Repository: openshift/kubernetes
Pull request #2215: TRT-1854: translate test annotations to use: `include`/`exclude` CEL, labels, filtering
Author: login: smg247
Labels: name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: lgtm
description: Indicates that a PR is ready to be merged.
name: vendor-update
description: Touching vendor dir or related files
name: backports/validated-commits
description: Indicates that all commits come to merged upstream PRs.
name: jira/valid-reference
description: Indicates that this PR references a valid Jira ticket of any type.
Created: 2025-02-24T20:02:30Z | Merged: 2025-03-17T19:17:13Z

`openshift-tests-extension` introduces a new way to skip upstream tests based on environment flags and `include`/`exclude` fields present on the listed tests. This PR translates the existing annotations to that functionality, but leaves them in place. They will be removed in a later PR.


Diff:
diff --git a/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go b/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
new file mode 100644
index 0000000000000..e15e870b0859e
--- /dev/null
+++ b/openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
@@ -0,0 +1,215 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+			"[Feature:volumegroupsnapshot]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+		},
+		// tests that may work, but we don't support them
+		"Unsupported": {
+			"[Driver: rbd]",             // OpenShift 4.x does not support Ceph RBD (use CSI instead)
+			"[Driver: ceph]",            // OpenShift 4.x does not support CephFS (use CSI instead)
+			"[Driver: gluster]",         // OpenShift 4.x does not support Gluster
+			"Volumes GlusterFS",         // OpenShift 4.x does not support Gluster
+			"GlusterDynamicProvisioner", // OpenShift 4.x does not support Gluster
+
+			// Also, our CI doesn't support topology, so disable those tests
+			"[sig-storage] In-tree Volumes [Driver: vsphere] [Testpattern: Dynamic PV (delayed binding)] topology should fail to schedule a pod which has topologies that conflict with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: vsphere] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: vsphere] [Testpattern: Dynamic PV (immediate binding)] topology should fail to schedule a pod which has topologies that conflict with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: vsphere] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+		},
+	}
+
+	var disabledSpecs et.ExtensionTestSpecs
+	for _, disabledList := range disabledByReason {
+		var selectFunctions []et.SelectFunction
+		for _, disabledName := range disabledList {
+			selectFunctions = append(selectFunctions, et.NameContains(disabledName))
+		}
+
+		disabledSpecs = append(disabledSpecs, specs.SelectAny(selectFunctions)...)
+	}
+
+	disabledNames := sets.New[string]()
+	for _, disabledSpec := range disabledSpecs {
+		disabledNames.Insert(disabledSpec.Name)
+	}
+
+	enabledSpecs := specs[:0]
+	for _, spec := range specs {
+		if !disabledNames.Has(spec.Name) {
+			enabledSpecs = append(enabledSpecs, spec)
+		}
+	}
+
+	return enabledSpecs
+}
diff --git a/openshift-hack/cmd/k8s-tests-ext/environment_selectors.go b/openshift-hack/cmd/k8s-tests-ext/environment_selectors.go
new file mode 100644
index 0000000000000..bf6aa2229330c
--- /dev/null
+++ b/openshift-hack/cmd/k8s-tests-ext/environment_selectors.go
@@ -0,0 +1,231 @@
+package main
+
+import et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+
+// addEnvironmentSelectors adds the environmentSelector field to appropriate specs to facilitate including or excluding
+// them based on attributes of the cluster they are running on
+func addEnvironmentSelectors(specs et.ExtensionTestSpecs) {
+	filterByPlatform(specs)
+	filterByExternalConnectivity(specs)
+	filterByTopology(specs)
+	filterByNoOptionalCapabilities(specs)
+	filterByNetwork(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+}
+
+// filterByPlatform is a helper function to do, simple, "NameContains" filtering on tests by platform
+func filterByPlatform(specs et.ExtensionTestSpecs) {
+	var platformExclusions = map[string][]string{
+		"alibabacloud": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"azure": {
+			"Networking should provide Internet connection for containers", // Azure does not allow ICMP traffic to internet.
+			// Azure CSI migration changed how we treat regions without zones.
+			// See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2066865
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+		},
+		"baremetal": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"gce": {
+			// Requires creation of a different compute instance in a different zone and is not compatible with volumeBindingMode of WaitForFirstConsumer which we use in 4.x
+			"[sig-storage] Multi-AZ Cluster Volumes should only be allowed to provision PDs in zones where nodes exist",
+			// The following tests try to ssh directly to a node. None of our nodes have external IPs
+			"[k8s.io] [sig-node] crictl should be able to run crictl on the node",
+			"[sig-storage] Flexvolumes should be mountable",
+			"[sig-storage] Detaching volumes should not work when mount is in progress",
+			// We are using ovn-kubernetes to conceal metadata
+			"[sig-auth] Metadata Concealment should run a check-metadata-concealment job to completion",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1740959
+			"[sig-api-machinery] AdmissionWebhook should be able to deny pod and configmap creation",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1745720
+			"[sig-storage] CSI Volumes [Driver: pd.csi.storage.gke.io]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1749882
+			"[sig-storage] CSI Volumes CSI Topology test using GCE PD driver [Serial]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1751367
+			"gce-localssd-scsi-fs",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1750851
+			// should be serial if/when it's re-enabled
+			"[HPA] Horizontal pod autoscaling (scale resource: Custom Metrics from Stackdriver)",
+			"[Feature:CustomMetricsAutoscaling]",
+		},
+		"ibmcloud": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"ibmroks": {
+			// Calico is allowing the request to timeout instead of returning 'REFUSED'
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825021 - ROKS: calico SDN results in a request timeout when accessing services with no endpoints
+			"[sig-network] Services should be rejected when no endpoints exist",
+			// Nodes in ROKS have access to secrets in the cluster to handle encryption
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825013 - ROKS: worker nodes have access to secrets in the cluster
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent configmap should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent secret should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a secret for a workload the node has access to should succeed",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing configmap should exit with the Forbidden error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing secret should exit with the Forbidden error",
+			// Access to node external address is blocked from pods within a ROKS cluster by Calico
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825016 - e2e: NodeAuthenticator tests use both external and internal addresses for node
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet's main port 10250 should reject requests with no credentials",
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet can delegate ServiceAccount tokens to the API server",
+			// Mode returned by RHEL7 worker contains an extra character not expected by the test: dgtrwx vs dtrwx
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825024 - e2e: Failing test - HostPath should give a volume the correct mode
+			"[sig-storage] HostPath should give a volume the correct mode",
+		},
+		"kubevirt": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"nutanix": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"openstack": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"ovirt": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+		"vsphere": {
+			// LoadBalancer tests in 1.31 require explicit platform-specific skips
+			// https://issues.redhat.com/browse/OCPBUGS-38840
+			"[Feature:LoadBalancer]",
+		},
+	}
+
+	for platform, exclusions := range platformExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.PlatformEquals(platform))
+	}
+}
+
+// filterByExternalConnectivity is a helper function to do, simple, "NameContains" filtering on tests by external connectivity
+func filterByExternalConnectivity(specs et.ExtensionTestSpecs) {
+	var externalConnectivityExclusions = map[string][]string{
+		// Tests that don't pass on disconnected, either due to requiring
+		// internet access for GitHub (e.g. many of the s2i builds), or
+		// because of pullthrough not supporting ICSP (https://bugzilla.redhat.com/show_bug.cgi?id=1918376)
+		"Disconnected": {
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+		// These tests are skipped when openshift-tests needs to use a proxy to reach the
+		// cluster -- either because the test won't work while proxied, or because the test
+		// itself is testing a functionality using it's own proxy.
+		"Proxy": {
+			// These tests setup their own proxy, which won't work when we need to access the
+			// cluster through a proxy.
+			"[sig-cli] Kubectl client Simple pod should support exec through an HTTP proxy",
+			"[sig-cli] Kubectl client Simple pod should support exec through kubectl proxy",
+			// Kube currently uses the x/net/websockets pkg, which doesn't work with proxies.
+			// See: https://github.com/kubernetes/kubernetes/pull/103595
+			"[sig-node] Pods should support retrieving logs from the container over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on localhost should support forwarding over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on 0.0.0.0 should support forwarding over websockets",
+			"[sig-node] Pods should support remote command execution over websockets",
+			// These tests are flacky and require internet access
+			// See https://bugzilla.redhat.com/show_bug.cgi?id=2019375
+			"[sig-network] DNS should resolve DNS of partial qualified names for services",
+			"[sig-network] DNS should provide DNS for the cluster",
+			// This test does not work when using in-proxy cluster, see https://bugzilla.redhat.com/show_bug.cgi?id=2084560
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+	}
+
+	for externalConnectivity, exclusions := range externalConnectivityExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.ExternalConnectivityEquals(externalConnectivity))
+	}
+}
+
+// filterByTopology is a helper function to do, simple, "NameContains" filtering on tests by topology
+func filterByTopology(specs et.ExtensionTestSpecs) {
+	var topologyExclusions = map[string][]string{
+		"SingleReplicaTopology": {
+			"[sig-apps] Daemon set [Serial] should rollback without unnecessary restarts [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] doesn't evict pod with tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] eventually evict pod with finite tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] evicts pods from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] removing taint cancels eviction [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] pods evicted from tainted nodes have pod disruption condition",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] evicts pods with minTolerationSeconds [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] only evicts pods without tolerations from tainted nodes",
+			"[sig-cli] Kubectl client Kubectl taint [Serial] should remove all the taints with the same key off a node",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on different nodes",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on the same nodes",
+			"[sig-architecture] Conformance Tests should have at least two untainted nodes",
+		},
+	}
+
+	for topology, exclusions := range topologyExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.TopologyEquals(topology))
+	}
+}
+
+// filterByNoOptionalCapabilities is a helper function to facilitate adding environment selectors for tests which can't
+// be run/don't make sense to run against a cluster with all optional capabilities disabled
+func filterByNoOptionalCapabilities(specs et.ExtensionTestSpecs) {
+	var exclusions = []string{
+		// Requires CSISnapshot capability
+		"[Feature:VolumeSnapshotDataSource]",
+		// Requires Storage capability
+		"[Driver: aws]",
+		"[Feature:StorageProvider]",
+	}
+
+	var selectFunctions []et.SelectFunction
+	for _, exclusion := range exclusions {
+		selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+	}
+	specs.SelectAny(selectFunctions).Exclude(et.NoOptionalCapabilitiesExist())
+}
+
+// filterByNetwork is a helper function to do, simple, "NameContains" filtering on tests by network
+func filterByNetwork(specs et.ExtensionTestSpecs) {
+	var networkExclusions = map[string][]string{
+		"OVNKubernetes": {
+			"NetworkPolicy",
+			"named port",
+		},
+	}
+
+	for network, exclusions := range networkExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.NetworkEquals(network))
+	}
+}
diff --git a/openshift-hack/cmd/k8s-tests-ext/k8s-tests.go b/openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
index cb7e6a9922fbf..8ba6d88a5b656 100644
--- a/openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
+++ b/openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"reflect"
 
