Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Promote admission webhook e2e tests to conformance #81857

Merged
merged 2 commits into from
Aug 30, 2019
Merged

Promote admission webhook e2e tests to conformance #81857

merged 2 commits into from
Aug 30, 2019

Conversation

jpbetz
Copy link
Contributor

@jpbetz jpbetz commented Aug 23, 2019 •
edited

Test stability status: https://k8s-testgrid.appspot.com/sig-release-master-blocking#gce-cos-master-default&width=5&sort-by-flakiness=&include-filter-by-regex=.*AdmissionWebhook.*

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Admission webhoooks graduate to GA in 1.16. Conformance tests are now required for graduation to GA.

Which issue(s) this PR fixes:
Fixes #80767

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

/area conformance
@kubernetes/sig-architecture-pr-reviews @kubernetes/sig-api-machinery-pr-reviews @kubernetes/cncf-conformance-wg

/cc @liggitt @roycaihw @sttts @caesarxuchao
/priority important-soon

@k8s-ci-robot k8s-ci-robot added the release-note-none Denotes a PR that doesn't merit a release note. label Aug 23, 2019
@k8s-ci-robot k8s-ci-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. area/conformance Issues or PRs related to kubernetes conformance tests sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Aug 23, 2019
@jpbetz jpbetz force-pushed the admission-conformance branch 2 times, most recently from 626659d to 7f5b08d Compare August 23, 2019 18:19
@k8s-ci-robot k8s-ci-robot added area/test sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Aug 23, 2019
johnbelamaric
johnbelamaric suggested changes Aug 23, 2019
View reviewed changes
Copy link
Member

@johnbelamaric johnbelamaric left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I need to dig into the actual test functionality, but here's a quick couple comments that need addressing.

/assign

test/e2e/apimachinery/webhook.go Outdated Show resolved Hide resolved
test/e2e/apimachinery/webhook.go Outdated Show resolved Hide resolved
@johnbelamaric johnbelamaric added this to Needs Review in conformance-definition Aug 23, 2019
@jpbetz jpbetz mentioned this pull request Aug 23, 2019
Closed
6 tasks
@BenTheElder
Copy link
Member

/retest

@jpbetz
Copy link
Contributor Author

jpbetz commented Aug 23, 2019

/test pull-kubernetes-e2e-aks-engine-azure-windows

@BenTheElder
Copy link
Member

FYI DNS failures like these are currently expected on IPV6, pending a fix, and this job is NOT merge blocking currently. cc @aojea

@jpbetz
Copy link
Contributor Author

jpbetz commented Aug 24, 2019

Thanks for the quick first pass on syntactical issues @johnbelamaric. Feedback is applied.

@jpbetz
Copy link
Contributor Author

jpbetz commented Aug 24, 2019

/test pull-kubernetes-conformance-image-test

@BenTheElder
Copy link
Member

/test pull-kubernetes-e2e-kind

@BenTheElder
Copy link
Member

BenTheElder commented Aug 24, 2019 •
edited

hmm 🤔 EDIT: one of these flaked once in pull-kubernetes-e2e-kind, passed on retest 👍
/retest

@roycaihw roycaihw mentioned this pull request Aug 27, 2019
Merged
@roycaihw
Copy link
Member

thanks @liggitt @johnbelamaric. I'm adding the [Privileged:ClusterAdmin] tag

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 29, 2019
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 29, 2019
@roycaihw
Copy link
Member

rebased and promoted the discovery doc test #82019, to cover all endpoints for conformance

@roycaihw
Copy link
Member

/retest

@smarterclayton
Copy link
Contributor

smarterclayton commented Aug 29, 2019 •
edited

Originally conformance was "make sure apps run on kube clusters the same". We limited privilege because lots of clusters won't allow those privileges. We want conformance to apply to more than just app function (to cover extension function and admin function). We really, really, really need either profiles or to drop the requirements around non-privilege in the short term.

Edited for clarity

@roycaihw
Copy link
Member

/retest

@johnbelamaric
Copy link
Member

/lgtm

Note for conformance approvers: These tests require clusterAdmin, because this functionality is inherently privileged. To mitigate this in environments where the tests cannot be run as clusterAdmin, we added a [Privileged:ClusterAdmin] tag to that they can be easily excluded. This is a new tag and I will propose an update to the docs to cover this case.

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 29, 2019
@johnbelamaric
Copy link
Member

/assign @bgrant0607 @smarterclayton

@johnbelamaric johnbelamaric moved this from Needs Review to Needs Approval in conformance-definition Aug 29, 2019
@smarterclayton
Copy link
Contributor

/approve

This is such a fundamental part of Kube that I think we should get it in conformance, then use this as a focus to sort out profiles. You can be conformant for apps without allowing webhook registration, but you can't be conformant for extension without it.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, smarterclayton

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 29, 2019
@smarterclayton
Copy link
Contributor

/retest

@k8s-ci-robot
Copy link
Contributor

@jpbetz: The following tests failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-aks-engine-azure-windows bc3c37b19d49611fceaedd6acd7aa83b074fe9bb link /test pull-kubernetes-e2e-aks-engine-azure-windows
pull-kubernetes-conformance-image-test 68bafe4 link /test pull-kubernetes-conformance-image-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot merged commit bc089a3 into kubernetes:master Aug 30, 2019
conformance-definition automation moved this from Needs Approval to Done Aug 30, 2019
@liggitt liggitt mentioned this pull request Aug 30, 2019
Closed
@liggitt liggitt moved this from Required for GA, in progress to Complete in Admission Webhooks Aug 30, 2019
@roycaihw
Copy link
Member

/area admission-control

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@aojea aojea aojea left review comments

@johnbelamaric johnbelamaric johnbelamaric requested changes

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

@roycaihw roycaihw Awaiting requested review from roycaihw

@sttts sttts Awaiting requested review from sttts

Assignees

@smarterclayton smarterclayton

@bgrant0607 bgrant0607

@johnbelamaric johnbelamaric

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/admission-control area/conformance Issues or PRs related to kubernetes conformance tests area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note-none Denotes a PR that doesn't merit a release note. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
Admission Webhooks
Complete
conformance-definition
  
Done
Milestone
v1.16
Development

Successfully merging this pull request may close these issues.

Conformance Tests for AdmissionWebhook
9 participants
@jpbetz @BenTheElder @roycaihw @liggitt @johnbelamaric @aojea @smarterclayton @k8s-ci-robot @bgrant0607