Change:
// deployGmsaWebhook deploys the GMSA webhook, and returns a cleanup function // to be called when done with testing, that removes the temp files it's created // on disks as well as the API resources it's created. <del> func deployGmsaWebhook(f *framework.Framework, deployScriptPath string) (func(), error) { cleanUpFunc := func() {} </del> <ins> func deployGmsaWebhook(f *framework.Framework) (func(), error) { deployerName := "webhook-deployer" deployerNamespace := f.Namespace.Name webHookName := "gmsa-webhook" webHookNamespace := deployerNamespace + "-webhook" </ins> <del> tempDir, err := os.MkdirTemp("", "") if err != nil { return cleanUpFunc, fmt.Errorf("unable to create temp dir: %w", err) } </del> <ins> // regardless of whether the deployment succeeded, let's do a best effort at cleanup cleanUpFunc := func() { framework.Logf("Best effort clean up of the webhook:n") stdout, err := framework.RunKubectl("", "delete", "CustomResourceDefinition", "gmsacredentialspecs.windows.k8s.io") framework.Logf("stdout:%snerror:%s", stdout, err) </ins> <del> manifestsFile := path.Join(tempDir, "manifests.yml") name := "gmsa-webhook" namespace := f.Namespace.Name + "-webhook" certsDir := path.Join(tempDir, "certs") </del> <ins> stdout, err = framework.RunKubectl("", "delete", "CertificateSigningRequest", fmt.Sprintf("%s.%s", webHookName, webHookNamespace)) framework.Logf("stdout:%snerror:%s", stdout, err) </ins> <del> // regardless of whether the deployment succeeded, let's do a best effort at cleanup cleanUpFunc = func() { framework.RunKubectl(f.Namespace.Name, "delete", "--filename", manifestsFile) framework.RunKubectl(f.Namespace.Name, "delete", "CustomResourceDefinition", "gmsacredentialspecs.windows.k8s.io") framework.RunKubectl(f.Namespace.Name, "delete", "CertificateSigningRequest", fmt.Sprintf("%s.%s", name, namespace)) os.RemoveAll(tempDir) </del> <ins> stdout, err = runKubectlExecInNamespace(deployerNamespace, deployerName, "--", "kubectl", "delete", "-f", "/manifests.yml") framework.Logf("stdout:%snerror:%s", stdout, err) } // ensure the deployer has ability to approve certificatesigningrequests to install the webhook s := createServiceAccount(f) bindClusterRBACRoleToServiceAccount(f, s, "cluster-admin") installSteps := []string{ "echo "@testing http://dl-cdn.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories", "&& apk add kubectl@testing gettext openssl", "&& apk add --update coreutils", fmt.Sprintf("&& curl %s > gmsa.sh", gmsaWebhookDeployScriptURL), "&& chmod +x gmsa.sh", fmt.Sprintf("&& ./gmsa.sh --file %s --name %s --namespace %s --certs-dir %s --tolerate-master", "/manifests.yml", webHookName, webHookNamespace, "certs"), "&& /agnhost pause", </ins> } <ins> installCommand := strings.Join(installSteps, " ") </ins> <del> cmd := exec.Command("bash", deployScriptPath, "--file", manifestsFile, "--name", name, "--namespace", namespace, "--certs-dir", certsDir, "--tolerate-master") </del> <ins> pod := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name:      deployerName, Namespace: deployerNamespace, }, Spec: v1.PodSpec{ ServiceAccountName: s, NodeSelector: map[string]string{ "kubernetes.io/os": "linux", }, Containers: []v1.Container{ { Name:    deployerName, Image:   imageutils.GetE2EImage(imageutils.Agnhost), Command: []string{"bash", "-c"}, Args:    []string{installCommand}, }, }, Tolerations: []v1.Toleration{ { Operator: v1.TolerationOpExists, Effect:   v1.TaintEffectNoSchedule, }, }, }, } f.PodClient().CreateSync(pod) </ins> <del> output, err := cmd.CombinedOutput() </del> <ins> // Wait for the Webhook deployment to become ready. The deployer pod takes a few seconds to initialize and create resources err := waitForDeployment(func() (*appsv1.Deployment, error) { return f.ClientSet.AppsV1().Deployments(webHookNamespace).Get(context.TODO(), webHookName, metav1.GetOptions{}) }, 10*time.Second, f.Timeouts.PodStart) </ins> if err == nil { <del> framework.Logf("GMSA webhook successfully deployed, output:n%s", string(output)) </del> <ins> framework.Logf("GMSA webhook successfully deployed") </ins> } else { <del> err = fmt.Errorf("unable to deploy GMSA webhook, output:n%s: %w", string(output), err) </del> <ins> err = fmt.Errorf("GMSA webhook did not become ready: %w", err) </ins> } <ins> // Dump deployer logs logs, _ := e2epod.GetPodLogs(f.ClientSet, deployerNamespace, deployerName, deployerName) framework.Logf("GMSA deployment logs:n%s", logs) </ins> return cleanUpFunc, err }

Discussion:
Cluster api provides a framework to run the e2e tests which uses the conformance image: The gmsa tests use bash to install the webhook: The test will fail when run in the conformance image because of the bash: we should install the component another way run this e2e conformance image with /sig windows fyi <details</details<details</details<details</details<details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Conformance image:
Hi does the "work e2e" test case pass? Deploying GMSA webhook is the same for both "work e2e" and this test case.
no, they both fail due to bash not being present in the conformance image. The gmsa tests themselves pass if I run locally
/sig testing