Skip to content

Commit c0443a7

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #8191 from adrianmoisey/enable-flakey-tests
Enable TestUnchangedCAReloader tests
2 parents 2511e44 + 8d90da9 commit c0443a7

File tree

1 file changed

+116
-117
lines changed

1 file changed

+116
-117
lines changed

‎vertical-pod-autoscaler/pkg/admission-controller/certs_test.go

Lines changed: 116 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -276,120 +276,119 @@ func TestChangedCAReloader(t *testing.T) {
276276
assert.NotEqual(t, oldCAEncodedString, newCAEncodedString, "expected CA to change")
277277
}
278278

279-
// TODO(omerap12): Temporary workaround for flakiness (#7831)
280-
// func TestUnchangedCAReloader(t *testing.T) {
281-
// tempDir := t.TempDir()
282-
// caCert := &x509.Certificate{
283-
// SerialNumber: big.NewInt(0),
284-
// Subject: pkix.Name{
285-
// Organization: []string{"ca"},
286-
// },
287-
// NotBefore: time.Now(),
288-
// NotAfter: time.Now().AddDate(2, 0, 0),
289-
// IsCA: true,
290-
// ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
291-
// KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
292-
// BasicConstraintsValid: true,
293-
// }
294-
// caKey, err := rsa.GenerateKey(rand.Reader, 4096)
295-
// if err != nil {
296-
// t.Error(err)
297-
// }
298-
// caBytes, err := x509.CreateCertificate(rand.Reader, caCert, caCert, &caKey.PublicKey, caKey)
299-
// if err != nil {
300-
// t.Error(err)
301-
// }
302-
// caPath := path.Join(tempDir, "ca.crt")
303-
// caFile, err := os.Create(caPath)
304-
// if err != nil {
305-
// t.Error(err)
306-
// }
307-
// err = pem.Encode(caFile, &pem.Block{
308-
// Type: "CERTIFICATE",
309-
// Bytes: caBytes,
310-
// })
311-
// if err != nil {
312-
// t.Error(err)
313-
// }
314-
315-
// testClientSet := fake.NewSimpleClientset()
316-
317-
// selfRegistration(
318-
// testClientSet,
319-
// readFile(caPath),
320-
// 0*time.Second,
321-
// "default",
322-
// "vpa-service",
323-
// "http://example.com/",
324-
// true,
325-
// int32(32),
326-
// "",
327-
// []string{},
328-
// false,
329-
// "key1:value1,key2:value2",
330-
// )
331-
332-
// webhookConfigInterface := testClientSet.AdmissionregistrationV1().MutatingWebhookConfigurations()
333-
// oldWebhookConfig, err := webhookConfigInterface.Get(context.TODO(), webhookConfigName, metav1.GetOptions{})
334-
// if err != nil {
335-
// t.Error(err)
336-
// }
337-
338-
// assert.Len(t, oldWebhookConfig.Webhooks, 1, "expected one webhook configuration")
339-
// webhook := oldWebhookConfig.Webhooks[0]
340-
// oldWebhookCABundle := webhook.ClientConfig.CABundle
341-
342-
// var reloadWebhookCACalled, patchCalled atomic.Bool
343-
// reloadWebhookCACalled.Store(false)
344-
// patchCalled.Store(false)
345-
// testClientSet.PrependReactor("get", "mutatingwebhookconfigurations", func(action k8stesting.Action) (bool, runtime.Object, error) {
346-
// reloadWebhookCACalled.Store(true)
347-
// return false, nil, nil
348-
// })
349-
// testClientSet.PrependReactor("patch", "mutatingwebhookconfigurations", func(action k8stesting.Action) (bool, runtime.Object, error) {
350-
// patchCalled.Store(true)
351-
// return false, nil, nil
352-
// })
353-
354-
// reloader := certReloader{
355-
// clientCaPath: caPath,
356-
// mutatingWebhookClient: testClientSet.AdmissionregistrationV1().MutatingWebhookConfigurations(),
357-
// }
358-
// stop := make(chan struct{})
359-
// defer close(stop)
360-
// if err := reloader.start(stop); err != nil {
361-
// t.Error(err)
362-
// }
363-
364-
// originalCaFile, err := os.ReadFile(caPath)
365-
// if err != nil {
366-
// t.Error(err)
367-
// }
368-
// err = os.WriteFile(caPath, originalCaFile, 0666)
369-
// if err != nil {
370-
// t.Error(err)
371-
// }
372-
373-
// oldCAEncodedString := base64.StdEncoding.EncodeToString(oldWebhookCABundle)
374-
375-
// for tries := 0; tries < 10; tries++ {
376-
// if reloadWebhookCACalled.Load() {
377-
// break
378-
// }
379-
// time.Sleep(1 * time.Second)
380-
// }
381-
// if !reloadWebhookCACalled.Load() {
382-
// t.Error("expected reloadWebhookCA to be called")
383-
// }
384-
385-
// assert.False(t, patchCalled.Load(), "expected patch to not be called")
386-
387-
// newWebhookConfig, err := webhookConfigInterface.Get(context.TODO(), webhookConfigName, metav1.GetOptions{})
388-
