Change:
[x] test approval issue : [x] test pr : [x] two weeks soak end date : 31 Dec 2022 [X] test promotion pr : According to following two APIsnoop queries, there are still two authorization endpoints which are untested. example endpoint kind ---------------------------------------------------------+
-+-------------------------- createAuthorizationV1NamespacedLocalSubjectAccessReview LocalSubjectAccessReview (1 row) sql-mode select distinct endpoint, testhit AS "e2e Test", conftesthit AS "Conformance Test" from public.auditevent where endpoint ilike '%SubjectAccessReview' and useragent like '%e2e%' and not conftesthit order by endpoint limit 10; example endpoint Conformance Test ------------------------------------------+----------+------------------ createAuthorizationV1SubjectAccessReview f (1 row) [It] should support SubjectReview API operations STEP: Create pod "pod-x6fhh" in namespace "subjectreview-1704" 12/07/22 21:33:12.332 Dec 7 21:33:12.441: INFO: Waiting up to 5m0s for pod "pod-x6fhh" in namespace "subjectreview-1704" to be "running" Dec 7 21:33:12.502: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 61.265222ms Dec 7 21:33:14.512: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 2.070783878s Dec 7 21:33:16.520: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 4.078677494s Dec 7 21:33:18.513: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 6.07168643s Dec 7 21:33:20.510: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 8.068598657s Dec 7 21:33:22.509: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 10.068442532s Dec 7 21:33:24.514: INFO: Pod "pod-x6fhh": Phase="Pending", Reason="", readiness=false. Elapsed: 12.073076728s Dec 7 21:33:26.511: INFO: Pod "pod-x6fhh": Phase="Running", Reason="", readiness=true. Elapsed: 14.069523123s Dec 7 21:33:26.511: INFO: Pod "pod-x6fhh" satisfied condition "running" Dec 7 21:33:26.515: INFO: "pod-x6fhh" in namespace "subjectreview-1704" is "Running" Dec 7 21:33:26.515: INFO: serviceaccount name: "system:serviceaccount:subjectreview-1704:default" STEP: Creating SubjectAccessReview in "subjectreview-1704" namespace 12/07/22 21:33:26.515 Dec 7 21:33:26.521: INFO: sarResponse Status: v1.SubjectAccessReviewStatus{Allowed:false, Denied:false, Reason:"", EvaluationError:""} STEP: Creating clientset to impersonate "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.521 STEP: Verifying api 'get' call to "pod-x6fhh" as "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.522 Dec 7 21:33:26.525: INFO: api call by "system:serviceaccount:subjectreview-1704:default" was denied Dec 7 21:33:26.525: INFO: SubjectAccessReview has been verified STEP: Creating a LocalSubjectAccessReview in "subjectreview-1704" namespace 12/07/22 21:33:26.525 Dec 7 21:33:26.530: INFO: lsarResponse Status: v1.SubjectAccessReviewStatus{Allowed:false, Denied:false, Reason:"", EvaluationError:""} STEP: Verifying api 'get' call to "pod-x6fhh" as "system:serviceaccount:subjectreview-1704:default" 12/07/22 21:33:26.53 Dec 7 21:33:26.532: INFO: api call by "system:serviceaccount:subjectreview-1704:default" was denied Dec 7 21:33:26.532: INFO: LocalSubjectAccessReview has been verified sql-mode select distinct substring(endpoint from 'w+') AS endpoint, right(useragent,43) AS useragent from testing.auditevent where useragent like 'e2e%should%' and releasedate::BIGINT round(((EXTRACT(EPOCH FROM NOW()))::numeric)*1000,0) - and endpoint ilike '%subject%' order by endpoint limit 10; example endpoint | useragent ---------------------------------------------------------+--------------------------------------------- createAuthorizationV1NamespacedLocalSubjectAccessReview | should support SubjectReview API operations createAuthorizationV1SubjectAccessReview | should support SubjectReview API operations (2 rows) If a test with these calls gets merged, test coverage will go up by 2 points This test is also created with the goal of conformance promotion. /sig testing /sig architecture /area conformance
/triage accepted
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
