Change:
[x] test approval issue : [x] test pr : [x] two weeks soak end date : 31 Dec 2022 [X] test promotion pr : According to following two APIsnoop queries, there are still two authorization endpoints which are untested. example endpoint kind ---------------------------------------------------------+
-+-------------------------- createAuthorizationV1NamespacedLocalSubjectAccessReview LocalSubjectAccessReview (1 row) sql-mode select distinct endpoint, testhit AS "e2e Test", conftesthit AS "Conformance Test" from public.auditevent where endpoint ilike '%SubjectAccessReview' and useragent like '%e2e%' and not conftesthit order by endpoint limit 10; example endpoint Conformance Test ------------------------------------------+----------+------------------ createAuthorizationV1SubjectAccessReview f (1 row) [It] should support SubjectReview API operations STEP: Create pod "pod-x6fhh" in namespace "subjectreview-1704" 12/07/22 21:33:12.332 Dec 7 21:33:12.441: INFO: Waiting up to 5m0s for pod "pod-x6fhh" in namespace "subjectreview-1704" to be "running" Dec 7 21:33:12.502: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 61.265222ms Dec 7 21:33:14.512: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 2.070783878s Dec 7 21:33:16.520: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 4.078677494s Dec 7 21:33:18.513: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 6.07168643s Dec 7 21:33:20.510: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 8.068598657s Dec 7 21:33:22.509: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 10.068442532s Dec 7 21:33:24.514: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 12.073076728s Dec 7 21:33:26.511: INFO: Pod "pod-x6fhh": Phase="Running", Reason="", readiness=true. Elapsed: 14.069523123s Dec 7 21:33:26.511: INFO: Pod "pod-x6fhh" satisfied condition "running" Dec 7 21:33:26.515: INFO: "pod-x6fhh" in namespace "subjectreview-1704" is "Running" Dec 7 21:33:26.515: INFO: serviceaccount name: "system:serviceaccount:subjectreview-1704:default" STEP: Creating SubjectAccessReview in "subjectreview-1704" namespace 12/07/22 21:33:26.515 Dec 7 21:33:26.521: INFO: sarResponse Status: v1.SubjectAccessReviewStatus{Allowed:false, Denied:false, Reason:"", EvaluationError:""} STEP: Creating clientset to impersonate "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.521 STEP: Verifying api 'get' call to "pod-x6fhh" as "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.522 Dec 7 21:33:26.525: INFO: api call by "system:serviceaccount:subjectreview-1704:default" was denied Dec 7 21:33:26.525: INFO: SubjectAccessReview has been verified STEP: Creating a LocalSubjectAccessReview in "subjectreview-1704" namespace 12/07/22 21:33:26.525 Dec 7 21:33:26.530: INFO: lsarResponse Status: v1.SubjectAccessReviewStatus{Allowed:false, Denied:false, Reason:"", EvaluationError:""} STEP: Verifying api 'get' call to "pod-x6fhh" as "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.53 Dec 7 21:33:26.532: INFO: api call by "system:serviceaccount:subjectreview-1704:default" was denied Dec 7 21:33:26.532: INFO: LocalSubjectAccessReview has been verified sql-mode select distinct substring(endpoint from 'w+') AS endpoint, right(useragent,43) AS useragent from testing.auditevent where useragent like 'e2e%should%' and releasedate::BIGINT round(((EXTRACT(EPOCH FROM NOW()))::numeric)*1000,0) - and endpoint ilike '%subject%' order by endpoint limit 10; example endpoint | useragent ---------------------------------------------------------+--------------------------------------------- createAuthorizationV1NamespacedLocalSubjectAccessReview | should support SubjectReview API operations createAuthorizationV1SubjectAccessReview | should support SubjectReview API operations (2 rows) If a test with these calls gets merged, test coverage will go up by 2 points This test is also created with the goal of conformance promotion. /sig testing /sig architecture /area conformance
/triage accepted
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
it MUST succeed and the field MUST equal the new value. release: v1.26 file: test/e2e/auth/service_accounts.go <ins> - testname: SubjectReview, API Operations codename: '[sig-auth] SubjectReview should support SubjectReview API operations [Conformance]' description: A ServiceAccount is created which MUST succeed. A clientset is created to impersonate the ServiceAccount. A SubjectAccessReview is created for the ServiceAccount which MUST succeed. The allowed status for the SubjectAccessReview MUST match the expected allowed for the impersonated client call. A LocalSubjectAccessReviews is created for the ServiceAccount which MUST succeed. The allowed status for the LocalSubjectAccessReview MUST match the expected allowed for the impersonated client call. release: v1.27 file: test/e2e/auth/subjectreviews.go </ins> - testname: Kubectl, guestbook application codename: '[sig-cli] Kubectl client Guestbook application should create and stop a working application  [Conformance]'

var _ = SIGDescribe("SubjectReview", func() { f := framework.NewDefaultFramework("subjectreview") <del> ginkgo.It("should support SubjectReview API operations", func() { </del> <ins> /* Release: v1.27 Testname: SubjectReview, API Operations Description: A ServiceAccount is created which MUST succeed. A clientset is created to impersonate the ServiceAccount. A SubjectAccessReview is created for the ServiceAccount which MUST succeed. The allowed status for the SubjectAccessReview MUST match the expected allowed for the impersonated client call. A LocalSubjectAccessReviews is created for the ServiceAccount which MUST succeed. The allowed status for the LocalSubjectAccessReview MUST match the expected allowed for the impersonated client call. */ framework.ConformanceIt("should support SubjectReview API operations", func() { </ins> AuthClient := f.ClientSet.AuthorizationV1() ns := f.Namespace.Name