+	"k8s.io/kubernetes/openshift-hack/e2e/annotate/generated"
 	"k8s.io/kubernetes/test/e2e/framework"
 
 	"github.com/spf13/cobra"
@@ -13,14 +14,13 @@ import (
 	"github.com/openshift-eng/openshift-tests-extension/pkg/cmd"
 	"github.com/openshift-eng/openshift-tests-extension/pkg/extension"
 	e "github.com/openshift-eng/openshift-tests-extension/pkg/extension"
-	"github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
 	g "github.com/openshift-eng/openshift-tests-extension/pkg/ginkgo"
 	v "github.com/openshift-eng/openshift-tests-extension/pkg/version"
 
 	"k8s.io/client-go/pkg/version"
 	utilflag "k8s.io/component-base/cli/flag"
 	"k8s.io/component-base/logs"
-	"k8s.io/kubernetes/openshift-hack/e2e/annotate/generated"
 	"k8s.io/kubernetes/test/utils/image"
 
 	// initialize framework extensions
@@ -97,12 +97,19 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	specs = filterOutDisabledSpecs(specs)
+	addLabelsToSpecs(specs)
+
+	// EnvironmentSelectors added to the appropriate specs to facilitate including or excluding them
+	// based on attributes of the cluster they are running on
+	addEnvironmentSelectors(specs)
+
 	kubeTestsExtension.AddSpecs(specs)
 
 	// Cobra stuff
diff --git a/openshift-hack/cmd/k8s-tests-ext/labels.go b/openshift-hack/cmd/k8s-tests-ext/labels.go
new file mode 100644
index 0000000000000..7932f2eb1b62c
--- /dev/null
+++ b/openshift-hack/cmd/k8s-tests-ext/labels.go
@@ -0,0 +1,52 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+)
+
+func addLabelsToSpecs(specs et.ExtensionTestSpecs) {
+	var namesByLabel = map[string][]string{
+		// tests too slow to be part of conformance
+		"Slow": {
+			"[sig-scalability]",                            // disable from the default set for now
+			"should create and stop a working application", // Inordinately slow tests
+
+			"[Feature:PerformanceDNS]", // very slow
+
+			"validates that there exists conflict between pods with same hostPort and protocol but one using 0.0.0.0 hostIP", // 5m, really?
+		},
+		// tests that are known flaky
+		"Flaky": {
+			"Job should run a job to completion when tasks sometimes fail and are not locally restarted", // seems flaky, also may require too many resources
+			// TODO(node): test works when run alone, but not in the suite in CI
+			"[Feature:HPA] Horizontal pod autoscaling (scale resource: CPU) [sig-autoscaling] ReplicationController light Should scale from 1 pod to 2 pods",
+		},
+		// tests that must be run without competition
+		"Serial": {
+			"[Disruptive]",
+			"[Feature:Performance]", // requires isolation
+
+			"Service endpoints latency", // requires low latency
+			"Clean up pods on node",     // schedules up to max pods per node
+			"DynamicProvisioner should test that deleting a claim before the volume is provisioned deletes the volume", // test is very disruptive to other tests
+
+			"Should be able to support the 1.7 Sample API Server using the current Aggregator", // down apiservices break other clients today https://bugzilla.redhat.com/show_bug.cgi?id=1623195
+
+			"[Feature:HPA] Horizontal pod autoscaling (scale resource: CPU) [sig-autoscaling] ReplicationController light Should scale from 1 pod to 2 pods",
+
+			"should prevent Ingress creation if more than 1 IngressClass marked as default", // https://bugzilla.redhat.com/show_bug.cgi?id=1822286
+
+			"[sig-network] IngressClass [Feature:Ingress] should set default value on new IngressClass", //https://bugzilla.redhat.com/show_bug.cgi?id=1833583
+		},
+	}
+
+	for label, names := range namesByLabel {
+		var selectFunctions []et.SelectFunction
+		for _, name := range names {
+			selectFunctions = append(selectFunctions, et.NameContains(name))
+		}
+
+		//TODO: once annotation logic has been removed, it might also be necessary to annotate the test name with the label as well
+		specs.SelectAny(selectFunctions).AddLabel(label)
+	}
+}


Reviews:
user: login: stbenjam
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-02-28T14:21:54Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-06T20:02:29Z
user: login: stbenjam
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-06T20:35:18Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-10T23:20:07Z
user: login: smg247
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-11T11:23:19Z
user: login: stbenjam
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-11T11:56:39Z
user: login: stbenjam
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-11T12:04:55Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-12T18:26:31Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-12T18:28:16Z
user: login: smg247
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-12T19:14:49Z
user: login: stbenjam
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-12T19:41:37Z
user: login: stbenjam
body: I like it
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T13:19:47Z
user: login: smg247
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T14:22:41Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T16:37:12Z
user: login: smg247
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T18:16:41Z
user: login: smg247
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T18:17:51Z
user: login: bertinatto
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-13T19:34:46Z
user: login: bertinatto
body: /approve
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-14T20:04:08Z
user: login: bertinatto
body: Things that I'd like to see in follow-ups:

1. Some mechanism to detect a rule that doesn't match any test
2. Some mechanism to continue running `k8s-*` jobs in this repository once the annotations are gone
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-14T20:08:29Z
user: login: bertinatto
body: /remove-label backports/unvalidated-commits
/label backports/validated-commits
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-17T10:29:40Z

Review comments:
diff_hunk: @@ -97,12 +97,153 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	// Tests that don't pass on disconnected, either due to requiring
+	// internet access for GitHub (e.g. many of the s2i builds), or
+	// because of pullthrough not supporting ICSP (https://bugzilla.redhat.com/show_bug.cgi?id=1918376)
+	specs.Select(et.NameContains("[sig-network] Networking should provide Internet connection for containers")).
+		Exclude(et.ExternalConnectivityEquals("Disconnected"))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	specs.SelectAny([]et.SelectFunction{
+		et.NameContains("Networking should provide Internet connection for containers"), // Azure does not allow ICMP traffic to internet.
+		// Azure CSI migration changed how we treat regions without zones.
+		// See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2066865
+		et.NameContains("[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies"),
+		et.NameContains("[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies"),
+	}).Exclude(et.PlatformEquals("azure"))
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: stbenjam
body: Do you think it would make sense to have for the simple cases an abstraction layer on top of this?

```
specs = filterByPlatform(specs)
```

And then in there have something like this:

```go
var platformExclusions = map[string][]string{
    "azure": {
        "Networking should provide Internet connection for containers", // Azure does not allow ICMP traffic to internet.
        "[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
        "[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
    },
   [....]
}

// iterate over the exclusions here
```

I'm just trying to imagine a more maintainable (and easier to modify) list for the simple cases.



created_at: 2025-02-28T14:21:54Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: What happens when the tests that match this are gone? Will this result in a failure or will this code linger on?
created_at: 2025-03-06T19:35:52Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
+
+	specs.SelectAll([]et.SelectFunction{
+		// ovn-kubernetes does not support named ports
+		et.NameContains("NetworkPolicy"),
+		et.NameContains("named port"),
+	}).Exclude(et.NetworkEquals("OVNKubernetes"))
+
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Suggestion: this whole block looks confusing. An alternative would be to replace this with a single call, and maybe move all the skips to a different file.
created_at: 2025-03-06T19:41:58Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: This new capability in OTE is definitely a nice addition, but I also find it considerably more confusing compared to our current approach.

