01T08:30:20Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

liouk · 2024-11-01T08:46:34Z

/remove-lifecycle rotten

openshift-bot · 2025-01-30T09:00:30Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

liouk · 2025-01-30T10:53:12Z

/remove-lifecycle stale

openshift-trt · 2025-02-28T17:01:50Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: ea0c6cd

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-gcp-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-gcp-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-metal-ipi-ovn-ipv6	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-metal-ipi-ovn-ipv6	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-vsphere-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-main-e2e-vsphere-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-master-e2e-vsphere-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit
pull-ci-openshift-origin-master-e2e-vsphere-ovn	High - "[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit

New tests seen in this PR at sha: ea0c6cd

"[sig-auth][Feature:PodSecurity][Feature:LabelSyncer] updating PSa labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 0, Fail: 6, Flake: 0]
"[sig-auth][Feature:PodSecurity][Feature:LabelSyncer][Feature:ForceHistoricalOwnership] forcing PSa label historical ownership [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 0, Fail: 6, Flake: 0]

openshift-bot · 2025-08-02T01:00:23Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2025-09-01T08:30:24Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

liouk · 2025-09-02T14:38:17Z

/remove-lifecycle rotten

openshift-merge-robot · 2025-10-03T17:17:03Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-11-18T13:07:07Z

@liouk: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-fips	`ea0c6cd`	link	true	`/test e2e-aws-ovn-fips`
ci/prow/e2e-aws-ovn-cgroupsv2	`ea0c6cd`	link	false	`/test e2e-aws-ovn-cgroupsv2`
ci/prow/e2e-gcp-ovn	`ea0c6cd`	link	true	`/test e2e-gcp-ovn`
ci/prow/e2e-openstack-ovn	`ea0c6cd`	link	false	`/test e2e-openstack-ovn`
ci/prow/e2e-aws-ovn-single-node-upgrade	`ea0c6cd`	link	false	`/test e2e-aws-ovn-single-node-upgrade`
ci/prow/e2e-aws-ovn-single-node	`ea0c6cd`	link	false	`/test e2e-aws-ovn-single-node`
ci/prow/e2e-aws-ovn-single-node-serial	`ea0c6cd`	link	false	`/test e2e-aws-ovn-single-node-serial`
ci/prow/e2e-metal-ipi-sdn	`ea0c6cd`	link	false	`/test e2e-metal-ipi-sdn`
ci/prow/e2e-gcp-ovn-builds	`ea0c6cd`	link	true	`/test e2e-gcp-ovn-builds`
ci/prow/e2e-vsphere-ovn-upi	`ea0c6cd`	link	true	`/test e2e-vsphere-ovn-upi`
ci/prow/e2e-vsphere-ovn	`ea0c6cd`	link	true	`/test e2e-vsphere-ovn`
ci/prow/e2e-aws-csi	`ea0c6cd`	link	true	`/test e2e-aws-csi`
ci/prow/e2e-gcp-csi	`ea0c6cd`	link	true	`/test e2e-gcp-csi`
ci/prow/go-verify-deps	`ea0c6cd`	link	true	`/test go-verify-deps`
ci/prow/e2e-aws-ovn-microshift	`ea0c6cd`	link	true	`/test e2e-aws-ovn-microshift`
ci/prow/e2e-aws-ovn-microshift-serial	`ea0c6cd`	link	true	`/test e2e-aws-ovn-microshift-serial`
ci/prow/e2e-metal-ipi-ovn-ipv6	`ea0c6cd`	link	true	`/test e2e-metal-ipi-ovn-ipv6`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 13, 2023

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 13, 2023

openshift-ci bot requested review from s-urbaniak and sosiouxme September 13, 2023 08:39

liouk force-pushed the psalabelsyncer-managed-labels branch 3 times, most recently from cb80df0 to 49d0add Compare September 13, 2023 14:56

liouk force-pushed the psalabelsyncer-managed-labels branch from 49d0add to 776c4bb Compare September 21, 2023 10:07

liouk changed the title ~~WIP: AUTH-428: add PSa labelsyncer managed labels e2e tests~~ AUTH-428: add PSa labelsyncer managed labels e2e tests Sep 21, 2023

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 21, 2023

ibihim suggested changes Oct 9, 2023

View reviewed changes

stlaz suggested changes Oct 9, 2023

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 18, 2023

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 17, 2024

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 24, 2024

liouk force-pushed the psalabelsyncer-managed-labels branch from 9418921 to 2649633 Compare January 25, 2024 12:31

liouk force-pushed the psalabelsyncer-managed-labels branch from 2649633 to b0021c5 Compare January 31, 2024 10:34

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 31, 2024

liouk force-pushed the psalabelsyncer-managed-labels branch from 20e5af0 to 5486b12 Compare February 8, 2024 14:54

test/extended: add PSa labelsyncer managed labels e2e tests

ea0c6cd

liouk force-pushed the psalabelsyncer-managed-labels branch from 5486b12 to ea0c6cd Compare February 9, 2024 10:12

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 4, 2024

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 4, 2024

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 3, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Nov 1, 2024

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Nov 1, 2024

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 30, 2025

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 30, 2025

openshift-trt bot deleted a comment from openshift-trt-bot Feb 28, 2025

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 2, 2025

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Sep 1, 2025

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Sep 2, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 3, 2025

AUTH-428: add PSa labelsyncer managed labels e2e tests #28257

Are you sure you want to change the base?

AUTH-428: add PSa labelsyncer managed labels e2e tests #28257

Uh oh!

Conversation

liouk commented Sep 13, 2023

Uh oh!

openshift-ci-robot commented Sep 13, 2023 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Sep 13, 2023

Uh oh!

liouk commented Sep 21, 2023

Uh oh!

liouk commented Sep 25, 2023

Uh oh!

Uh oh!

Uh oh!

ibihim Oct 6, 2023

Choose a reason for hiding this comment

Uh oh!

liouk Jan 24, 2024

Choose a reason for hiding this comment

Uh oh!

ibihim Jan 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liouk commented Oct 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-bot commented Jan 17, 2024

Uh oh!

liouk commented Jan 24, 2024

Uh oh!

liouk commented Jan 25, 2024

Uh oh!

liouk commented Jan 30, 2024

Uh oh!

liouk commented Jan 31, 2024

Uh oh!

liouk commented Feb 8, 2024

Uh oh!

liouk commented Feb 8, 2024

Uh oh!

openshift-bot commented Jun 4, 2024

Uh oh!

liouk commented Jun 4, 2024

Uh oh!

openshift-bot commented Sep 3, 2024

Uh oh!

openshift-bot commented Nov 1, 2024

Uh oh!

liouk commented Nov 1, 2024

Uh oh!

openshift-bot commented Jan 30, 2025

Uh oh!

liouk commented Jan 30, 2025

Uh oh!

openshift-trt bot commented Feb 28, 2025

Uh oh!

openshift-bot commented Aug 2, 2025

Uh oh!

openshift-bot commented Sep 1, 2025

Uh oh!

liouk commented Sep 2, 2025

Uh oh!

openshift-merge-robot commented Oct 3, 2025

Uh oh!

openshift-ci bot commented Nov 18, 2025

Uh oh!

openshift-ci-robot commented Sep 13, 2023 •

edited by openshift-ci bot

Loading

ibihim Jan 25, 2024 •

edited

Loading

liouk commented Oct 18, 2023 •

edited

Loading