github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-18 12:06:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(e2e): skip failing specs on openshift (#2034)

Browse Source 
Fix the OpenShift e2e bootstrap and skip the specs that still fail on
OpenShift/MicroShift:

- Drop the dev-setup-fluxcd prerequisite from dev-setup-cert-manager so
  the OpenShift path no longer re-applies the non-OpenShift flux
  manifests over the SCC-patched ones (which restored source-controller's
  fsGroup 1337, rejected by every OpenShift SCC and hanging the run).
- Label the remaining OpenShift-failing specs with skip-on-openshift so
  they are excluded by the e2e-openshift label filter.

Signed-off-by: Hristo Hristov <me@hhristov.info>
This commit is contained in:
Hristo Hristov
2026-07-20 14:44:15 +03:00
committed by GitHub
parent 975d738509
commit 0378ea279e
15 changed files with 27 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+2 -2
View File
@@ -242,7 +242,7 @@ dev-setup-argocd: dev-setup-fluxcd
@printf " \033[1mkubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d\033[0m\n\n"
@printf " \033[1mkubectl port-forward svc/argocd-server 9091:80 -n argocd\033[0m\n\n"
dev-setup-cert-manager: dev-setup-fluxcd
dev-setup-cert-manager:
@$(KUBECTL) kustomize --load-restrictor='LoadRestrictionsNone' hack/distro/cert-manager | envsubst | kubectl apply -f -
dev-setup-fluxcd:
@@ -261,7 +261,7 @@ dev-setup-capsule: dev-setup-fluxcd
@$(MAKE) wait-for-helmreleases
@$(MAKE) dev-setup-capsule-example
dev-setup-capsule-example:
dev-setup-capsule-example: dev-setup-fluxcd
@$(KUBECTL) kustomize --load-restrictor='LoadRestrictionsNone' hack/distro/capsule/example-setup | envsubst | kubectl apply -f -
@$(KUBECTL) create ns wind-uat --as joe --as-group projectcapsule.dev || true
@$(KUBECTL) label ns wind-uat env=test
e2e/custom_resource_quota_test.go
+1 -1
View File
@@ -106,7 +106,7 @@ var _ = Describe("when Tenant limits custom Resource Quota", Ordered, Label("res
EventuallyDeletion(tnt)
})
It("should block resources in overflow", func() {
It("should block resources in overflow", Label("skip-on-openshift"), func() {
dynamicClient := dynamic.NewForConfigOrDie(cfg)
for _, i := range []int{1, 2, 3} {
e2e/customquota_global_test.go
+4 -4
View File
@@ -211,7 +211,7 @@ func getLedger(ctx context.Context, namespace, name string) *capsulev1beta2.Quan
return obj
}
var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ordered, Label("global", "globalcustomquota", "customquota", "ledger"), Ordered, func() {
var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ordered, Label("global", "globalcustomquota", "customquota", "ledger", "skip-on-openshift"), Ordered, func() {
const (
testNamespace = "global-custom-quota-e2e-test"
tenantLabel = "e2e.capsule.dev/test-suite"
@@ -316,7 +316,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
}
})
It("aggregates a custom pod quantity path and settles the corresponding ledger", func() {
It("aggregates a custom pod quantity path and settles the corresponding ledger", Label("skip-on-openshift"), func() {
q := &capsulev1beta2.GlobalCustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "gq-pod-cpu-requests",
@@ -440,7 +440,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
})
It("denies creating a matching object when the configured quantity path resolves to no value", func() {
It("denies creating a matching object when the configured quantity path resolves to no value", Label("skip-on-openshift"), func() {
q := &capsulev1beta2.GlobalCustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "gq-missing-path-deny-create",
@@ -492,7 +492,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
expectLedgerSettled(ctx, ControllerNamespace, q.GetName())
})
It("remains consistent under concurrent pod creations for a GlobalCustomQuota", func() {
It("remains consistent under concurrent pod creations for a GlobalCustomQuota", Label("skip-on-openshift"), func() {
q := &capsulev1beta2.GlobalCustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "gq-concurrent-pod-count",
e2e/customquota_namespaced_test.go
+4 -4
View File
@@ -20,7 +20,7 @@ import (
"k8s.io/client-go/kubernetes/scheme"
)