For example, compare the block above with our existing method:

```
// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
"[Skipped:NoOptionalCapabilities]": {
    // Requires CSISnapshot capability
    `\[Feature:VolumeSnapshotDataSource\]`,
    // Requires Storage capability
    `\[Driver: aws\]`,
    `\[Feature:StorageProvider\]`,
},
```

Right now, adding a quick test skip is straightforward, but achieving the same result with OTE feels significantly more complex. I can imagine situations (like during a kube rebase) where we need to move quickly and tweak skips on the fly. Having to create a rule in OTE at that moment could slow things down and add friction (specially if the engineer is new to this framework). Not to mention that the rules we have in this PR are just a small subset of all the rules that would need to be migrated.

Perhaps the reason this feels more confusing is that `rules.go` already contains so many "twisted" skips and corner cases.

Given that, I’m tempted to suggest that we hold off on using this OTE capability in `k8s-tests.go` for now. It might be beneficial to first see it in action with other external binaries before making this transition.

Thoughts?
created_at: 2025-03-06T20:02:22Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: stbenjam
body: I think moving this to a separate file, maybe called rules.go, would help keep the main code of k8s-tests-ext cleaner by separating concerns.

Regarding the semantics, while this approach is _different_, I don't think it's more difficult. In fact, I would argue it's simpler than the current use of annotations. With this method, you don't need to invoke any make targets to regenerate annotations—it takes effect immediately. You can also test it easily by invoking k8s-tests-ext with the appropriate environment flags.  Want to know what tests are running on AWS? `k8s-tests-ext list tests --platform=aws`.

Most importantly, test names remain unchanged. This is crucial because Kubernetes tests are the most volatile, and we have to maintain a history of tests across releases. The upcoming introduction of two-node OpenShift is likely to cause some test name churn. While ci-test-mapping can handle renames, our track record for keeping that updated isn't great.

Additionally, the language used in this approach is more consistent compared to annotations, and it provides access to a broader range of cluster information (and it's easy to expose new information). 

Initially, I had some concerns about how this would look in practice, but that led to helpers like filterByPlatform below. For most simple skip conditions, you would simply insert a record into the slice, making it straightforward to manage.

Do you have a recent example that illustrates why this path might be more challenging? That could help us address any potential concerns more directly.
created_at: 2025-03-06T20:35:17Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: I'm asking because we've been working to fix this problem, which also occurs with annotations: https://github.com/openshift/kubernetes/pull/2117. We need to make sure skip rules do not persist indefinitely if no matching tests are present.

created_at: 2025-03-10T21:51:37Z
author_association: MEMBER
diff_hunk: @@ -142,3 +184,137 @@ func convertToImage(obj interface{}) extension.Image {
 	}
 	return image
 }
+
+// filterByPlatform is a helper function to do, simple, "NameContains" filtering on tests by platform
+func filterByPlatform(specs et.ExtensionTestSpecs) {
+	var platformExclusions = map[string][]string{
+		"azure": {
+			"Networking should provide Internet connection for containers", // Azure does not allow ICMP traffic to internet.
+			// Azure CSI migration changed how we treat regions without zones.
+			// See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2066865
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+		},
+		"gce": {
+			// Requires creation of a different compute instance in a different zone and is not compatible with volumeBindingMode of WaitForFirstConsumer which we use in 4.x
+			"[sig-storage] Multi-AZ Cluster Volumes should only be allowed to provision PDs in zones where nodes exist",
+			// The following tests try to ssh directly to a node. None of our nodes have external IPs
+			"[k8s.io] [sig-node] crictl should be able to run crictl on the node",
+			"[sig-storage] Flexvolumes should be mountable",
+			"[sig-storage] Detaching volumes should not work when mount is in progress",
+			// We are using ovn-kubernetes to conceal metadata
+			"[sig-auth] Metadata Concealment should run a check-metadata-concealment job to completion",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1740959
+			"[sig-api-machinery] AdmissionWebhook should be able to deny pod and configmap creation",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1745720
+			"[sig-storage] CSI Volumes [Driver: pd.csi.storage.gke.io]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1749882
+			"[sig-storage] CSI Volumes CSI Topology test using GCE PD driver [Serial]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1751367
+			"gce-localssd-scsi-fs",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1750851
+			// should be serial if/when it's re-enabled
+			"[HPA] Horizontal pod autoscaling (scale resource: Custom Metrics from Stackdriver)",
+			"[Feature:CustomMetricsAutoscaling]",
+		},
+		"ibmroks": {
+			// Calico is allowing the request to timeout instead of returning 'REFUSED'
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825021 - ROKS: calico SDN results in a request timeout when accessing services with no endpoints
+			"[sig-network] Services should be rejected when no endpoints exist",
+			// Nodes in ROKS have access to secrets in the cluster to handle encryption
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825013 - ROKS: worker nodes have access to secrets in the cluster
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent configmap should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent secret should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a secret for a workload the node has access to should succeed",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing configmap should exit with the Forbidden error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing secret should exit with the Forbidden error",
+			// Access to node external address is blocked from pods within a ROKS cluster by Calico
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825016 - e2e: NodeAuthenticator tests use both external and internal addresses for node
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet's main port 10250 should reject requests with no credentials",
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet can delegate ServiceAccount tokens to the API server",
+			// Mode returned by RHEL7 worker contains an extra character not expected by the test: dgtrwx vs dtrwx
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825024 - e2e: Failing test - HostPath should give a volume the correct mode
+			"[sig-storage] HostPath should give a volume the correct mode",
+		},
+	}
+
+	for platform, exclusions := range platformExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.PlatformEquals(platform))
+	}
+}
+
+// filterByExternalConnectivity is a helper function to do, simple, "NameContains" filtering on tests by external connectivity
+func filterByExternalConnectivity(specs et.ExtensionTestSpecs) {
+	var externalConnectivityExclusions = map[string][]string{
+		// Tests that don't pass on disconnected, either due to requiring
+		// internet access for GitHub (e.g. many of the s2i builds), or
+		// because of pullthrough not supporting ICSP (https://bugzilla.redhat.com/show_bug.cgi?id=1918376)
+		"Disconnected": {
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+		// These tests are skipped when openshift-tests needs to use a proxy to reach the
+		// cluster -- either because the test won't work while proxied, or because the test
+		// itself is testing a functionality using it's own proxy.
+		"Proxy": {
+			// These tests setup their own proxy, which won't work when we need to access the
+			// cluster through a proxy.
+			"[sig-cli] Kubectl client Simple pod should support exec through an HTTP proxy",
+			"[sig-cli] Kubectl client Simple pod should support exec through kubectl proxy",
+			// Kube currently uses the x/net/websockets pkg, which doesn't work with proxies.
+			// See: https://github.com/kubernetes/kubernetes/pull/103595
+			"[sig-node] Pods should support retrieving logs from the container over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on localhost should support forwarding over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on 0.0.0.0 should support forwarding over websockets",
+			"[sig-node] Pods should support remote command execution over websockets",
+			// These tests are flacky and require internet access
+			// See https://bugzilla.redhat.com/show_bug.cgi?id=2019375
+			"[sig-network] DNS should resolve DNS of partial qualified names for services",
+			"[sig-network] DNS should provide DNS for the cluster",
+			// This test does not work when using in-proxy cluster, see https://bugzilla.redhat.com/show_bug.cgi?id=2084560
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+	}
+
+	for externalConnectivity, exclusions := range externalConnectivityExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.ExternalConnectivityEquals(externalConnectivity))
+	}
+}
+
+// filterByTopology is a helper function to do, simple, "NameContains" filtering on tests by topology
+func filterByTopology(specs et.ExtensionTestSpecs) {
+	var topologyExclusions = map[string][]string{
+		"SingleReplicaTopology": {
+			"[sig-apps] Daemon set [Serial] should rollback without unnecessary restarts [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] doesn't evict pod with tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] eventually evict pod with finite tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] evicts pods from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] removing taint cancels eviction [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] pods evicted from tainted nodes have pod disruption condition",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] evicts pods with minTolerationSeconds [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] only evicts pods without tolerations from tainted nodes",
+			"[sig-cli] Kubectl client Kubectl taint [Serial] should remove all the taints with the same key off a node",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on different nodes",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on the same nodes",
+			"[sig-architecture] Conformance Tests should have at least two untainted nodes",
+		},
+	}
+
+	for topology, exclusions := range topologyExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.TopologyEquals(topology))
+	}
+}
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Currently, when I look at the generated test names I can tell if a test exists and is being skipped. Do we have the same opportunity here?
created_at: 2025-03-10T22:32:49Z
author_association: MEMBER
diff_hunk: @@ -13,7 +13,7 @@ import (
 	"github.com/openshift-eng/openshift-tests-extension/pkg/cmd"
 	"github.com/openshift-eng/openshift-tests-extension/pkg/extension"
 	e "github.com/openshift-eng/openshift-tests-extension/pkg/extension"
-	"github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: We currently vendor the same code and semantics for skipping tests from o/o. Do we intend to apply the same approach there, or will we maintain different semantics for o/k and o/o?