<ins> /* Copyright 2022 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package auth import ( "context" "fmt" authorizationv1 "k8s.io/api/authorization/v1" v1 "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apiserver/pkg/authentication/serviceaccount" "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" "k8s.io/kubernetes/test/e2e/framework" "github.com/onsi/ginkgo/v2" ) var _ = SIGDescribe("SubjectReview", func() { f := framework.NewDefaultFramework("subjectreview") ginkgo.It("should support SubjectReview API operations", func() { AuthClient := f.ClientSet.AuthorizationV1() ns := f.Namespace.Name saName := "e2e" ginkgo.By(fmt.Sprintf("Creating a Serviceaccount %q in namespace %q", saName, ns)) sa, err := f.ClientSet.CoreV1().ServiceAccounts(ns).Create(context.TODO(), &v1.ServiceAccount{ ObjectMeta: metav1.ObjectMeta{ Name: saName, }, }, metav1.CreateOptions{}) framework.ExpectNoError(err, "Unable to create serviceaccount %q", saName) saUsername := serviceaccount.MakeUsername(sa.Namespace, sa.Name) framework.Logf("saUsername: %q", saUsername) saGroups := []string{"system:authenticated"} saGroups = append(saGroups, serviceaccount.MakeGroupNames(sa.Namespace)...) framework.Logf("saGroups: %#v", saGroups) saUID := string(sa.UID) framework.Logf("saUID: %q", saUID) ginkgo.By(fmt.Sprintf("Creating clientset to impersonate %q", saUsername)) config := rest.CopyConfig(f.ClientConfig()) config.Impersonate = rest.ImpersonationConfig{ UserName: saUsername, UID:      saUID, Groups:   saGroups, } impersonatedClientSet, err := kubernetes.NewForConfig(config) framework.ExpectNoError(err, "Could not load config, %v", err) ginkgo.By(fmt.Sprintf("Creating SubjectAccessReview for %q", saUsername)) sar := &authorizationv1.SubjectAccessReview{ Spec: authorizationv1.SubjectAccessReviewSpec{ ResourceAttributes: &authorizationv1.ResourceAttributes{ Verb:      "list", Resource:  "configmaps", Namespace: ns, Version:   "v1", }, User:   saUsername, Groups: saGroups, UID:    saUID, }, } sarResponse, err := AuthClient.SubjectAccessReviews().Create(context.TODO(), sar, metav1.CreateOptions{}) framework.ExpectNoError(err, "Unable to create a SubjectAccessReview, %#v", err) framework.Logf("sarResponse Status: %#v", sarResponse.Status) expectedAllowed := sarResponse.Status.Allowed ginkgo.By(fmt.Sprintf("Verifying as %q api 'list' configmaps in %q namespace", saUsername, ns)) _, requestErr := impersonatedClientSet.CoreV1().ConfigMaps(ns).List(context.TODO(), metav1.ListOptions{}) actuallyAllowed := false switch { case apierrors.IsForbidden(requestErr): actuallyAllowed = false case requestErr != nil: framework.Fail("Unexpected error") default: actuallyAllowed = true } if actuallyAllowed != expectedAllowed { framework.Fail(fmt.Sprintf("Could not verify SubjectAccessReview for %q in namespace %q: SubjectAccessReview allowed: %v, request allowed: %v, request error: %v", saUsername, ns, expectedAllowed, actuallyAllowed, requestErr)) } framework.Logf("SubjectAccessReview has been verified") ginkgo.By(fmt.Sprintf("Creating a LocalSubjectAccessReview for %q", saUsername)) lsar := &authorizationv1.LocalSubjectAccessReview{ ObjectMeta: metav1.ObjectMeta{ Namespace: ns, }, Spec: authorizationv1.SubjectAccessReviewSpec{ ResourceAttributes: &authorizationv1.ResourceAttributes{ Verb:      "list", Resource:  "configmaps", Namespace: ns, Version:   "v1", }, User:   saName, Groups: saGroups, UID:    saUID, }, } lsarResponse, err := AuthClient.LocalSubjectAccessReviews(ns).Create(context.TODO(), lsar, metav1.CreateOptions{}) framework.ExpectNoError(err, "Unable to create a LocalSubjectAccessReview, %#v", err) framework.Logf("lsarResponse Status: %#v", lsarResponse.Status) expectedAllowed = lsarResponse.Status.Allowed if actuallyAllowed != expectedAllowed { framework.Fail(fmt.Sprintf("Could not verify LocalSubjectAccessReview for %q in namespace %q: LocalSubjectAccessReview allowed: %v, request allowed: %v, request error: %v", saUsername, ns, expectedAllowed, actuallyAllowed, requestErr)) } framework.Logf("LocalSubjectAccessReview has been verified") }) }) </ins>