// assert.Nil(t, err, "expected no error")
389-
// assert.NotNil(t, newWebhookConfig, "expected webhook configuration")
390-
// assert.Len(t, newWebhookConfig.Webhooks, 1, "expected one webhook configuration")
391-
392-
// newWebhookCABundle := newWebhookConfig.Webhooks[0].ClientConfig.CABundle
393-
// newCAEncodedString := base64.StdEncoding.EncodeToString(newWebhookCABundle)
394-
// assert.Equal(t, oldCAEncodedString, newCAEncodedString, "expected CA to not change")
395-
// }
279+
func TestUnchangedCAReloader(t *testing.T) {
280+
tempDir := t.TempDir()
281+
caCert := &x509.Certificate{
282+
SerialNumber: big.NewInt(0),
283+
Subject: pkix.Name{
284+
Organization: []string{"ca"},
285+
},
286+
NotBefore: time.Now(),
287+
NotAfter: time.Now().AddDate(2, 0, 0),
288+
IsCA: true,
289+
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
290+
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
291+
BasicConstraintsValid: true,
292+
}
293+
caKey, err := rsa.GenerateKey(rand.Reader, 4096)
294+
if err != nil {
295+
t.Error(err)
296+
}
297+
caBytes, err := x509.CreateCertificate(rand.Reader, caCert, caCert, &caKey.PublicKey, caKey)
298+
if err != nil {
299+
t.Error(err)
300+
}
301+
caPath := path.Join(tempDir, "ca.crt")
302+
caFile, err := os.Create(caPath)
303+
if err != nil {
304+
t.Error(err)
305+
}
306+
err = pem.Encode(caFile, &pem.Block{
307+
Type: "CERTIFICATE",
308+
Bytes: caBytes,
309+
})
310+
if err != nil {
311+
t.Error(err)
312+
}
313+
314+
testClientSet := fake.NewSimpleClientset()
315+
316+
selfRegistration(
317+
testClientSet,
318+
readFile(caPath),
319+
0*time.Second,
320+
"default",
321+
"vpa-service",
322+
"http://example.com/",
323+
true,
324+
int32(32),
325+
"",
326+
[]string{},
327+
false,
328+
"key1:value1,key2:value2",
329+
)
330+
331+
webhookConfigInterface := testClientSet.AdmissionregistrationV1().MutatingWebhookConfigurations()
332+
oldWebhookConfig, err := webhookConfigInterface.Get(context.TODO(), webhookConfigName, metav1.GetOptions{})
333+
if err != nil {
334+
t.Error(err)
335+
}
336+
337+
assert.Len(t, oldWebhookConfig.Webhooks, 1, "expected one webhook configuration")
338+
webhook := oldWebhookConfig.Webhooks[0]
339+
oldWebhookCABundle := webhook.ClientConfig.CABundle
340+
341+
var reloadWebhookCACalled, patchCalled atomic.Bool
342+
reloadWebhookCACalled.Store(false)
343+
patchCalled.Store(false)
344+
testClientSet.PrependReactor("get", "mutatingwebhookconfigurations", func(action k8stesting.Action) (bool, runtime.Object, error) {
345+
reloadWebhookCACalled.Store(true)
346+
return false, nil, nil
347+
})
348+
testClientSet.PrependReactor("patch", "mutatingwebhookconfigurations", func(action k8stesting.Action) (bool, runtime.Object, error) {
349+
patchCalled.Store(true)
350+
return false, nil, nil
351+
})
352+
353+
reloader := certReloader{
354+
clientCaPath: caPath,
355+
mutatingWebhookClient: testClientSet.AdmissionregistrationV1().MutatingWebhookConfigurations(),
356+
}
357+
stop := make(chan struct{})
358+
defer close(stop)
359+
if err := reloader.start(stop); err != nil {
360+
t.Error(err)
361+
}
362+
363+
originalCaFile, err := os.ReadFile(caPath)
364+
if err != nil {
365+
t.Error(err)
366+
}
367+
err = os.WriteFile(caPath, originalCaFile, 0666)
368+
if err != nil {
369+
t.Error(err)
370+
}
371+
372+
oldCAEncodedString := base64.StdEncoding.EncodeToString(oldWebhookCABundle)
373+
374+
for tries := 0; tries < 10; tries++ {
375+
if reloadWebhookCACalled.Load() {
376+
break
377+
}
378+
time.Sleep(1 * time.Second)
379+
}
380+
if !reloadWebhookCACalled.Load() {
381+
t.Error("expected reloadWebhookCA to be called")
382+
}
383+
384+
assert.False(t, patchCalled.Load(), "expected patch to not be called")
385+
386+
newWebhookConfig, err := webhookConfigInterface.Get(context.TODO(), webhookConfigName, metav1.GetOptions{})
387+
assert.Nil(t, err, "expected no error")
388+
assert.NotNil(t, newWebhookConfig, "expected webhook configuration")
389+
assert.Len(t, newWebhookConfig.Webhooks, 1, "expected one webhook configuration")
390+
391+
newWebhookCABundle := newWebhookConfig.Webhooks[0].ClientConfig.CABundle
392+
newCAEncodedString := base64.StdEncoding.EncodeToString(newWebhookCABundle)
393+
assert.Equal(t, oldCAEncodedString, newCAEncodedString, "expected CA to not change")
394+
}

0 commit comments

Comments
 (0)