I assume the plan is to outsource all tests currently living in o/o to external binaries. However, that might take some time, which means we'll need to keep the `openshift-hack/e2e/annotate` package around?
created_at: 2025-03-10T22:35:26Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: > Most importantly, test names remain unchanged. This is crucial because Kubernetes tests are the most volatile, and we have to maintain a history of tests across releases. The upcoming introduction of two-node OpenShift is likely to cause some test name churn. While ci-test-mapping can handle renames, our track record for keeping that updated isn't great.

Could you explain how this new approach will prevent us from maintaining a history of test names across releases? For instance, let's say a set of upstream tests have their prefix renamed from `[Feature:SELinuxMount]` to `[FeatureGate:SELinuxMount]`. We'd need to update the rule here as well, correct? I'm not doubting your point, just asking for my understanding.

> Do you have a recent example that illustrates why this path might be more challenging? That could help us address any potential concerns more directly.

IMO the `[Feature:LoadBalancer]` skips above are a good example. I keep staring at it, but still don't know how I'd create these rules myself. :sweat_smile: But maybe that's just me.


created_at: 2025-03-10T23:00:55Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Another immediate problem that I see is our `k8s-*` jobs in o/k. Those jobs use `ginkgo` to run the o/k tests and they rely on test annotations (some of which we add in `rules.go`), to skip some incompatible tests.

https://github.com/openshift/kubernetes/blob/master/openshift-hack/test-kubernetes-e2e.sh#L28
created_at: 2025-03-10T23:19:43Z
author_association: MEMBER
diff_hunk: @@ -142,3 +184,137 @@ func convertToImage(obj interface{}) extension.Image {
 	}
 	return image
 }
+
+// filterByPlatform is a helper function to do, simple, "NameContains" filtering on tests by platform
+func filterByPlatform(specs et.ExtensionTestSpecs) {
+	var platformExclusions = map[string][]string{
+		"azure": {
+			"Networking should provide Internet connection for containers", // Azure does not allow ICMP traffic to internet.
+			// Azure CSI migration changed how we treat regions without zones.
+			// See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2066865
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (immediate binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+			"[sig-storage] In-tree Volumes [Driver: azure-disk] [Testpattern: Dynamic PV (delayed binding)] topology should provision a volume and schedule a pod with AllowedTopologies",
+		},
+		"gce": {
+			// Requires creation of a different compute instance in a different zone and is not compatible with volumeBindingMode of WaitForFirstConsumer which we use in 4.x
+			"[sig-storage] Multi-AZ Cluster Volumes should only be allowed to provision PDs in zones where nodes exist",
+			// The following tests try to ssh directly to a node. None of our nodes have external IPs
+			"[k8s.io] [sig-node] crictl should be able to run crictl on the node",
+			"[sig-storage] Flexvolumes should be mountable",
+			"[sig-storage] Detaching volumes should not work when mount is in progress",
+			// We are using ovn-kubernetes to conceal metadata
+			"[sig-auth] Metadata Concealment should run a check-metadata-concealment job to completion",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1740959
+			"[sig-api-machinery] AdmissionWebhook should be able to deny pod and configmap creation",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1745720
+			"[sig-storage] CSI Volumes [Driver: pd.csi.storage.gke.io]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1749882
+			"[sig-storage] CSI Volumes CSI Topology test using GCE PD driver [Serial]",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1751367
+			"gce-localssd-scsi-fs",
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1750851
+			// should be serial if/when it's re-enabled
+			"[HPA] Horizontal pod autoscaling (scale resource: Custom Metrics from Stackdriver)",
+			"[Feature:CustomMetricsAutoscaling]",
+		},
+		"ibmroks": {
+			// Calico is allowing the request to timeout instead of returning 'REFUSED'
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825021 - ROKS: calico SDN results in a request timeout when accessing services with no endpoints
+			"[sig-network] Services should be rejected when no endpoints exist",
+			// Nodes in ROKS have access to secrets in the cluster to handle encryption
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825013 - ROKS: worker nodes have access to secrets in the cluster
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent configmap should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a non-existent secret should exit with the Forbidden error, not a NotFound error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting a secret for a workload the node has access to should succeed",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing configmap should exit with the Forbidden error",
+			"[sig-auth] [Feature:NodeAuthorizer] Getting an existing secret should exit with the Forbidden error",
+			// Access to node external address is blocked from pods within a ROKS cluster by Calico
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825016 - e2e: NodeAuthenticator tests use both external and internal addresses for node
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet's main port 10250 should reject requests with no credentials",
+			"[sig-auth] [Feature:NodeAuthenticator] The kubelet can delegate ServiceAccount tokens to the API server",
+			// Mode returned by RHEL7 worker contains an extra character not expected by the test: dgtrwx vs dtrwx
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1825024 - e2e: Failing test - HostPath should give a volume the correct mode
+			"[sig-storage] HostPath should give a volume the correct mode",
+		},
+	}
+
+	for platform, exclusions := range platformExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.PlatformEquals(platform))
+	}
+}
+
+// filterByExternalConnectivity is a helper function to do, simple, "NameContains" filtering on tests by external connectivity
+func filterByExternalConnectivity(specs et.ExtensionTestSpecs) {
+	var externalConnectivityExclusions = map[string][]string{
+		// Tests that don't pass on disconnected, either due to requiring
+		// internet access for GitHub (e.g. many of the s2i builds), or
+		// because of pullthrough not supporting ICSP (https://bugzilla.redhat.com/show_bug.cgi?id=1918376)
+		"Disconnected": {
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+		// These tests are skipped when openshift-tests needs to use a proxy to reach the
+		// cluster -- either because the test won't work while proxied, or because the test
+		// itself is testing a functionality using it's own proxy.
+		"Proxy": {
+			// These tests setup their own proxy, which won't work when we need to access the
+			// cluster through a proxy.
+			"[sig-cli] Kubectl client Simple pod should support exec through an HTTP proxy",
+			"[sig-cli] Kubectl client Simple pod should support exec through kubectl proxy",
+			// Kube currently uses the x/net/websockets pkg, which doesn't work with proxies.
+			// See: https://github.com/kubernetes/kubernetes/pull/103595
+			"[sig-node] Pods should support retrieving logs from the container over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on localhost should support forwarding over websockets",
+			"[sig-cli] Kubectl Port forwarding With a server listening on 0.0.0.0 should support forwarding over websockets",
+			"[sig-node] Pods should support remote command execution over websockets",
+			// These tests are flacky and require internet access
+			// See https://bugzilla.redhat.com/show_bug.cgi?id=2019375
+			"[sig-network] DNS should resolve DNS of partial qualified names for services",
+			"[sig-network] DNS should provide DNS for the cluster",
+			// This test does not work when using in-proxy cluster, see https://bugzilla.redhat.com/show_bug.cgi?id=2084560
+			"[sig-network] Networking should provide Internet connection for containers",
+		},
+	}
+
+	for externalConnectivity, exclusions := range externalConnectivityExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.ExternalConnectivityEquals(externalConnectivity))
+	}
+}
+
+// filterByTopology is a helper function to do, simple, "NameContains" filtering on tests by topology
+func filterByTopology(specs et.ExtensionTestSpecs) {
+	var topologyExclusions = map[string][]string{
+		"SingleReplicaTopology": {
+			"[sig-apps] Daemon set [Serial] should rollback without unnecessary restarts [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] doesn't evict pod with tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] eventually evict pod with finite tolerations from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] evicts pods from tainted nodes",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] removing taint cancels eviction [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Single Pod [Serial] pods evicted from tainted nodes have pod disruption condition",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] evicts pods with minTolerationSeconds [Disruptive] [Conformance]",
+			"[sig-node] NoExecuteTaintManager Multiple Pods [Serial] only evicts pods without tolerations from tainted nodes",
+			"[sig-cli] Kubectl client Kubectl taint [Serial] should remove all the taints with the same key off a node",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on different nodes",
+			"[sig-network] LoadBalancers should be able to preserve UDP traffic when server pod cycles for a LoadBalancer service on the same nodes",
+			"[sig-architecture] Conformance Tests should have at least two untainted nodes",
+		},
+	}
+
+	for topology, exclusions := range topologyExclusions {
+		var selectFunctions []et.SelectFunction
+		for _, exclusion := range exclusions {
+			selectFunctions = append(selectFunctions, et.NameContains(exclusion))
+		}
+
+		specs.SelectAny(selectFunctions).Exclude(et.TopologyEquals(topology))
+	}
+}
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: smg247
body: When running the `list tests` command on the binary, the tests will include an `environmentSelector` field that will display the conditions they are skipped under
created_at: 2025-03-11T11:19:16Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: smg247
body: As it is, it will linger on until it is removed by someone. 
We could consider having some sort of a `MustSelect` function that errors if it doesn't find anything, but that doesn't currently exist.
created_at: 2025-03-11T11:21:11Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: stbenjam
body: >> Most importantly, test names remain unchanged. This is crucial because Kubernetes tests are the most volatile, and we have to maintain a history of tests across releases. The upcoming introduction of two-node OpenShift is likely to cause some test name churn. While ci-test-mapping can handle renames, our track record for keeping that updated isn't great.

