diff --git a/go.mod b/go.mod index cb80c9a..fd2f1ab 100644 --- a/go.mod +++ b/go.mod @@ -21,7 +21,6 @@ require ( k8s.io/apimachinery v0.29.0 k8s.io/client-go v0.29.0 k8s.io/klog/v2 v2.120.1 - k8s.io/kubectl v0.25.10 k8s.io/utils v0.0.0-20230726121419-3b25d923346b sigs.k8s.io/controller-runtime v0.15.1 sigs.k8s.io/e2e-framework v0.3.0 diff --git a/go.sum b/go.sum index 84590e2..0362f94 100644 --- a/go.sum +++ b/go.sum @@ -413,8 +413,6 @@ k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65/go.mod h1:sX9MT8g7NVZM5lV k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk= k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780= k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA= -k8s.io/kubectl v0.25.10 h1:XWDG6sMzlUMXfQ0ueRNUI5O2+x1N1XxK6XVrCPPZwxI= -k8s.io/kubectl v0.25.10/go.mod h1:+p6MgNAxmYbCQoQMlCLbRWqi926Q+diY/x6ZB0JQtxs= k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI= diff --git a/osde2e/managed_cluster_validating_webhooks_test.go b/osde2e/managed_cluster_validating_webhooks_test.go index 14b1332..c953eaf 100644 --- a/osde2e/managed_cluster_validating_webhooks_test.go +++ b/osde2e/managed_cluster_validating_webhooks_test.go @@ -27,7 +27,6 @@ import ( "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/client-go/dynamic" "k8s.io/client-go/kubernetes/scheme" - "k8s.io/kubectl/pkg/util/slice" "sigs.k8s.io/controller-runtime/pkg/client/config" "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/e2e-framework/klient/k8s" @@ -43,7 +42,6 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { dedicatedAdmink8s *openshift.Client userk8s *openshift.Client clusterAdmink8s *openshift.Client - err error unauthenticatedk8s *openshift.Client dynamicClient dynamic.Interface testNamespace *v1.Namespace @@ -117,8 +115,10 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { ) var pod *v1.Pod - newTestPod := func(name string) *v1.Pod { - return &v1.Pod{ + + BeforeAll(func() { + name := envconf.RandomName("testpod", 12) + pod = &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: name, }, @@ -142,18 +142,13 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { }, }, } - } + }) withNamespace := func(pod *v1.Pod, namespace string) *v1.Pod { pod.SetNamespace(namespace) return pod } - BeforeAll(func() { - name := envconf.RandomName("testpod", 12) - pod = newTestPod(name) - }) - It("blocks pods scheduled onto master/infra nodes", func(ctx context.Context) { err := dedicatedAdmink8s.Create(ctx, withNamespace(pod, privilegedNamespace)) Expect(apierrors.IsForbidden(err)).To(BeTrue()) @@ -203,7 +198,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { } var podList v1.PodList - err = client.WithNamespace(metav1.NamespaceAll).List(ctx, &podList) + err := client.WithNamespace(metav1.NamespaceAll).List(ctx, &podList) Expect(err).ShouldNot(HaveOccurred(), "unable to list pods") Expect(len(podList.Items)).To(BeNumerically(">", 0), "found no pods") @@ -224,7 +219,14 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { continue } if strings.HasPrefix(pod.GetName(), operator) && !strings.HasPrefix(pod.GetName(), operator+"-registry") { - if !slice.ContainsString(nodeNames, pod.Spec.NodeName, nil) { + found := false + for _, nodeName := range nodeNames { + if nodeName == pod.Spec.NodeName { + found = true + break + } + } + if !found { violators = append(violators, pod.GetNamespace()+"/"+pod.GetName()) } } @@ -269,7 +271,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { BeforeAll(func(ctx context.Context) { testNamespace = &v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: testNsName}} - err = client.Create(ctx, testNamespace) + err := client.Create(ctx, testNamespace) Expect(err).ShouldNot(HaveOccurred(), "Unable to create test namespace") }) @@ -291,7 +293,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { It("blocks modifications to nodes", func(ctx context.Context) { var nodes v1.NodeList selectInfraNodes := resources.WithLabelSelector(labels.FormatLabels(map[string]string{"node-role.kubernetes.io": "infra"})) - err = dedicatedAdmink8s.List(ctx, &nodes, selectInfraNodes) + err := dedicatedAdmink8s.List(ctx, &nodes, selectInfraNodes) Expect(err).NotTo(HaveOccurred()) Expect(len(nodes.Items)).Should(BeNumerically(">", 0), "failed to find infra nodes") @@ -305,7 +307,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { // TODO: test "system:serviceaccounts:openshift-backplane-cee" group can use NetNamespace CR It("allows dedicated-admin to manage CustomDomain CRs", func(ctx context.Context) { - dynamicClient, err = dynamic.NewForConfig(dedicatedAdmink8s.GetConfig()) + dynamicClient, err := dynamic.NewForConfig(dedicatedAdmink8s.GetConfig()) Expect(err).ShouldNot(HaveOccurred(), "failed creating the dynamic client: %w", err) cdc := dynamicClient.Resource(schema.GroupVersionResource{ @@ -378,7 +380,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { BeforeAll(func(ctx context.Context) { managedCRQ = newTestCRQ("managed" + quotaName) - err = clusterAdmink8s.Create(ctx, managedCRQ) + err := clusterAdmink8s.Create(ctx, managedCRQ) Expect(err).NotTo(HaveOccurred(), "Failed to create managed ClusterResourceQuota") }) @@ -388,7 +390,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { }) It("blocks deletion of managed ClusterResourceQuotas", func(ctx context.Context) { - err = dedicatedAdmink8s.Delete(ctx, managedCRQ) + err := dedicatedAdmink8s.Delete(ctx, managedCRQ) Expect(errors.IsForbidden(err)).To(BeTrue(), "Expected deletion to be forbidden for dedicatedAdmink8s") err = userk8s.Delete(ctx, managedCRQ) Expect(errors.IsForbidden(err)).To(BeTrue(), "Expected deletion to be forbidden for client") @@ -421,7 +423,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { scc := &securityv1.SecurityContextConstraints{ObjectMeta: metav1.ObjectMeta{Name: "privileged"}} scc.SetLabels(map[string]string{"osde2e": ""}) - err = dedicatedAdmink8s.Update(ctx, scc) + err := dedicatedAdmink8s.Update(ctx, scc) Expect(errors.IsForbidden(err)).To(BeTrue()) err = dedicatedAdmink8s.Delete(ctx, scc) @@ -600,7 +602,7 @@ var _ = Describe("Managed Cluster Validating Webhooks", Ordered, func() { It("allows non-privileged users to manage PrometheusRules in non-privileged namespaces", func(ctx context.Context) { rule := newPrometheusRule("osde2e-temp-ns") - err = dedicatedAdmink8s.Create(ctx, rule) + err := dedicatedAdmink8s.Create(ctx, rule) Expect(err).NotTo(HaveOccurred()) err = dedicatedAdmink8s.Delete(ctx, rule)