diff --git a/test/extended/internalreleaseimage/helper.go b/test/extended/internalreleaseimage/helper.go index 3a440fd48fbe..c1edfec3afed 100644 --- a/test/extended/internalreleaseimage/helper.go +++ b/test/extended/internalreleaseimage/helper.go @@ -4,6 +4,7 @@ import ( "context" "fmt" "strings" + "time" g "github.com/onsi/ginkgo/v2" o "github.com/onsi/gomega" @@ -12,6 +13,7 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/uuid" + "k8s.io/apimachinery/pkg/util/wait" e2e "k8s.io/kubernetes/test/e2e/framework" e2epod "k8s.io/kubernetes/test/e2e/framework/pod" @@ -196,7 +198,7 @@ func (h *IRITestHelper) DeleteTestPod(namespace, name string) { } } -// CreateSimpleNamespace creates a basic namespace without waiting for service account secrets +// CreateSimpleNamespace creates a basic namespace and waits for SCC annotations func (h *IRITestHelper) CreateSimpleNamespace() string { ns := &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{ @@ -208,6 +210,18 @@ func (h *IRITestHelper) CreateSimpleNamespace() string { o.Expect(err).NotTo(o.HaveOccurred(), "Failed to create namespace") e2e.Logf("Created namespace: %s", createdNs.Name) + // Wait for the namespace controller to set the SCC uid-range annotation, + // which is required by the admission controller before pods can be created. + err = wait.PollUntilContextTimeout(context.Background(), 500*time.Millisecond, 30*time.Second, true, func(ctx context.Context) (bool, error) { + updatedNs, err := h.oc.AdminKubeClient().CoreV1().Namespaces().Get(ctx, createdNs.Name, metav1.GetOptions{}) + if err != nil { + return false, err + } + _, exists := updatedNs.Annotations["openshift.io/sa.scc.uid-range"] + return exists, nil + }) + o.Expect(err).NotTo(o.HaveOccurred(), "Timed out waiting for namespace %s to get SCC uid-range annotation", createdNs.Name) + return createdNs.Name }