UPSTREAM: <carry>: allow type mutation for specific secrets

squash with the previous PR during the rebase #1924
openshift · Apr 15, 2024 · 124f7a8 · 124f7a8
1 parent 822d173
commit 124f7a8
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/pkg/apis/core/validation/validation_patch.go b/pkg/apis/core/validation/validation_patch.go
@@ -39,6 +39,7 @@ var (
 		"openshift-kube-apiserver-operator":          {},
 		"openshift-kube-apiserver":                   {},
 		"openshift-kube-controller-manager-operator": {},
+		"openshift-config-managed":                   {},
 	}
 )
 

diff --git a/test/integration/apiserver/openshift_secret_updates_type_mutation_test.go b/test/integration/apiserver/openshift_secret_updates_type_mutation_test.go
@@ -23,6 +23,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/kubernetes"
 	apiservertesting "k8s.io/kubernetes/cmd/kube-apiserver/app/testing"
 	"k8s.io/kubernetes/test/integration/framework"
@@ -33,8 +34,13 @@ var whitelistedSecretNamespaces = map[string]struct{}{
 	"openshift-kube-apiserver-operator":          {},
 	"openshift-kube-apiserver":                   {},
 	"openshift-kube-controller-manager-operator": {},
+	"openshift-config-managed":                   {},
 }
 
+// immortalNamespaces cannot be deleted, give the following error:
+// failed to delete namespace: "" is forbidden: this namespace may not be deleted
+var immortalNamespaces = sets.NewString("openshift-config-managed")
+
 func TestOpenShiftValidateWhiteListedSecretTypeMutationUpdateAllowed(t *testing.T) {
 	ctx := context.Background()
 	server, err := apiservertesting.StartTestServer(t, apiservertesting.NewDefaultTestServerOptions(), nil, framework.SharedEtcd())
@@ -51,7 +57,9 @@ func TestOpenShiftValidateWhiteListedSecretTypeMutationUpdateAllowed(t *testing.
 		_, err := client.CoreV1().Namespaces().Get(ctx, whiteListedSecretNamespace, metav1.GetOptions{})
 		if apierrors.IsNotFound(err) {
 			testNamespace := framework.CreateNamespaceOrDie(client, whiteListedSecretNamespace, t)
-			t.Cleanup(func() { framework.DeleteNamespaceOrDie(client, testNamespace, t) })
+			if !immortalNamespaces.Has(testNamespace.Name) {
+				t.Cleanup(func() { framework.DeleteNamespaceOrDie(client, testNamespace, t) })
+			}
 		} else if err != nil {
 			t.Fatal(err)
 		}