> Could you explain how this new approach will prevent us from maintaining a history of test names across releases? For instance, let's say a set of upstream tests have their prefix renamed from [Feature:SELinuxMount] to [FeatureGate:SELinuxMount]. We'd need to update the rule here as well, correct? I'm not doubting your point, just asking for my understanding.

It doesn't eliminate all renames.  It does eliminate altering a test name to change where a test runs. You would not update something here in the example you gave. Ideally someone would open a PR to ci-test-mapping for that name change.

Also, there's no current plans to handle feature gates with the environment flags, but you could control execution of that FeatureGate test if for say it didn't work on gcp and you'd be able to do that without renaming the test.

A reminder the process for single node disabling an upstream test, Egli had to:

1. Open a PR to o/k https://github.com/openshift/kubernetes/pull/2033 - which involved updating rules.go, and running the make target
2. Revendor that code in origin https://github.com/openshift/origin/pull/28948
3. Update ci-test-mapping https://github.com/openshift-eng/ci-test-mapping/pull/151

The process here is:

1. Add the test to the single-node topology exclusions list


>> Do you have a recent example that illustrates why this path might be more challenging? That could help us address any potential concerns more directly.

>IMO the [Feature:LoadBalancer] skips above are a good example. I keep staring at it, but still don't know how I'd create these rules myself. 😅 But maybe that's just me.

The functions being called are helpers provided by OTE, you don't have to write any. If you had something similar you would just duplicate this block.  If you wanted to also exclude the LoadBalancer tests on AWS, you'd just add et.PlatformEquals("aws") to the list.

If there's examples that are missing we can add more, but I don't think this is significantly different effort than editing the existing rules.go.  And it requires far less work.

>> Another immediate problem that I see is our k8s-* jobs in o/k. Those jobs use ginkgo to run the o/k tests and they rely on test annotations (some of which we add in rules.go), to skip some incompatible tests.
>> https://github.com/openshift/kubernetes/blob/master/openshift-hack/test-kubernetes-e2e.sh#L28

What are these jobs used for? Is it even needed anymore with extensions? If you open a kube bump PR, any new tests are automatically run in the presubmits so why do we need this separate script?
created_at: 2025-03-11T11:56:38Z
author_association: MEMBER
diff_hunk: @@ -13,7 +13,7 @@ import (
 	"github.com/openshift-eng/openshift-tests-extension/pkg/cmd"
 	"github.com/openshift-eng/openshift-tests-extension/pkg/extension"
 	e "github.com/openshift-eng/openshift-tests-extension/pkg/extension"
-	"github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: stbenjam
body: Plans are to move origin to OTE itself for its own internal tests.  It'll use the same code we're using here and annotations will go away there too. 

We have no plans to require all tests to use extensions, adding tests to origin is still a valid path and will be for the foreseeable future.  But annotate will go away.
created_at: 2025-03-11T12:04:54Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: > What are these jobs used for? Is it even needed anymore with extensions? If you open a kube bump PR, any new tests are automatically run in the presubmits so why do we need this separate script?

Good question. I think those jobs have been around since the beginning, so I can't say for certain what the original intentions were, but I can guess a few reasons.

I believe it’s important that OCP passes upstream tests using the upstream binary and upstream images, as they were intended. While these tests may seem redundant, having some overlap is safer than missing a critical failure. Also, to obtain the kube certification, we need to run a different program that I believe uses a variation of the upstream binary and the upstream images.

I'm hesitant to remove these jobs. Any ideas how can keep them running with the incoming changes?
created_at: 2025-03-12T18:26:31Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
+
+	specs.SelectAll([]et.SelectFunction{
+		// ovn-kubernetes does not support named ports
+		et.NameContains("NetworkPolicy"),
+		et.NameContains("named port"),
+	}).Exclude(et.NetworkEquals("OVNKubernetes"))
+
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Thanks for moving this to a different file, @smg247. Do you think we can translate the remaining rules in this PR? It'd be useful to see how it looks like. 
created_at: 2025-03-12T18:28:16Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
+
+	specs.SelectAll([]et.SelectFunction{
+		// ovn-kubernetes does not support named ports
+		et.NameContains("NetworkPolicy"),
+		et.NameContains("named port"),
+	}).Exclude(et.NetworkEquals("OVNKubernetes"))
+
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: smg247
body: I could, I was trying to start with the skips only just to be sure that the way I was doing it was correct. I guess that we have determined that with the back-and-forth here though, so no harm in doing them all in a single PR.
created_at: 2025-03-12T19:14:49Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: stbenjam
body: I think we could use a focus file https://onsi.github.io/ginkgo/#location-based-filtering to explicitly list all the tests we want to run, and use `k8s-test-ext` with environment flags or other filters to generate the list.

Would it be acceptable to call k8s-test-ext in order to filter the list of tests we should run, but use ginkgo+k8s-e2e.test to run them?

created_at: 2025-03-12T19:41:37Z
author_association: MEMBER
path: openshift-hack/cmd/k8s-tests-ext/environemnt-selectors.go
user: login: stbenjam
body: s/environemnt/environment/
created_at: 2025-03-13T13:12:50Z
author_association: MEMBER
path: openshift-hack/cmd/k8s-tests-ext/disabled-tests.go
user: login: stbenjam
body: Underscores are more 100x more common than dashes for go files in k/k.  Maybe the dashes are consistent in this directory because k8s-tests.go has a dash.

created_at: 2025-03-13T13:18:11Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
+		},
+		// tests that may work, but we don't support them
+		"Unsupported": {
+			"[Driver: rbd]",             // OpenShift 4.x does not support Ceph RBD (use CSI instead)
+			"[Driver: ceph]",            // OpenShift 4.x does not support CephFS (use CSI instead)
+			"[Driver: gluster]",         // OpenShift 4.x does not support Gluster
+			"Volumes GlusterFS",         // OpenShift 4.x does not support Gluster
+			"GlusterDynamicProvisioner", // OpenShift 4.x does not support Gluster
+
+			// Skip vSphere-specific storage tests. The standard in-tree storage tests for vSphere
+			// (prefixed with "In-tree Volumes [Driver: vsphere]") are enough for testing this plugin.
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2019115
+			"[sig-storage].*[Feature:vsphere]", //TODO: this rule is broken due to the regex, but it wouldn't pick anything up anyways, safe to remove?
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: smg247
body: Note the TODO here, what should we do about this one?
created_at: 2025-03-13T14:22:41Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: bertinatto
body: Are you sure you looked at the `rules.go` from the master branch? Some of these have been removed already
created_at: 2025-03-13T14:23:11Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Many of the existing rules are outdated and don't match any existing tests, so I think ` MustSelect`-like helper would be very helpful.
created_at: 2025-03-13T16:05:59Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,54 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	filterByPlatform(specs)
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.Select(et.NameContains("[Feature:LoadBalancer]")).
+		Exclude(et.Or(
+			et.PlatformEquals("alibabacloud"),
+			et.PlatformEquals("baremetal"),
+			et.PlatformEquals("ibmcloud"),
+			et.PlatformEquals("kubevirt"),
+			et.PlatformEquals("nutanix"),
+			et.PlatformEquals("openstack"),
+			et.PlatformEquals("ovirt"),
+			et.PlatformEquals("vsphere"),
+		))
+
+	// LoadBalancer tests in 1.31 require explicit platform-specific skips
+	// https://issues.redhat.com/browse/OCPBUGS-38840
+	specs.SelectAny([]et.SelectFunction{ // Since these must use "NameContainsAll" they cannot be included in filterByPlatform
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "UDP"),
+		et.NameContainsAll("[sig-network] LoadBalancers [Feature:LoadBalancer]", "session affinity"),
+	}).Exclude(et.PlatformEquals("aws"))
+
+	filterByExternalConnectivity(specs)
+
+	filterByTopology(specs)
+
+	// Tests which can't be run/don't make sense to run against a cluster with all optional capabilities disabled
+	specs.SelectAny([]et.SelectFunction{
+		// Requires CSISnapshot capability
+		et.NameContains("[Feature:VolumeSnapshotDataSource]"),
+		// Requires Storage capability
+		et.NameContains("[Driver: aws]"),
+		et.NameContains("[Feature:StorageProvider]"),
+	}).Exclude(et.NoOptionalCapabilitiesExist())
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Can we use a skip file instead? `k8s-test-ext` would need to list the tests that need to be skipped, but based on https://github.com/openshift/kubernetes/pull/2215#discussion_r1989016427 I believe that's doable, correct?
created_at: 2025-03-13T16:27:25Z
author_association: MEMBER
diff_hunk: @@ -97,12 +97,19 @@ func main() {
 	//		  the environmental skip code from the enhancement once its implemented.
 	//		- Make sure to account for test renames that occur because of removal of these
 	//		  annotations
-	specs.Walk(func(spec *extensiontests.ExtensionTestSpec) {
+	specs.Walk(func(spec *et.ExtensionTestSpec) {
 		if annotations, ok := generated.Annotations[spec.Name]; ok {
 			spec.Name += annotations
 		}
 	})
 