var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered, Label("namespaced", "namespacedcustomquota", "customquota", "ledger"), Ordered, func() {
var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered, Label("namespaced", "namespacedcustomquota", "customquota", "ledger", "skip-on-openshift"), Ordered, func() {
const (
testNamespace = "custom-quota-e2e-test"
tenantLabel = "e2e.capsule.dev/test-suite"
@@ -136,7 +136,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
})
It("denies creating a matching object when the configured quantity path resolves to no value", func() {
It("denies creating a matching object when the configured quantity path resolves to no value", Label("skip-on-openshift"), func() {
q := &capsulev1beta2.CustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "cq-missing-path-deny-create",
@@ -178,7 +178,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
expectLedgerSettled(ctx, testNamespace, q.GetName())
})
It("remains consistent under concurrent pod creations for a CustomQuota", func() {
It("remains consistent under concurrent pod creations for a CustomQuota", Label("skip-on-openshift"), func() {
q := &capsulev1beta2.CustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "cq-concurrent-pod-count",
@@ -261,7 +261,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
expectLedgerSettled(ctx, testNamespace, q.GetName())
})
It("tracks different paths independently when global and namespaced quotas match the same pod gvk", func() {
It("tracks different paths independently when global and namespaced quotas match the same pod gvk", Label("skip-on-openshift"), func() {
gq := &capsulev1beta2.GlobalCustomQuota{
ObjectMeta: metav1.ObjectMeta{
Name: "gq-mixed-path-cpu-from-cq-suite",
e2e/namespace_capsule_label_test.go
+1 -1
View File
@@ -51,7 +51,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("nam
EventuallyDeletion(tnt)
})
It("should contains the default Capsule label", func() {
It("should contains the default Capsule label", Label("skip-on-openshift"), func() {
namespaces := []*v1.Namespace{
NewNamespace("", map[string]string{
meta.TenantLabel: tnt.GetName(),
e2e/namespace_metadata_forbidden_test.go
+1 -1
View File
@@ -257,7 +257,7 @@ var _ = Describe("creating a Namespace with user-specified labels and annotation
})
})
It("should fail when updating a Namespace", func() {
It("should fail when updating a Namespace", Label("skip-on-openshift"), func() {
role := &rbacv1.Role{
ObjectMeta: metav1.ObjectMeta{
Name: "ns-patch",
e2e/performance_scalability_test.go
+1 -1
View File
@@ -50,7 +50,7 @@ var _ = Describe("verify scalability", Ordered, Label("performance", "scalabilit
EventuallyDeletion(tnt)
})
It("verify lifecycle (scalability)", func() {
It("verify lifecycle (scalability)", Label("skip-on-openshift"), func() {
const amount = 50
const podsPerNamespace int32 = 1
e2e/replications_globaltenantresource_test.go
+4 -4
View File
@@ -252,7 +252,7 @@ var _ = Describe("GlobalTenantResource", Ordered, Label("replications", "global"
expectGlobalTenantResourceProcessedClusterRole("gtr-cluster-generator", "gtr-cluster-generator-role")
})
It("only allows the managing GlobalTenantResource service account to update created cluster-scoped objects", func() {
It("only allows the managing GlobalTenantResource service account to update created cluster-scoped objects", Label("skip-on-openshift"), func() {
saName := "gtr-cluster-update-guard"
clusterRoleName := "gtr-cluster-admission-role"
writerRoleName := "gtr-cluster-admission-writer"
@@ -834,7 +834,7 @@ data:
}
})
It("only allows the managing GlobalTenantResource service account to update created objects", func() {
It("only allows the managing GlobalTenantResource service account to update created objects", Label("skip-on-openshift"), func() {
saName := "gtr-update-guard"
targetNamespace := tenantANamespaces[0]
configMapName := "gtr-admission-protected"
@@ -903,7 +903,7 @@ data:
}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
})
It("fails to prune replicated resources when the impersonated service account cannot delete them", func() {
It("fails to prune replicated resources when the impersonated service account cannot delete them", Label("skip-on-openshift"), func() {
