e2e: Only create PSP if RBAC is enabled #56382
Conversation
Using PSP in e2e tests depend on RBAC being enabled in the cluster and thus PSP should only be used when RBAC is.
k8s-ci-robot
added
release-note
k8s-ci-robot
added
the
needs-ok-to-test
|
/ok-to-test |
k8s-ci-robot
removed
the
needs-ok-to-test
|
Flake #56262 |
|
CC @tallclair |
test/e2e/framework/psp_util.go
Outdated
| @@ -97,7 +97,7 @@ var ( | |||
| ) | |||
|
|
|||
| func CreatePrivilegedPSPBinding(f *Framework, namespace string) { | |||
| if !IsPodSecurityPolicyEnabled(f) { | |||
| if !IsPodSecurityPolicyEnabled(f) || !IsRBACEnabled(f) { | |||
There was a problem hiding this comment.
If the PSP is enabled, but RBAC is disabled, it probably means the cluster is using ABAC or allow all. In either case, we still want to create the PSP to avoid breaking things, we just don't need to bind it, right?
There was a problem hiding this comment.
In our case we are using a custom authorization webhook instead of RBAC which is ofc. a bit special. I will try and see how it works if only the binding is skipped.
There was a problem hiding this comment.
@tallclair changed it to only create the binding if RBAC is enabled, but always create the PSP PTAL.
|
/unassign @fejta @spiffxp |
k8s-ci-robot
added
size/M
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
/approve |
|
/retest |
|
/approve no-issue |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mikkeloscar, spiffxp, tallclair Associated issue: #57840 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these OWNERS Files:
You can indicate your approval by writing |
k8s-ci-robot
added
the
approved
|
Automatic merge from submit-queue (batch tested with PRs 56382, 57549). If you want to cherry-pick this change to another branch, please follow the instructions here. |
What this PR does / why we need it: Creating privileged PSPs during e2e tests depends on RBAC being enabled in the target cluster. However it is possible to use PSPs without having RBAC enabled thus only enable creating PSPs during e2e tests if both PSP and RBAC is enabled.
Fix #57840
Special notes for your reviewer:
Release note: