Code change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --E2E test fails. The test is implemented at: I would expect the test pass with these objects in place: AFAIK this fulfills the general requirement of the test that there's a corresponding endpointslice object with same addressing information as is on the endpoint object. IMO the test should rather look for epslice which is owned by the endpoint rather than relying on a hardcoded name. Add flag to kube-apiserver Manually create the endpoint with proper addressing for the api-server epslice "mirroring" create new endpointslice with name like --The test fails as it's hardcoded to look for endpointslice named I'm working on a PR to provide a fix proposal Kubernetes version (use ): 1.22.1 Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: k0s Network plugin and version (if this is a network-related bug): kube-router 1.3.1 Others:
/sig testing
/remove-sig testing /sig network EndpointSlices are owned by sig network.
/kind failing-test
/remove kind-bug /remove kind-failing-test The test is correct, apiserver must generates both endpoint and enpointslices with the special name "kubernetes" , that are the backends for the "kubernetes.default" service with the IP addresses of the apiservers. This special service "kubernetes.default" and its endpoints are used by clients with In-Cluster auto discovery. I think that whatever cluster that is not generating the endpoint and endpointslices for the "kubernetes.default" service should not meet Conformance, at least I can't see how automatic in-cluster configuration will work without that ... I only see option used for webhook tests, the other 2 reconcilers always create the endpoints and slices for "kubernetes.default" should we clarify the goal of this "none" option?
Yes, I do understand this. And in our case this is true, there is a svc called as there is also endpoints object called . This makes the in-cluster discovery work. Otherwise we'd get much more errors in the conformance instead of this only one... :) In our case we're relying on the endpointslice mirroring to take care of creating the endpointslice object, which makes this test fail as it uses generated "suffix" on the object name. I have not dived too deep (yet) into the internals of endpointslices but I fail to see how the endpointslice object name really matters when both svc and endpoint object does have proper name.
oh, this seems interesting then ... who is creating the corresponding endpoint? can you paste a kubectl get endpoints -o yaml?
this is how it looks like in my cluster
In our case (k0s distro) it's our custom controller that is triggered when the controlplane is configured in HA mode. So this basically sets the api to mode . When our controller runs it has a configured LB address which it resolves to IP address(es) and creates the corresponding EP object. We do NOT create the endpointslice as we rely on the mirroring functionality to let it create and sync it. Here's the object details: Reading the code for API built-in endpoint reconcilers I see they set and create the endpointslice object by themselves. Yes, we could do that too in k0s but I fail to see why the name of the endpointslice object really matters at all.
I agree the conformance test should not be looking up endpointslice by name. It should be using a label selector of to locate one or more endpointslices and verifying the ports and endpoints across them.
Fair enough, on the good side this also will simplify the KEP from to dual-stack the apiserver you are the expert in this area, can you PTAL at this discussion? /kind failing-test
hmm the test description explicitly says the name of the object has to be "kubernetes", if the name is mandatory the test is correct, otherwise we need to rewrite the test description and talk with conformance people /area conformance
the description should be rewritten... the test is enforcing stricter requirements on endpointslices than required/expected
/triage accepted

Related discussion:
text: Description: The discovery.k8s.io API group MUST exist in the /apis discovery document. The discovery.k8s.io/v1 API group/version MUST exist in the /apis/discovery.k8s.io discovery document. The endpointslices resource MUST exist in the /apis/discovery.k8s.io/v1 discovery document. <del> API Server should create self referential Endpoints and EndpointSlices named "kubernetes" in the default namespace. </del> <ins> The cluster MUST have a service named "kubernetes" on the default namespace referencing the API servers. The "kubernetes.default" service MUST have Endpoints and EndpointSlices pointing to each API server instance. </ins> */ framework.ConformanceIt("should have Endpoints and EndpointSlices pointing to API Server", func() { namespace := "default" name := "kubernetes" <ins> // verify "kubernetes.default" service exist _, err := cs.CoreV1().Services(namespace).Get(context.TODO(), name, metav1.GetOptions{}) framework.ExpectNoError(err, "error obtaining API server "kubernetes" Service resource on "default" namespace") // verify Endpoints for the API servers exist </ins> endpoints, err := cs.CoreV1().Endpoints(namespace).Get(context.TODO(), name, metav1.GetOptions{}) <del> framework.ExpectNoError(err, "error creating Endpoints resource") if len(endpoints.Subsets) != 1 { framework.Failf("Expected 1 subset in endpoints, got %d: %#v", len(endpoints.Subsets), endpoints.Subsets) </del> <ins> framework.ExpectNoError(err, "error obtaining API server "kubernetes" Endpoint resource on "default" namespace") if len(endpoints.Subsets) == 0 { framework.Failf("Expected at least 1 subset in endpoints, got %d: %#v", len(endpoints.Subsets), endpoints.Subsets) </ins> } <del> endpointSubset := endpoints.Subsets[0] endpointSlice, err := cs.DiscoveryV1().EndpointSlices(namespace).Get(context.TODO(), name, metav1.GetOptions{}) framework.ExpectNoError(err, "error creating EndpointSlice resource") if len(endpointSlice.Ports) != len(endpointSubset.Ports) { framework.Failf("Expected EndpointSlice to have %d ports, got %d: %#v", len(endpointSubset.Ports), len(endpointSlice.Ports), endpointSlice.Ports) </del> <ins> // verify EndpointSlices for the API servers exist endpointSliceList, err := cs.DiscoveryV1().EndpointSlices(namespace).List(context.TODO(), metav1.ListOptions{ LabelSelector: "kubernetes.io/service-name=" + name, }) framework.ExpectNoError(err, "error obtaining API server "kubernetes" EndpointSlice resource on "default" namespace") if len(endpointSliceList.Items) == 0 { framework.Failf("Expected at least 1 EndpointSlice, got %d: %#v", len(endpoints.Subsets), endpoints.Subsets) </ins> } <del> numExpectedEndpoints := len(endpointSubset.Addresses) + len(endpointSubset.NotReadyAddresses) if len(endpointSlice.Endpoints) != numExpectedEndpoints { framework.Failf("Expected EndpointSlice to have %d endpoints, got %d: %#v", numExpectedEndpoints, len(endpointSlice.Endpoints), endpointSlice.Endpoints) </del> <ins> if !endpointSlicesEqual(endpoints, endpointSliceList) { framework.Failf("Expected EndpointSlice to have same addresses and port as Endpoints, got %#v: %#v", endpoints, endpointSliceList) </ins> } })