Change:
What happened: e2e tests detect whether PSP is enabled based on presence of PSP API objects. An addon that proactively includes a PSP in a manifest can trigger that detection and enable PSP-specific e2e tests that should not be run. What you expected to happen: In addition to detecting presence of PSP objects, consider dry-run creating a pod and verifying the annotation indicating the selected PSP policy is , indicating the admission plugin is active. /sig auth /assign

Discussion:
// compute the context. Mutation is allowed. ValidatedPSPAnnotation is not taken into account. allowedPod, pspName, validationErrs, err := p.computeSecurityContext(ctx, a, pod, true, "") if err != nil { <del> return admission.NewForbidden(a, err) </del> <ins> return admission.NewForbidden(a, fmt.Errorf("PodSecurityPolicy: %w", err)) </ins> } if allowedPod != nil { *pod = *allowedPod

} // we didn't validate against any provider, reject the pod and give the errors for each attempt <del> klog.V(4).Infof("unable to validate pod %s (generate: %s) in namespace %s against any pod security policy: %v", pod.Name, pod.GenerateName, a.GetNamespace(), validationErrs) return admission.NewForbidden(a, fmt.Errorf("unable to validate against any pod security policy: %v", validationErrs)) </del> <ins> klog.V(4).Infof("unable to admit pod %s (generate: %s) in namespace %s against any pod security policy: %v", pod.Name, pod.GenerateName, a.GetNamespace(), validationErrs) return admission.NewForbidden(a, fmt.Errorf("PodSecurityPolicy: unable to admit pod: %v", validationErrs)) </ins> } // Validate verifies attributes against the PodSecurityPolicy

// compute the context. Mutation is not allowed. ValidatedPSPAnnotation is used as a hint to gain same speed-up. allowedPod, pspName, validationErrs, err := p.computeSecurityContext(ctx, a, pod, false, pod.ObjectMeta.Annotations[psputil.ValidatedPSPAnnotation]) if err != nil { <del> return admission.NewForbidden(a, err) </del> <ins> return admission.NewForbidden(a, fmt.Errorf("PodSecurityPolicy: %w", err)) </ins> } if apiequality.Semantic.DeepEqual(pod, allowedPod) { key := auditKeyPrefix + "/" + "validate-policy"

// we didn't validate against any provider, reject the pod and give the errors for each attempt klog.V(4).Infof("unable to validate pod %s (generate: %s) in namespace %s against any pod security policy: %v", pod.Name, pod.GenerateName, a.GetNamespace(), validationErrs) <del> return admission.NewForbidden(a, fmt.Errorf("unable to validate against any pod security policy: %v", validationErrs)) </del> <ins> return admission.NewForbidden(a, fmt.Errorf("PodSecurityPolicy: unable to validate pod: %v", validationErrs)) </ins> } func shouldIgnore(a admission.Attributes) (bool, error) {

import ( "context" "fmt" <ins> "strings" </ins> "sync" v1 "k8s.io/api/core/v1"

"k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/authentication/serviceaccount" clientset "k8s.io/client-go/kubernetes" <ins> imageutils "k8s.io/kubernetes/test/utils/image" </ins> "github.com/onsi/ginkgo"

psps, err := kubeClient.PolicyV1beta1().PodSecurityPolicies().List(context.TODO(), metav1.ListOptions{}) if err != nil { Logf("Error listing PodSecurityPolicies; assuming PodSecurityPolicy is disabled: %v", err) <del> isPSPEnabled = false } else if psps == nil || len(psps.Items) == 0 { </del> <ins> return } if psps == nil || len(psps.Items) == 0 { </ins> Logf("No PodSecurityPolicies found; assuming PodSecurityPolicy is disabled.") <del> isPSPEnabled = false } else { Logf("Found PodSecurityPolicies; assuming PodSecurityPolicy is enabled.") isPSPEnabled = true </del> <ins> return } Logf("Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled") testPod := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{GenerateName: "psp-test-pod-"}, Spec:       v1.PodSpec{Containers: []v1.Container{{Name: "test", Image: imageutils.GetPauseImageName()}}}, } dryRunPod, err := kubeClient.CoreV1().Pods("kube-system").Create(context.TODO(), testPod, metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}}) if err != nil { if strings.Contains(err.Error(), "PodSecurityPolicy") { Logf("PodSecurityPolicy error creating dryrun pod; assuming PodSecurityPolicy is enabled: %v", err) isPSPEnabled = true } else { Logf("Error creating dryrun pod; assuming PodSecurityPolicy is disabled: %v", err) } return } pspAnnotation, pspAnnotationExists := dryRunPod.Annotations["kubernetes.io/psp"] if !pspAnnotationExists { Logf("No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled") return </ins> } <ins> Logf("PSP annotation exists on dry run pod: %q; assuming PodSecurityPolicy is enabled", pspAnnotation) isPSPEnabled = true </ins> }) return isPSPEnabled }