Skip to content

DRA: test flake in DRA [Feature:DynamicResourceAllocation] cluster DaemonSet with admin access [Feature:DRAAdminAccess]  #128493

Closed
@pohly

Description

@pohly

Which jobs are flaking?

pull-kubernetes-kind-dra-all

https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/127511/pull-kubernetes-kind-dra-all/1852326009861312512

Which tests are flaking?

DRA [Feature:DynamicResourceAllocation] cluster DaemonSet with admin access

Since when has it been flaking?

Only once so far on 2024-11-01.

Testgrid link

https://testgrid.k8s.io/sig-node-dynamic-resource-allocation#ci-kind-dra-all

Reason for failure (if possible)

"support validating admission policy for admin access" must have run in parallel to "DaemonSet with admin access". The former deploys a VAP which prevents admin access, the latter doesn't.

Anything else we need to know?

This patch should fix, but somehow the namespace selector didn't match the test namespace and thus the VAP didn't trigger anymore:

diff --git a/test/e2e/dra/dra.go b/test/e2e/dra/dra.go
index cb2324e0a5e..1498b0cbea4 100644
--- a/test/e2e/dra/dra.go
+++ b/test/e2e/dra/dra.go
@@ -830,6 +830,10 @@ var _ = framework.SIGDescribe("node")("DRA", feature.DynamicResourceAllocation,
                f.It("support validating admission policy for admin access", feature.DRAAdminAccess, func(ctx context.Context) {
                        // Create VAP, after making it unique to the current test.
                        adminAccessPolicyYAML := strings.ReplaceAll(adminAccessPolicyYAML, "dra.example.com", b.f.UniqueName)
+                       adminAccessPolicyYAML = strings.ReplaceAll(adminAccessPolicyYAML,
+                               "null # namespaceSelector",
+                               fmt.Sprintf(`{matchExpressions: [{key: "metadata.name", operator: "In", values: [%q]}]}`, f.Namespace.Name),
+                       )
                        driver.createFromYAML(ctx, []byte(adminAccessPolicyYAML), "")

diff --git a/test/e2e/dra/test-driver/deploy/example/admin-access-policy.yaml b/test/e2e/dra/test-driver/deploy/example/admin-access-policy.yaml
index 822b1c7d991..964d0f00145 100644
--- a/test/e2e/dra/test-driver/deploy/example/admin-access-policy.yaml
+++ b/test/e2e/dra/test-driver/deploy/example/admin-access-policy.yaml
@@ -22,6 +22,9 @@ spec:
       apiVersions: ["v1alpha3", "v1beta1"]
       operations:  ["CREATE", "UPDATE"]
       resources:   ["resourceclaims"]
+
+    # This is for tests. Don't change the comment!
+    namespaceSelector: null # namespaceSelector
   validations:
     - expression: '! object.spec.devices.requests.exists(e, has(e.adminAccess) && e.adminAccess)'
       reason: Forbidden
@@ -52,6 +55,9 @@ spec:
       apiVersions: ["v1alpha3", "v1beta1"]
       operations:  ["CREATE", "UPDATE"]
       resources:   ["resourceclaimtemplates"]
+
+    # This is for tests. Don't change the comment!
+    namespaceSelector: null # namespaceSelector
   validations:
     - expression: '! object.spec.spec.devices.requests.exists(e, has(e.adminAccess) && e.adminAccess)'
       reason: Forbidden

Relevant SIG(s)

/sig node
/wg device-management

Metadata

Metadata

Assignees

Labels

kind/flakeCategorizes issue or PR as related to a flaky test.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.priority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to complete.sig/nodeCategorizes an issue or PR as relevant to SIG Node.wg/device-managementCategorizes an issue or PR as relevant to WG Device Management.

Type

No type

Projects

Status

✅ Done

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions