OKD-259: Test OKD Feature set Against OKD and OCP clusters #30693
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| package apiserver | ||
|
|
||
| import ( | ||
| "context" | ||
| "strings" | ||
|
|
||
| g "github.com/onsi/ginkgo/v2" | ||
| o "github.com/onsi/gomega" | ||
|
|
||
| configv1 "github.com/openshift/api/config/v1" | ||
| k8serrors "k8s.io/apimachinery/pkg/api/errors" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
|
|
||
| exutil "github.com/openshift/origin/test/extended/util" | ||
| ) | ||
|
|
||
| // isOKD checks if the cluster is an OKD cluster by examining the version string | ||
| func isOKD(oc *exutil.CLI) (bool, error) { | ||
| current, err := exutil.GetCurrentVersion(context.TODO(), oc.AdminConfig()) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| return strings.Contains(current, "okd-scos"), nil | ||
| } | ||
|
|
||
| var _ = g.Describe("[sig-api-machinery][Feature:FeatureGate][OCPFeatureGate:OKD]", func() { | ||
| defer g.GinkgoRecover() | ||
|
|
||
| oc := exutil.NewCLI("featuregate-okd") | ||
|
|
||
| g.It("should reject OKD featureset on OCP clusters [apigroup:config.openshift.io]", func() { | ||
| // Skip this test on OKD clusters - OKD featureset is allowed on OKD | ||
| okdCluster, err := isOKD(oc) | ||
| o.Expect(err).NotTo(o.HaveOccurred(), "Failed to determine if cluster is OKD") | ||
| if okdCluster { | ||
| g.Skip("Skipping test on OKD cluster - OKD featureset is allowed on OKD") | ||
| } | ||
|
|
||
| // Get current FeatureGate | ||
| fgClient := oc.AdminConfigClient().ConfigV1().FeatureGates() | ||
| fg, err := fgClient.Get(context.Background(), "cluster", metav1.GetOptions{}) | ||
| o.Expect(err).NotTo(o.HaveOccurred(), "Failed to get cluster FeatureGate") | ||
|
|
||
| // Attempt to set OKD featureset using dry-run | ||
| fg.Spec.FeatureSet = configv1.OKD | ||
| _, err = fgClient.Update(context.Background(), fg, metav1.UpdateOptions{ | ||
| DryRun: []string{metav1.DryRunAll}, | ||
| }) | ||
|
|
||
| // Expect validation error on OCP clusters | ||
| o.Expect(err).To(o.HaveOccurred(), "OKD featureset should be rejected on OCP clusters") | ||
| o.Expect(err.Error()).To(o.ContainSubstring("OKD featureset is not supported on OpenShift clusters")) | ||
| o.Expect(k8serrors.IsInvalid(err)).To(o.BeTrue(), "Error should be an Invalid error") | ||
| }) | ||
| }) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -337,10 +337,10 @@ func generateClusterImagePolicies() map[string]configv1.ClusterImagePolicy { | |
| ObjectMeta: metav1.ObjectMeta{Name: invalidPublicKeyClusterImagePolicyName}, | ||
| Spec: configv1.ClusterImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testSignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
|
Member
There was a problem hiding this comment. @sanchezl since you authored openshift/api#2626, could you take a look at these changes?
Contributor
Author
There was a problem hiding this comment. For some context, unit tests would fail without this change as I vendored the API repo |
||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PublicKeyRootOfTrust, | ||
| PublicKey: &configv1.ImagePolicyPublicKeyRootOfTrust{ | ||
| KeyData: []byte(`-----BEGIN PUBLIC KEY----- | ||
| MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+ | ||
| 2/Yz5Y8GcN3zFE6ViIvkGnHhMlAhXaX/bo0M9R62s0/6q++T7uwNFuOg8A== | ||
|
|
@@ -361,10 +361,10 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+ | |
| ObjectMeta: metav1.ObjectMeta{Name: publiKeyRekorClusterImagePolicyName}, | ||
| Spec: configv1.ClusterImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testSignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PublicKeyRootOfTrust, | ||
| PublicKey: &configv1.ImagePolicyPublicKeyRootOfTrust{ | ||
| KeyData: []byte(`-----BEGIN PUBLIC KEY----- | ||
| MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5 | ||
| 60l1/qUU0fRATNSCVORCog5PDFo5z0ZLeblWgwbn4c8xpvuo9jQFwpeOsg== | ||
|
|
@@ -385,10 +385,10 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5 | |
| ObjectMeta: metav1.ObjectMeta{Name: invalidPKIClusterImagePolicyName}, | ||
| Spec: configv1.ClusterImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testPKISignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PKIRootOfTrust, | ||
| PKI: &configv1.ImagePolicyPKIRootOfTrust{ | ||
| CertificateAuthorityRootsData: []byte(`-----BEGIN CERTIFICATE----- | ||
| MIICYDCCAgagAwIBAgIUTq5IQKTGqI9XDqGzdGzm8mI43qkwCgYIKoZIzj0EAwIw | ||
