Change:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: , Which test(s) are failing: Since when has it been failing: since this PR introduced them Testgrid link: Note that this is the flakiest test in both dashboards, and failing quite frequently. Reason for failure: unknown Anything else we need to know: cc
/sig node
see: , both getting empty PID and multiple PIDs.
opened revert at
for discoverability for the release team /priority critical-urgent /milestone v1.17

Discussion:
v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" <del> "k8s.io/apimachinery/pkg/util/sets" </del> "k8s.io/apimachinery/pkg/util/uuid" "k8s.io/kubernetes/pkg/kubelet/events" "k8s.io/kubernetes/test/e2e/framework"

podClient = f.PodClient() }) <del> ginkgo.Context("when creating a pod in the host PID namespace", func() { makeHostPidPod := func(podName, image string, command []string, hostPID bool) *v1.Pod { return &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: podName, }, Spec: v1.PodSpec{ RestartPolicy: v1.RestartPolicyNever, HostPID:       hostPID, Containers: []v1.Container{ { Image:   image, Name:    podName, Command: command, }, }, }, } } createAndWaitHostPidPod := func(podName string, hostPID bool) { podClient.Create(makeHostPidPod(podName, framework.BusyBoxImage, []string{"sh", "-c", "pidof nginx || true"}, hostPID, )) podClient.WaitForSuccess(podName, framework.PodStartTimeout) } nginxPid := "" ginkgo.BeforeEach(func() { nginxPodName := "nginx-hostpid-" + string(uuid.NewUUID()) podClient.CreateSync(makeHostPidPod(nginxPodName, imageutils.GetE2EImage(imageutils.Nginx), nil, true, )) output := f.ExecShellInContainer(nginxPodName, nginxPodName, "cat /var/run/nginx.pid") nginxPid = strings.TrimSpace(output) }) ginkgo.It("should show its pid in the host PID namespace [LinuxOnly] [NodeFeature:HostAccess]", func() { busyboxPodName := "busybox-hostpid-" + string(uuid.NewUUID()) createAndWaitHostPidPod(busyboxPodName, true) logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) if err != nil { framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) } pids := strings.TrimSpace(logs) framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName) if pids == "" { framework.Failf("nginx's pid should be seen by hostpid containers") } pidSets := sets.NewString(strings.Split(pids, " ")...) if !pidSets.Has(nginxPid) { framework.Failf("nginx's pid should be seen by hostpid containers") } }) ginkgo.It("should not show its pid in the non-hostpid containers [LinuxOnly] [NodeFeature:HostAccess]", func() { busyboxPodName := "busybox-non-hostpid-" + string(uuid.NewUUID()) createAndWaitHostPidPod(busyboxPodName, false) logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) if err != nil { framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) } pids := strings.TrimSpace(logs) framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName) pidSets := sets.NewString(strings.Split(pids, " ")...) if pidSets.Has(nginxPid) { framework.Failf("nginx's pid should not be seen by non-hostpid containers") } }) }) </del> ginkgo.Context("When creating a container with runAsUser", func() { makeUserPod := func(podName, image string, command []string, userid int64) *v1.Pod { return &v1.Pod{

"os/exec" "strings" <del> v1 "k8s.io/api/core/v1" </del> <ins> "k8s.io/api/core/v1" </ins> metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" <ins> "k8s.io/apimachinery/pkg/util/sets" </ins> "k8s.io/apimachinery/pkg/util/uuid" utilfeature "k8s.io/apiserver/pkg/util/feature" "k8s.io/kubernetes/pkg/features"

}) }) <ins> ginkgo.Context("when creating a pod in the host PID namespace", func() { makeHostPidPod := func(podName, image string, command []string, hostPID bool) *v1.Pod { return &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: podName, }, Spec: v1.PodSpec{ RestartPolicy: v1.RestartPolicyNever, HostPID:       hostPID, Containers: []v1.Container{ { Image:   image, Name:    podName, Command: command, }, }, }, } } createAndWaitHostPidPod := func(podName string, hostPID bool) { podClient.Create(makeHostPidPod(podName, busyboxImage, []string{"sh", "-c", "pidof nginx || true"}, hostPID, )) podClient.WaitForSuccess(podName, framework.PodStartTimeout) } nginxPid := "" ginkgo.BeforeEach(func() { nginxPodName := "nginx-hostpid-" + string(uuid.NewUUID()) podClient.CreateSync(makeHostPidPod(nginxPodName, imageutils.GetE2EImage(imageutils.Nginx), nil, true, )) output := f.ExecShellInContainer(nginxPodName, nginxPodName, "cat /var/run/nginx.pid") nginxPid = strings.TrimSpace(output) }) ginkgo.It("should show its pid in the host PID namespace [NodeFeature:HostAccess]", func() { busyboxPodName := "busybox-hostpid-" + string(uuid.NewUUID()) createAndWaitHostPidPod(busyboxPodName, true) logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) if err != nil { framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) } pids := strings.TrimSpace(logs) framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName) if pids == "" { framework.Failf("nginx's pid should be seen by hostpid containers") } pidSets := sets.NewString(strings.Split(pids, " ")...) if !pidSets.Has(nginxPid) { framework.Failf("nginx's pid should be seen by hostpid containers") } }) ginkgo.It("should not show its pid in the non-hostpid containers [NodeFeature:HostAccess]", func() { busyboxPodName := "busybox-non-hostpid-" + string(uuid.NewUUID()) createAndWaitHostPidPod(busyboxPodName, false) logs, err := e2epod.GetPodLogs(f.ClientSet, f.Namespace.Name, busyboxPodName, busyboxPodName) if err != nil { framework.Failf("GetPodLogs for pod %q failed: %v", busyboxPodName, err) } pids := strings.TrimSpace(logs) framework.Logf("Got nginx's pid %q from pod %q", pids, busyboxPodName) pidSets := sets.NewString(strings.Split(pids, " ")...) if pidSets.Has(nginxPid) { framework.Failf("nginx's pid should not be seen by non-hostpid containers") } }) }) </ins> ginkgo.Context("when creating a pod in the host IPC namespace", func() { makeHostIPCPod := func(podName, image string, command []string, hostIPC bool) *v1.Pod { return &v1.Pod{