+	specs = filterOutDisabledSpecs(specs)
+	addLabelsToSpecs(specs)
+
+	// EnvironmentSelectors added to the appropriate specs to facilitate including or excluding them
+	// based on attributes of the cluster they are running on
+	addEnvironmentSelectors(specs)
+
path: openshift-hack/cmd/k8s-tests-ext/k8s-tests.go
user: login: bertinatto
body: Looking much better, thanks!
created_at: 2025-03-13T16:27:58Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
+		},
+		// tests that may work, but we don't support them
+		"Unsupported": {
+			"[Driver: rbd]",             // OpenShift 4.x does not support Ceph RBD (use CSI instead)
+			"[Driver: ceph]",            // OpenShift 4.x does not support CephFS (use CSI instead)
+			"[Driver: gluster]",         // OpenShift 4.x does not support Gluster
+			"Volumes GlusterFS",         // OpenShift 4.x does not support Gluster
+			"GlusterDynamicProvisioner", // OpenShift 4.x does not support Gluster
+
+			// Skip vSphere-specific storage tests. The standard in-tree storage tests for vSphere
+			// (prefixed with "In-tree Volumes [Driver: vsphere]") are enough for testing this plugin.
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2019115
+			"[sig-storage].*[Feature:vsphere]", //TODO: this rule is broken due to the regex, but it wouldn't pick anything up anyways, safe to remove?
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: bertinatto
body: They existed in 4.15 [1], but seem to be gone in 4.16. Feel free to drop it. See? We need a `MustSelect` :D

[1] https://github.com/bertinatto/kubernetes/blob/ff493be70058d7324491442be6d57c92cfccb92d/test/e2e/storage/vsphere/persistent_volumes-vsphere.go#L37
created_at: 2025-03-13T16:36:23Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: smg247
body: I hadn't rebased since I opened the PR. I am doing so now. It looks like it was only this one rule that was removed, and another that moved from one disabled reason to another; I will make those updates.
created_at: 2025-03-13T18:16:41Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
+		},
+		// tests that may work, but we don't support them
+		"Unsupported": {
+			"[Driver: rbd]",             // OpenShift 4.x does not support Ceph RBD (use CSI instead)
+			"[Driver: ceph]",            // OpenShift 4.x does not support CephFS (use CSI instead)
+			"[Driver: gluster]",         // OpenShift 4.x does not support Gluster
+			"Volumes GlusterFS",         // OpenShift 4.x does not support Gluster
+			"GlusterDynamicProvisioner", // OpenShift 4.x does not support Gluster
+
+			// Skip vSphere-specific storage tests. The standard in-tree storage tests for vSphere
+			// (prefixed with "In-tree Volumes [Driver: vsphere]") are enough for testing this plugin.
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2019115
+			"[sig-storage].*[Feature:vsphere]", //TODO: this rule is broken due to the regex, but it wouldn't pick anything up anyways, safe to remove?
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: smg247
body: I do think that will be useful, but can we do something like that in a followup?
created_at: 2025-03-13T18:17:51Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,226 @@
+package main
+
+import (
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// filterOutDisabledSpecs returns the specs with those that are disabled removed from the list
+func filterOutDisabledSpecs(specs et.ExtensionTestSpecs) et.ExtensionTestSpecs {
+	var disabledByReason = map[string][]string{
+		"Alpha": { // alpha features that are not gated
+			"[Feature:StorageVersionAPI]",
+			"[Feature:InPlacePodVerticalScaling]",
+			"[Feature:ServiceCIDRs]",
+			"[Feature:ClusterTrustBundle]",
+			"[Feature:SELinuxMount]",
+			"[FeatureGate:SELinuxMount]",
+			"[Feature:UserNamespacesPodSecurityStandards]",
+			"[Feature:UserNamespacesSupport]", // disabled Beta
+			"[Feature:DynamicResourceAllocation]",
+			"[Feature:VolumeAttributesClass]", // disabled Beta
+			"[sig-cli] Kubectl client Kubectl prune with applyset should apply and prune objects", // Alpha feature since k8s 1.27
+			// 4.19
+			"[Feature:PodLevelResources]",
+			"[Feature:SchedulerAsyncPreemption]",
+			"[Feature:RelaxedDNSSearchValidation]",
+			"[Feature:PodLogsQuerySplitStreams]",
+			"[Feature:PodLifecycleSleepActionAllowZero]",
+		},
+		// tests for features that are not implemented in openshift
+		"Unimplemented": {
+			"Monitoring",                               // Not installed, should be
+			"Cluster level logging",                    // Not installed yet
+			"Kibana",                                   // Not installed
+			"Ubernetes",                                // Can't set zone labels today
+			"kube-ui",                                  // Not installed by default
+			"Kubernetes Dashboard",                     // Not installed by default (also probably slow image pull)
+			"should proxy to cadvisor",                 // we don't expose cAdvisor port directly for security reasons
+			"[Feature:BootstrapTokens]",                // we don't serve cluster-info configmap
+			"[Feature:KubeProxyDaemonSetMigration]",    // upgrades are run separately
+			"[Feature:BoundServiceAccountTokenVolume]", // upgrades are run separately
+			"[Feature:StatefulUpgrade]",                // upgrades are run separately
+		},
+		// tests that rely on special configuration that we do not yet support
+		"SpecialConfig": {
+			// GPU node needs to be available
+			"[Feature:GPUDevicePlugin]",
+			"[sig-scheduling] GPUDevicePluginAcrossRecreate [Feature:Recreate]",
+
+			"[Feature:LocalStorageCapacityIsolation]", // relies on a separate daemonset?
+			"[sig-cloud-provider-gcp]",                // these test require a different configuration - note that GCE tests from the sig-cluster-lifecycle were moved to the sig-cloud-provider-gcpcluster lifecycle see https://github.com/kubernetes/kubernetes/commit/0b3d50b6dccdc4bbd0b3e411c648b092477d79ac#diff-3b1910d08fb8fd8b32956b5e264f87cb
+
+			"kube-dns-autoscaler", // Don't run kube-dns
+			"should check if Kubernetes master services is included in cluster-info", // Don't run kube-dns
+			"DNS configMap", // this tests dns federation configuration via configmap, which we don't support yet
+
+			"NodeProblemDetector",                   // requires a non-master node to run on
+			"Advanced Audit should audit API calls", // expects to be able to call /logs
+
+			"Firewall rule should have correct firewall rules for e2e cluster", // Upstream-install specific
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2079958
+			"[sig-network] [Feature:Topology Hints] should distribute endpoints evenly",
+
+			// Tests require SSH configuration and is part of the parallel suite, which does not create the bastion
+			// host. Enabling the test would result in the  bastion being created for every parallel test execution.
+			// Given that we have existing oc and WMCO tests that cover this functionality, we can safely disable it.
+			"[Feature:NodeLogQuery]",
+		},
+		// tests that are known broken and need to be fixed upstream or in openshift
+		// always add an issue here
+		"Broken": {
+			"mount an API token into pods",                              // We add 6 secrets, not 1
+			"ServiceAccounts should ensure a single API token exists",   // We create lots of secrets
+			"unchanging, static URL paths for kubernetes api services",  // the test needs to exclude URLs that are not part of conformance (/logs)
+			"Services should be able to up and down services",           // we don't have wget installed on nodes
+			"KubeProxy should set TCP CLOSE_WAIT timeout",               // the test require communication to port 11302 in the cluster nodes
+			"should check kube-proxy urls",                              // previously this test was skipped b/c we reported -1 as the number of nodes, now we report proper number and test fails
+			"SSH",                                                       // TRIAGE
+			"should implement service.kubernetes.io/service-proxy-name", // this is an optional test that requires SSH. sig-network
+			"recreate nodes and ensure they function upon restart",      // https://bugzilla.redhat.com/show_bug.cgi?id=1756428
+			"[Driver: iscsi]",                                           // https://bugzilla.redhat.com/show_bug.cgi?id=1711627
+
+			"RuntimeClass should reject",
+
+			"Services should implement service.kubernetes.io/headless",                    // requires SSH access to function, needs to be refactored
+			"ClusterDns [Feature:Example] should create pod that uses dns",                // doesn't use bindata, not part of kube test binary
+			"Simple pod should return command exit codes should handle in-cluster config", // kubectl cp doesn't work or is not preserving executable bit, we have this test already
+
+			// TODO(node): configure the cri handler for the runtime class to make this work
+			"should run a Pod requesting a RuntimeClass with a configured handler",
+			"should reject a Pod requesting a RuntimeClass with conflicting node selector",
+			"should run a Pod requesting a RuntimeClass with scheduling",
+
+			// A fix is in progress: https://github.com/openshift/origin/pull/24709
+			"Multi-AZ Clusters should spread the pods of a replication controller across zones",
+
+			// Upstream assumes all control plane pods are in kube-system namespace and we should revert the change
+			// https://github.com/kubernetes/kubernetes/commit/176c8e219f4c7b4c15d34b92c50bfa5ba02b3aba#diff-28a3131f96324063dd53e17270d435a3b0b3bd8f806ee0e33295929570eab209R78
+			"MetricsGrabber should grab all metrics from a Kubelet",
+			"MetricsGrabber should grab all metrics from API server",
+			"MetricsGrabber should grab all metrics from a ControllerManager",
+			"MetricsGrabber should grab all metrics from a Scheduler",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1906808
+			"ServiceAccounts should support OIDC discovery of service account issuer",
+
+			// NFS umount is broken in kernels 5.7+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1854379
+			"[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1986306
+			"[sig-cli] Kubectl client kubectl wait should ignore not found error with --for=delete",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1980141
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic from pods within server namespace based on PodSelector",
+			"Netpol NetworkPolicy between server and client should enforce policy based on NamespaceSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector with MatchExpressions",
+			"Netpol NetworkPolicy between server and client should enforce policy based on PodSelector or NamespaceSelector",
+			"Netpol NetworkPolicy between server and client should deny ingress from pods on other namespaces",
+			"Netpol NetworkPolicy between server and client should enforce updated policy",
+			"Netpol NetworkPolicy between server and client should enforce multiple, stacked policies with overlapping podSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy based on any PodSelectors",
+			"Netpol NetworkPolicy between server and client should enforce policy to allow traffic only from a different namespace, based on NamespaceSelector",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should support a 'default-deny-ingress' policy",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy based on Ports",
+			"Netpol [LinuxOnly] NetworkPolicy between server and client using UDP should enforce policy to allow traffic only from a pod in a different namespace based on PodSelector and NamespaceSelector",
+
+			"Topology Hints should distribute endpoints evenly",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1908645
+			"[sig-network] Networking Granular Checks: Services should function for service endpoints using hostNetwork",
+			"[sig-network] Networking Granular Checks: Services should function for pod-Service(hostNetwork)",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952460
+			"[sig-network] Firewall rule control plane should not expose well-known ports",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1988272
+			"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv6]",
+			"[sig-network] Networking should provider Internet connection for containers using DNS",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1957894
+			"[sig-node] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1952457
+			"[sig-node] crictl should be able to run crictl on the node",
+
+			// https://bugzilla.redhat.com/show_bug.cgi?id=1953478
+			"[sig-storage] Dynamic Provisioning Invalid AWS KMS key should report an error and create no PV",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34577
+			"[sig-storage] Multi-AZ Cluster Volumes should schedule pods in the same zones as statically provisioned PVs",
+
+			// https://issues.redhat.com/browse/OCPBUGS-34594
+			"[sig-node] [Feature:PodLifecycleSleepAction] when create a pod with lifecycle hook using sleep action valid prestop hook using sleep action",
+
+			// https://issues.redhat.com/browse/OCPBUGS-38839
+			"[sig-network] [Feature:Traffic Distribution] when Service has trafficDistribution=PreferClose should route traffic to an endpoint that is close to the client",
+		},
+		// tests that need to be temporarily disabled while the rebase is in progress.
+		"RebaseInProgress": {
+			// https://issues.redhat.com/browse/OCPBUGS-7297
+			"DNS HostNetwork should resolve DNS of partial qualified names for services on hostNetwork pods with dnsPolicy",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45275
+			"[sig-network] Connectivity Pod Lifecycle should be able to connect to other Pod from a terminating Pod",
+
+			// https://issues.redhat.com/browse/OCPBUGS-17194
+			"[sig-node] ImageCredentialProvider [Feature:KubeletCredentialProviders] should be able to create pod with image credentials fetched from external credential provider",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45214
+			// Even though this feature is not GA in k/k, it will be GA in OCP 4.19, so we should fix it and unskip this test
+			"[Feature:volumegroupsnapshot]",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45273
+			"[sig-network] Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes",
+
+			// https://issues.redhat.com/browse/OCPBUGS-45274
+			// https://github.com/kubernetes/kubernetes/issues/129056
+			"[sig-node] PodRejectionStatus Kubelet should reject pod when the node didn't have enough resource",
+		},
+		// tests that may work, but we don't support them
+		"Unsupported": {
+			"[Driver: rbd]",             // OpenShift 4.x does not support Ceph RBD (use CSI instead)
+			"[Driver: ceph]",            // OpenShift 4.x does not support CephFS (use CSI instead)
+			"[Driver: gluster]",         // OpenShift 4.x does not support Gluster
+			"Volumes GlusterFS",         // OpenShift 4.x does not support Gluster
+			"GlusterDynamicProvisioner", // OpenShift 4.x does not support Gluster
+
+			// Skip vSphere-specific storage tests. The standard in-tree storage tests for vSphere
+			// (prefixed with "In-tree Volumes [Driver: vsphere]") are enough for testing this plugin.
+			// https://bugzilla.redhat.com/show_bug.cgi?id=2019115
+			"[sig-storage].*[Feature:vsphere]", //TODO: this rule is broken due to the regex, but it wouldn't pick anything up anyways, safe to remove?
path: openshift-hack/cmd/k8s-tests-ext/disabled_tests.go
user: login: bertinatto
body: Definitely
created_at: 2025-03-13T19:34:46Z
author_association: MEMBER