| fDELMAkGA1UEBhMCLS0xDjAMBgNVBAgTBVNUQVRFMREwDwYDVQQHEwhMT0NBTElU | ||
|
|
@@ -423,10 +423,10 @@ TAIhALlR4yZRRYv2iaVPdgaptAI0LoDAtEUiO8Rb9FWJzpAN | |
| ObjectMeta: metav1.ObjectMeta{Name: pkiClusterImagePolicyName}, | ||
| Spec: configv1.ClusterImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testPKISignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PKIRootOfTrust, | ||
| PKI: &configv1.ImagePolicyPKIRootOfTrust{ | ||
| CertificateAuthorityRootsData: []byte(`-----BEGIN CERTIFICATE----- | ||
| MIIFvzCCA6egAwIBAgIUZnH3ITyYQMAp6lvNYc0fjRzzuBcwDQYJKoZIhvcNAQEL | ||
| BQAwbjELMAkGA1UEBhMCRVMxETAPBgNVBAcMCFZhbGVuY2lhMQswCQYDVQQKDAJJ | ||
|
|
@@ -479,10 +479,10 @@ L8ITFP+Nw9Meiw4etw59CTAPCc7l4Zvwr1K2ZTBmVGxrqdasiqpI0utG69aItsPi | |
| ObjectMeta: metav1.ObjectMeta{Name: invalidEmailPKIClusterImagePolicyName}, | ||
| Spec: configv1.ClusterImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testPKISignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PKIRootOfTrust, | ||
| PKI: &configv1.ImagePolicyPKIRootOfTrust{ | ||
| CertificateAuthorityRootsData: []byte(`-----BEGIN CERTIFICATE----- | ||
| MIIFvzCCA6egAwIBAgIUZnH3ITyYQMAp6lvNYc0fjRzzuBcwDQYJKoZIhvcNAQEL | ||
| BQAwbjELMAkGA1UEBhMCRVMxETAPBgNVBAcMCFZhbGVuY2lhMQswCQYDVQQKDAJJ | ||
|
|
@@ -541,10 +541,10 @@ func generateImagePolicies() map[string]configv1.ImagePolicy { | |
| ObjectMeta: metav1.ObjectMeta{Name: invalidPublicKeyImagePolicyName}, | ||
| Spec: configv1.ImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testSignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PublicKeyRootOfTrust, | ||
| PublicKey: &configv1.ImagePolicyPublicKeyRootOfTrust{ | ||
| KeyData: []byte(`-----BEGIN PUBLIC KEY----- | ||
| MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+ | ||
| 2/Yz5Y8GcN3zFE6ViIvkGnHhMlAhXaX/bo0M9R62s0/6q++T7uwNFuOg8A== | ||
|
|
@@ -565,10 +565,10 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+ | |
| ObjectMeta: metav1.ObjectMeta{Name: publiKeyRekorImagePolicyName}, | ||
| Spec: configv1.ImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testSignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PublicKeyRootOfTrust, | ||
| PublicKey: &configv1.ImagePolicyPublicKeyRootOfTrust{ | ||
| KeyData: []byte(`-----BEGIN PUBLIC KEY----- | ||
| MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5 | ||
| 60l1/qUU0fRATNSCVORCog5PDFo5z0ZLeblWgwbn4c8xpvuo9jQFwpeOsg== | ||
|
|
@@ -589,10 +589,10 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5 | |
| ObjectMeta: metav1.ObjectMeta{Name: invalidPKIImagePolicyName}, | ||
| Spec: configv1.ImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testPKISignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PKIRootOfTrust, | ||
| PKI: &configv1.ImagePolicyPKIRootOfTrust{ | ||
| CertificateAuthorityRootsData: []byte(`-----BEGIN CERTIFICATE----- | ||
| MIICYDCCAgagAwIBAgIUTq5IQKTGqI9XDqGzdGzm8mI43qkwCgYIKoZIzj0EAwIw | ||
| fDELMAkGA1UEBhMCLS0xDjAMBgNVBAgTBVNUQVRFMREwDwYDVQQHEwhMT0NBTElU | ||
|
|
@@ -627,10 +627,10 @@ TAIhALlR4yZRRYv2iaVPdgaptAI0LoDAtEUiO8Rb9FWJzpAN | |
| ObjectMeta: metav1.ObjectMeta{Name: pkiImagePolicyName}, | ||
| Spec: configv1.ImagePolicySpec{ | ||
| Scopes: []configv1.ImageScope{testPKISignedPolicyScope}, | ||
| Policy: configv1.ImageSigstoreVerificationPolicy{ | ||
| RootOfTrust: configv1.PolicyRootOfTrust{ | ||
| PolicyType: configv1.PKIRootOfTrust, | ||
| PKI: &configv1.ImagePolicyPKIRootOfTrust{ | ||
| CertificateAuthorityRootsData: []byte(`-----BEGIN CERTIFICATE----- | ||
| MIIFvzCCA6egAwIBAgIUZnH3ITyYQMAp6lvNYc0fjRzzuBcwDQYJKoZIhvcNAQEL | ||
| BQAwbjELMAkGA1UEBhMCRVMxETAPBgNVBAcMCFZhbGVuY2lhMQswCQYDVQQKDAJJ | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was clearly wrong, good catch. However, this change is unrelated to this commit, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
By commit do you mean this PR in general or the commit
Fixed monitor and imagepolicy.go errors from vendoring? The reason for these changes is for some reason after vendoring the API repo both monitor.go and imagepolicy.go would throw errors. I decided to keep it in a separate commit rather than putting it in the Vendor API commit as I'm manually editing code, but I can squash it into theVendored API repocommit if you'd like.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I meant the commit
Fixed monitor and imagepolicy.go errors from vendoring. Thanks for clarifying. I thought this change wasn't related to the commit.