Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --There was a regression in containerd that required a fix for gmsa working with UNC paths. See the fix at We should have a test that validates this functionality. See for set up and place to add this test. Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /sig windows /triage accepted /priority important-long-term /help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : <!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! --#### What happened: There was a regression in containerd that required a fix for gmsa working with UNC paths. See the fix at We should have a test that validates this functionality. Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /sig windows /triage accepted /priority important-long-term /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : There was a regression in containerd that required a fix for gmsa working with UNC paths. See the fix at We should have a test that validates this functionality. Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /sig windows /triage accepted /priority important-long-term /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/priority important-longterm
/assign
if you have questions feel free to reachout on slack in sig-windows
Will do, thanks!
/assign
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle rotten [1]:
/remove-lifecycle rotten
/remove-lifecycle rotten
/assign
I have thought about this a bit and think it might be easiest to just expose a share on the domain controller. This does push more requirements into the configuration that needs to happen outside of the tests but it will make the tests a lot cleaner IMO.
/assign
GitHub didn't allow me to assign the following users: iXinqi. Note that only , repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
//  * the cluster comprises at least one Linux node that accepts workloads - it //    can be the master, but any other Linux node is fine too. This is needed for //    the webhook's pod. <ins> //  * in order to run "can read and write file to remote folder" test case, a folder (e.g. "write_test") need to be created //    in that AD domain and it should be shared with that GMSA account. </ins> // All these assumptions are fulfilled by an AKS extension when setting up the AKS // cluster we run daily e2e tests against, but they do make running this test // outside of that very specific context pretty hard.

"os" "os/exec" "path" <ins> "regexp" </ins> "strings" "time" v1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" <ins> "k8s.io/apimachinery/pkg/util/uuid" </ins> clientset "k8s.io/client-go/kubernetes" "k8s.io/kubernetes/test/e2e/framework" e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"

// The name of the expected domain gmsaDomain = "k8sgmsa.lan" <ins> // The shared folder on the expected domain for file-writing test gmsaSharedFolder = "write_test" </ins> ) var _ = SIGDescribe("[Feature:Windows] GMSA Full [Serial] [Slow]", func() {

return true }, 1*time.Minute, 1*time.Second).Should(gomega.BeTrue()) }) <ins> ginkgo.It("can read and write file to remote SMB folder", func() { defer ginkgo.GinkgoRecover() ginkgo.By("finding the worker node that fulfills this test's assumptions") nodes := findPreconfiguredGmsaNodes(f.ClientSet) if len(nodes) != 1 { e2eskipper.Skipf("Expected to find exactly one node with the %q label, found %d", gmsaFullNodeLabel, len(nodes)) } node := nodes[0] ginkgo.By("retrieving the contents of the GMSACredentialSpec custom resource manifest from the node") crdManifestContents := retrieveCRDManifestFileContents(f, node) ginkgo.By("downloading the GMSA webhook deploy script") deployScriptPath, err := downloadFile(gmsaWebhookDeployScriptURL) defer func() { os.Remove(deployScriptPath) }() if err != nil { framework.Failf(err.Error()) } ginkgo.By("deploying the GMSA webhook") webhookCleanUp, err := deployGmsaWebhook(f, deployScriptPath) defer webhookCleanUp() if err != nil { framework.Failf(err.Error()) } ginkgo.By("creating the GMSA custom resource") customResourceCleanup, err := createGmsaCustomResource(f.Namespace.Name, crdManifestContents) defer customResourceCleanup() if err != nil { framework.Failf(err.Error()) } ginkgo.By("creating an RBAC role to grant use access to that GMSA resource") rbacRoleName, rbacRoleCleanup, err := createRBACRoleForGmsa(f) defer rbacRoleCleanup() if err != nil { framework.Failf(err.Error()) } ginkgo.By("creating a service account") serviceAccountName := createServiceAccount(f) ginkgo.By("binding the RBAC role to the service account") bindRBACRoleToServiceAccount(f, serviceAccountName, rbacRoleName) ginkgo.By("creating a pod using the GMSA cred spec") podName := createPodWithGmsa(f, serviceAccountName) ginkgo.By("getting the ip of GMSA domain") gmsaDomainIP := getGmsaDomainIP(f, podName) ginkgo.By("checking that file can be read and write from the remote folder successfully") filePath := fmt.Sprintf("%s%swrite-test-%s.txt", gmsaDomainIP, gmsaSharedFolder, string(uuid.NewUUID())[0:4]) gomega.Eventually(func() bool { // The filePath is a remote folder, do not change the format of it _, _ = runKubectlExecInNamespace(f.Namespace.Name, podName, "--", "powershell.exe", "-Command", "echo 'This is a test file.' > "+filePath) output, err := runKubectlExecInNamespace(f.Namespace.Name, podName, "powershell.exe", "--", "cat", filePath) if err != nil { framework.Logf("unable to get file from AD server: %s", err) return false } return strings.Contains(output, "This is a test file.") }, 1*time.Minute, 1*time.Second).Should(gomega.BeTrue()) }) </ins> }) })

namespaceOption := fmt.Sprintf("--namespace=%s", namespace) return framework.RunKubectl(namespace, append([]string{"exec", namespaceOption}, args...)...) } <ins> func getGmsaDomainIP(f *framework.Framework, podName string) string { output, _ := runKubectlExecInNamespace(f.Namespace.Name, podName, "powershell.exe", "--", "nslookup", gmsaDomain) re := regexp.MustCompile(`(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}`) idx := strings.Index(output, gmsaDomain) submatchall := re.FindAllString(output[idx:], -1) if len(submatchall) < 1 { framework.Logf("fail to get the ip of the gmsa domain") return "" } return submatchall[0] } </ins>