PR comments:
user: login: openshift-ci-robot
created_at: 2025-02-24T20:02:39Z
body: @smg247: This pull request references [TRT-1854](https://issues.redhat.com//browse/TRT-1854) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/kubernetes/pull/2215):

>`openshift-tests-extension` introduces a new way to skip upstream tests based on environment flags and `include`/`exclude` fields present on the listed tests. This PR translates the existing test skips to that functionality.
>
>There will be a followup to this to remove the other annotations, and eventually the framework itself.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fkubernetes).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-02-24T20:02:45Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [4abe9c8|UPSTREAM: <carry>: remove "SKIPPED" annotations, and replace with include/exclude CEL to make use of environment flags](https://github.com/openshift/kubernetes/commit/4abe9c8011bfb9ccf99b3894ffe4b0ac28c989cd): does not specify an upstream backport in the commit message
 - [e26bc4a|UPSTREAM: <drop>: updated generated annotations from removing skips](https://github.com/openshift/kubernetes/commit/e26bc4a15756e6d2318379d3aed4da99a22c03ca): does not specify an upstream backport in the commit message
 - [efdd8cd|UPSTREAM: <drop>: ./hack/update-vendor.sh for openshift-tests-extension](https://github.com/openshift/kubernetes/commit/efdd8cd4862bf2b36a092cf668f368c59714e10f): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: smg247
created_at: 2025-02-24T20:02:58Z
body: /hold to merge after https://github.com/openshift/kubernetes/pull/2214
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-02-24T20:06:44Z
body: @smg247: This pull request references [TRT-1854](https://issues.redhat.com//browse/TRT-1854) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/kubernetes/pull/2215):

>`openshift-tests-extension` introduces a new way to skip upstream tests based on environment flags and `include`/`exclude` fields present on the listed tests. This PR translates the existing test skips to that functionality.
>
>I have generated a [diff](https://gist.github.com/smg247/d4b74464f70305c54d1bbee62761b9ca) of the output of `k8s-tests-ext list` prior to, and after this change for verification purposes.
>
>There will be a followup to this to remove the other annotations, and eventually the framework itself.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fkubernetes).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-02-26T12:12:37Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [1daa2c4|UPSTREAM: <drop>: updated generated annotations from removing skips](https://github.com/openshift/kubernetes/commit/1daa2c46803a1859fb28873e1874fab4b9636915): does not specify an upstream backport in the commit message
 - [74647d8|UPSTREAM: <drop>: ./hack/update-vendor.sh for openshift-tests-extension](https://github.com/openshift/kubernetes/commit/74647d877e74ca7de0ae96cfd50721d9bc03b1f2): does not specify an upstream backport in the commit message
 - [db6b8e5|UPSTREAM: <carry>: remove "SKIPPED" annotations, and replace with include/exclude CEL to make use of environment flags](https://github.com/openshift/kubernetes/commit/db6b8e599c4a354805485682d4e10efad062efce): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-02-26T12:16:23Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [1daa2c4|UPSTREAM: <drop>: updated generated annotations from removing skips](https://github.com/openshift/kubernetes/commit/1daa2c46803a1859fb28873e1874fab4b9636915): does not specify an upstream backport in the commit message
 - [74647d8|UPSTREAM: <drop>: ./hack/update-vendor.sh for openshift-tests-extension](https://github.com/openshift/kubernetes/commit/74647d877e74ca7de0ae96cfd50721d9bc03b1f2): does not specify an upstream backport in the commit message
 - [77fa839|UPSTREAM: <drop>: fix vendoring error](https://github.com/openshift/kubernetes/commit/77fa839b6cb219fc02f2c5a785558028fae862e0): does not specify an upstream backport in the commit message
 - [db6b8e5|UPSTREAM: <carry>: remove "SKIPPED" annotations, and replace with include/exclude CEL to make use of environment flags](https://github.com/openshift/kubernetes/commit/db6b8e599c4a354805485682d4e10efad062efce): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: smg247
created_at: 2025-02-26T12:17:43Z
body: /hold cancel
author_association: MEMBER
user: login: smg247
created_at: 2025-02-26T20:31:32Z
body: /hold to figure out test mapping with the name changes prior to merge
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-02-27T18:41:20Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [0e529d9|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/0e529d9ee16b76482df0880b5bf77879360e97c8): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-02-27T18:44:42Z
body: @smg247: This pull request references [TRT-1854](https://issues.redhat.com//browse/TRT-1854) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/kubernetes/pull/2215):