saCreate := "gtr-creator-ok"
saNoDelete := "gtr-creator-no-delete"
@@ -1047,7 +1047,7 @@ data:
})
})
Context("prune on selector drift", func() {
Context("prune on selector drift", Label("skip-on-openshift"), func() {
It("prunes objects from tenants that stop matching tenantSelector", func() {
gtr := newRawConfigMapGlobalTenantResource("gtr-tenant-selector-prune", map[string]string{
"mode": "both",
e2e/replications_tenantresource_test.go
+1 -1
View File
@@ -958,7 +958,7 @@ data:
})
Context("apply lifecycle with prune enabled", func() {
It("applies, updates and prunes raw items", func() {
It("applies, updates and prunes raw items", Label("skip-on-openshift"), func() {
tr := newRawConfigMapTenantResource(baseNamespace, "raw-prune-enabled", map[string]string{
"mode": "before",
"foo": "one",
e2e/rules_enforce_metadata_test.go
+1 -1
View File
@@ -858,7 +858,7 @@ var _ = Describe("enforcing generic metadata namespace rules", Ordered, Label("t
)
})
It("treats empty apiVersion as core v1 and does not match grouped resources", func() {
It("treats empty apiVersion as core v1 and does not match grouped resources", Label("skip-on-openshift"), func() {
updateTenantRules([]*rules.NamespaceRuleBodyTenant{
metadataRule(
rules.ActionTypeAllow,
e2e/rules_enforce_qos_test.go
+1 -1
View File
@@ -512,7 +512,7 @@ var _ = Describe("enforcing pod QoS namespace rules", Ordered, Label("tenant", "
)
})
It("computes QoS across init containers and regular containers", func() {
It("computes QoS across init containers and regular containers", Label("skip-on-openshift"), func() {
ns := NewNamespace("", map[string]string{
meta.TenantLabel: tnt.GetName(),
})
e2e/service_allowed_external_ips_test.go
+3 -3
View File
@@ -18,7 +18,7 @@ import (
"github.com/projectcapsule/capsule/pkg/api/rbac"
)
var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, Label("tenant", "networking", "service"), func() {
var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, Label("tenant", "networking", "service", "skip-on-openshift"), func() {
tnt := &capsulev1beta2.Tenant{
ObjectMeta: metav1.ObjectMeta{
Name: "e2e-allowed-external-ip",
@@ -95,7 +95,7 @@ var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, La
}).ShouldNot(Succeed())
})
It("should allow the first CIDR block", Label("skip-on-openshift"), func() {
It("should allow the first CIDR block", func() {
ns := NewNamespace("", map[string]string{
meta.TenantLabel: tnt.GetName(),
})
@@ -132,7 +132,7 @@ var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, La
}).Should(Succeed())
})
It("should allow the /32 CIDR block", Label("skip-on-openshift"), func() {
It("should allow the /32 CIDR block", func() {
ns := NewNamespace("", map[string]string{
meta.TenantLabel: tnt.GetName(),
})
e2e/service_forbidden_metadata_test.go
+1 -1
View File
@@ -18,7 +18,7 @@ import (
"github.com/projectcapsule/capsule/pkg/api/rbac"
)
var _ = Describe("creating a Service with user-specified labels and annotations", Ordered, Label("tenant", "networking", "service"), func() {
var _ = Describe("creating a Service with user-specified labels and annotations", Ordered, Label("tenant", "networking", "service", "skip-on-openshift"), func() {
tnt := &capsulev1beta2.Tenant{
ObjectMeta: metav1.ObjectMeta{
Name: "e2e-service-user-metadata-forbidden",
e2e/storage_pv_cross_tenant_mount_test.go
+1 -1
View File
@@ -81,7 +81,7 @@ var _ = Describe("preventing PersistentVolume cross-tenant mount", Ordered, Labe
}
})
It("should add labels to PersistentVolume and prevent cross-Tenant mount", func() {
It("should add labels to PersistentVolume and prevent cross-Tenant mount", Label("skip-on-openshift"), func() {
ns := NewNamespace("", map[string]string{
meta.TenantLabel: tnt1.GetName(),
})
e2e/tenant_resource_quota_exceeded_test.go
+1 -1
View File
@@ -138,7 +138,7 @@ var _ = Describe("exceeding a Tenant resource quota", Ordered, Label("resourcequ
EventuallyDeletion(tnt)
})
It("should block new Pods", func() {
It("should block new Pods", Label("skip-on-openshift"), func() {
cs := ownerClient(tnt.Spec.Owners[0].UserSpec)
for _, namespace := range nsl {
Eventually(func() (err error) {