Change:
Kubernetes e2e suite: [It] [sig-api-machinery] AdmissionWebhook [Privileged:ClusterAdmin] should reject everything except leases The job was run on Aug 5th. I had a PR fixing typos in comments of kubelet source code. It is not related to api-machinery ipv6 but the test failed. The re-test passed. No response No response It seems the test is recently . /sig api-machinery /sig testing
It is failing considerably , it seems it fails to connect to the webhook that matches the time the test was I don't fully understand the test but it seems that is interacting with the cluster, I don't have clear if the deny policy affects everything and this is causing the race with the pod that implements the webhook /priority critical-urgent /release blocker /cc
/assign
cc
Debugged with Joe offline, paste for reference click open stderr on the failure to get the timeline
still failing after merge of
/triage accepted
It's suspicious that of all the admission webhook tests that start up a webhook pod, this is the one that flakes. I'll look more closely.
Looks like the webhook in this test may be configured to deny requests except leases globally in the cluster once enabled., which might create a race where, if the webhook is registered first , the controller setting up the webhook pod is denied requests by the webhook. I'll scope the webhook matching to the test namespace per offline suggestion.
Please let me know if I can be of help debugging this.Have free cycle and would like to contribute.
/assign
I can still see references to the expression that gives error Example run: Could you help confirm that the tests are completely removed? Thank you. cc
I think this is another test that is impacting the rest of the tests. Probably because the tests are running in parrallel. We might want to scope things down. Currently working on a fix.
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
this is a new bug, please review all the test that were and verify they are scoped to the custom created namespaces by the test framework, and if not, please tag them as cc:
/cc
I assume this could be closed with merged? /cc
Looks like the exact flak as reported in this issue has been resolved. /close
Closing this issue. <detailsIn response to : Looks like the exact flak as reported in this issue has been resolved. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
admissionregistrationv1 "k8s.io/api/admissionregistration/v1" appsv1 "k8s.io/api/apps/v1" <del> coordinationv1 "k8s.io/api/coordination/v1" </del> v1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"

/* Release: v1.28 <del> Testname: Validating Admission webhook, validating webhook exclude leases using match conditions field. Description: Create a validating webhook configuration with matchConditions field that will reject all resources except the coordination.k8s.io/lease ones. Try to create pods until the webhook is ready and rejecting the pods with "denied" error message. Create a Lease object and validate that it bypasses the webhook. Create a configMap and validate that it's rejected by the webhook. */ ginkgo.It("should reject everything except leases", func(ctx context.Context) { excludeLeasesMatchConditions := []admissionregistrationv1.MatchCondition{ { Name:       "exclude-leases", Expression: `!(request.resource.group == "coordination.k8s.io" && request.resource.resource == "leases")`, }, } ginkgo.By("creating a validating webhook with match conditions") validatingWebhookConfiguration := newValidatingWebhookWithMatchConditions(f, servicePort, certCtx, excludeLeasesMatchConditions) _, err := createValidatingWebhookConfiguration(ctx, f, validatingWebhookConfiguration) framework.ExpectNoError(err, "registering webhook config %s", f.UniqueName) defer func() { err := client.AdmissionregistrationV1().ValidatingWebhookConfigurations().Delete(ctx, validatingWebhookConfiguration.Name, metav1.DeleteOptions{}) framework.ExpectNoError(err, "Deleting mutating webhook configuration") }() err = waitWebhookConfigurationReady(ctx, f, f.Namespace.Name) framework.ExpectNoError(err, "waiting for webhook configuration to be ready") ginkgo.By("validate that the validating webhook configuration does not reject leases") _, err = client.CoordinationV1().Leases(f.Namespace.Name).Create(ctx, &coordinationv1.Lease{ ObjectMeta: metav1.ObjectMeta{ Name: "lease" + f.UniqueName, }, Spec: coordinationv1.LeaseSpec{}, }, metav1.CreateOptions{}) framework.ExpectNoError(err, "creating coordination.k8s.io/lease object") ginkgo.By("validate that the validating webhook configuration does reject configMaps") _, err = client.CoreV1().ConfigMaps(f.Namespace.Name).Create(ctx, &v1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "cm" + f.UniqueName, }, Data: map[string]string{ "reject": "this", }, }, metav1.CreateOptions{}) framework.ExpectError(err, "creating configmap object") expectedErrMsg := "denied the request: this webhook denies all requests" gomega.Expect(strings.Contains(err.Error(), expectedErrMsg)).To(gomega.BeTrue()) }) /* Release: v1.28 </del> Testname: Mutating Admission webhook, mutating webhook excluding object with specific name Description: Create a mutating webhook configuration with matchConditions field that will reject all resources except ones with a specific name 'skip-me'. Create