>`openshift-tests-extension` introduces a new way to skip upstream tests based on environment flags and `include`/`exclude` fields present on the listed tests. This PR translates the existing test skips to that functionality, but leaves the annotations alone. They will be removed in a later PR.
>
>I have generated a [diff](https://gist.github.com/smg247/d4b74464f70305c54d1bbee62761b9ca) of the output of `k8s-tests-ext list` prior to, and after this change for verification purposes. This diff was generated when we were removing the annotations from the test names, that part will no longer be happening with this PR.
>
>There will be a followup to this to translate the other annotations, and eventually the framework itself.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fkubernetes).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: smg247
created_at: 2025-02-27T18:45:36Z
body: /hold cancel
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-02-28T15:13:28Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [54463b0|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/54463b0cd497084be195945f6f10a2f29a928ce8): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: stbenjam
created_at: 2025-02-28T15:19:16Z
body: /lgtm
author_association: MEMBER
user: login: smg247
created_at: 2025-03-03T11:15:54Z
body: /retest-required
author_association: MEMBER
user: login: smg247
created_at: 2025-03-04T11:53:56Z
body: /retest-required
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-03-12T17:03:41Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [54463b0|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/54463b0cd497084be195945f6f10a2f29a928ce8): does not specify an upstream backport in the commit message
 - [75d9621|refactor environment selectors into their own file and make additional helpers to simplify the logic](https://github.com/openshift/kubernetes/commit/75d96211a2a85f3975fdcbef2a6ece6b7c1c5e00): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-13T11:58:42Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [54463b0|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/54463b0cd497084be195945f6f10a2f29a928ce8): does not specify an upstream backport in the commit message
 - [92dfce9|UPSTREAM: <carry>: filter out disabled tests and label those that are annotated as: Slow, Flaky, or Serial respectively](https://github.com/openshift/kubernetes/commit/92dfce982007860b9bbf18be8c934abf2d95d77d): does not specify an upstream backport in the commit message
 - [ab50c06|UPSTREAM: <carry>: refactor environment selectors into their own file and make additional helpers to simplify the logic](https://github.com/openshift/kubernetes/commit/ab50c067d06d5c2f2514f5b34b1b2dac54a22c34): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-13T12:58:23Z
body: @smg247: This pull request references [TRT-1854](https://issues.redhat.com//browse/TRT-1854) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/kubernetes/pull/2215):

>`openshift-tests-extension` introduces a new way to skip upstream tests based on environment flags and `include`/`exclude` fields present on the listed tests. This PR translates the existing annotations to that functionality, but leaves them in place. They will be removed in a later PR.


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fkubernetes).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-13T14:21:51Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [07d1643|UPSTREAM: <carry>: filter out disabled tests and label those that are annotated as: Slow, Flaky, or Serial respectively](https://github.com/openshift/kubernetes/commit/07d164389f1dee6868ebfe54867d31acec697c1b): does not specify an upstream backport in the commit message
 - [54463b0|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/54463b0cd497084be195945f6f10a2f29a928ce8): does not specify an upstream backport in the commit message
 - [ab50c06|UPSTREAM: <carry>: refactor environment selectors into their own file and make additional helpers to simplify the logic](https://github.com/openshift/kubernetes/commit/ab50c067d06d5c2f2514f5b34b1b2dac54a22c34): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-13T18:19:38Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [0d48d87|UPSTREAM: <carry>: add environemntSelector include/exclude CEL to make use of environment flags for SKIPPED tests](https://github.com/openshift/kubernetes/commit/0d48d87d9b0361606ef8182621fceea6d059d29d): does not specify an upstream backport in the commit message
 - [1458e23|UPSTREAM: <carry>: refactor environment selectors into their own file and make additional helpers to simplify the logic](https://github.com/openshift/kubernetes/commit/1458e231efb478a7571e286fbfafbc82adadb0be): does not specify an upstream backport in the commit message
 - [34ca7d9|UPSTREAM: <carry>: filter out disabled tests and label those that are annotated as: Slow, Flaky, or Serial respectively](https://github.com/openshift/kubernetes/commit/34ca7d95a4a775813f07a2ebd09276fcf367dd5b): does not specify an upstream backport in the commit message
 - [4fa2f14|UPSTREAM: <carry>: update to translate rules that were changed since this PR has been opened and remove unused disable](https://github.com/openshift/kubernetes/commit/4fa2f14d4776612f8846d01929e3e2f4652753ab): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-17T10:26:08Z
body: @smg247: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:
 - [d0c1b6d|UPSTREAM: <carry>: translate all existing rules to use filtering and the environemntSelector in the specs](https://github.com/openshift/kubernetes/commit/d0c1b6d2c9c5a98fe03699047bf2cb784437ab10): does not specify an upstream backport in the commit message

Comment <code>/validate-backports</code> to re-evaluate validity of the upstream PRs, for example when they are merged upstream.
author_association: NONE
user: login: stbenjam
created_at: 2025-03-17T13:54:30Z
body: /lgtm
author_association: MEMBER
user: login: stbenjam
created_at: 2025-03-17T13:54:40Z
body: /test verify
author_association: MEMBER
user: login: openshift-ci[bot]
created_at: 2025-03-17T13:56:41Z
body: @stbenjam: No presubmit jobs available for openshift/kubernetes@master

<details>

In response to [this](https://github.com/openshift/kubernetes/pull/2215#issuecomment-2729605413):

>/test verify


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-ci[bot]
created_at: 2025-03-17T14:01:10Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/openshift/kubernetes/pull/2215#pullrequestreview-2686697972" title="Approved">bertinatto</a>*, *<a href="https://github.com/openshift/kubernetes/pull/2215#" title="Author self-approved">smg247</a>*, *<a href="https://github.com/openshift/kubernetes/pull/2215#issuecomment-2729604920" title="LGTM">stbenjam</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=openshift%2Fkubernetes).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[DOWNSTREAM_OWNERS](https://github.com/openshift/kubernetes/blob/master/DOWNSTREAM_OWNERS)~~ [bertinatto]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: NONE
user: login: smg247
created_at: 2025-03-17T14:36:12Z
body: /retest-required
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-03-17T15:39:26Z
body: /retest-required

Remaining retests: 0 against base HEAD f4a27c46e464f735615c60fc0b067471e7073e13 and 2 for PR HEAD d0c1b6d2c9c5a98fe03699047bf2cb784437ab10 in total

author_association: NONE
user: login: smg247
created_at: 2025-03-17T16:54:40Z
body: /retest-required
author_association: MEMBER
user: login: smg247
created_at: 2025-03-17T17:06:10Z
body: /test verify
author_association: MEMBER
user: login: smg247
created_at: 2025-03-17T17:13:13Z
body: /retest-required
author_association: MEMBER
user: login: smg247
created_at: 2025-03-17T18:45:15Z
body: /retest-required
author_association: MEMBER
user: login: openshift-ci[bot]
created_at: 2025-03-17T19:12:13Z
body: @smg247: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
ci/prow/e2e-aws-csi | d0c1b6d2c9c5a98fe03699047bf2cb784437ab10 | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_kubernetes/2215/pull-ci-openshift-kubernetes-master-e2e-aws-csi/1901580879126335488) | false | `/test e2e-aws-csi`
ci/prow/okd-scos-e2e-aws-ovn | d0c1b6d2c9c5a98fe03699047bf2cb784437ab10 | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_kubernetes/2215/pull-ci-openshift-kubernetes-master-okd-scos-e2e-aws-ovn/1901580917583908864) | false | `/test okd-scos-e2e-aws-ovn`

[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=kubernetes&pr=2215). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:smg247).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: NONE
user: login: openshift-bot
created_at: 2025-03-18T03:54:33Z
body: **[ART PR BUILD NOTIFIER]**

Distgit: openshift-enterprise-pod
This PR has been included in build [openshift-enterprise-pod-container-v4.19.0-202503180241.p0.g2ed17b4.assembly.stream.el9](https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3561081).
All builds following this will include this PR.
author_association: NONE
user: login: openshift-bot
created_at: 2025-03-18T04:09:35Z
body: **[ART PR BUILD NOTIFIER]**

Distgit: openshift-enterprise-hyperkube
This PR has been included in build [openshift-enterprise-hyperkube-container-v4.19.0-202503180241.p0.g2ed17b4.assembly.stream.el9](https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3561090).
All builds following this will include this PR.
author_association: NONE
user: login: openshift-bot
created_at: 2025-03-18T04:12:46Z
body: **[ART PR BUILD NOTIFIER]**

Distgit: kube-proxy
This PR has been included in build [kube-proxy-container-v4.19.0-202503180241.p0.g2ed17b4.assembly.stream.el9](https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3561112).
All builds following this will include this PR.
author_association: NONE
user: login: openshift-bot
created_at: 2025-03-18T04:15:37Z
body: **[ART PR BUILD NOTIFIER]**

Distgit: ose-installer-kube-apiserver-artifacts
This PR has been included in build [ose-installer-kube-apiserver-artifacts-container-v4.19.0-202503180241.p0.g2ed17b4.assembly.stream.el9](https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3561110).
All builds following this will include this PR.
author_association: NONE