investigate: test passes even without the proper SA permissions#1263
investigate: test passes even without the proper SA permissions#1263MikelAlejoBR wants to merge 1 commit intocodeready-toolchain:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MikelAlejoBR The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughAppends additional test logic to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The "reset namespaces" test passes even though the PR which adds the "member" service account the, in theory, required permission to delete namespaces has not been merged. The test does not pass when running the tests locally, and in stage and production the feature does not work without that permission. SANDBOX-1067
MikelAlejoBR
force-pushed
the
SANDBOX-1067-investigate-passing-test
branch
from
93dfdde to
c549348
Compare
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@test/e2e/namespaces_reset_test.go`:
- Around line 115-123: The test contains an investigation block that
unconditionally aborts via require.FailNow (remove the call to require.FailNow)
— instead replace the temporary dump of clusterRole with a concrete RBAC
assertion: fetch the ClusterRole (variable clusterRole via
hostAwaitily.Client.Get with types.NamespacedName{Name:
"toolchaincluster-"+memberAwaitily.Namespace}), then assert that the role grants
namespace delete permission (e.g., check rules in clusterRole.Rules include
verbs ["delete"] for resources ["namespaces"] and appropriate API groups) and
use require.NoError/require.True assertions rather than forcing a failure; keep
the logging line if helpful but do not call require.FailNow.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
test/e2e/namespaces_reset_test.go
| // DELETEME - printing the member service account's cluster role to check | ||
| // its permissions. | ||
| clusterRole := rbacv1.ClusterRole{} | ||
| err = hostAwaitily.Client.Get(context.TODO(), types.NamespacedName{Name: "toolchaincluster-" + memberAwaitily.Namespace}, &clusterRole) | ||
| require.NoError(s.T(), err, "unable to obtain the cluster role") | ||
|
|
||
| s.T().Logf("ClusterRole: %+v", clusterRole) | ||
|
|
||
| require.FailNow(s.T(), "the test succeeded but we are failing to gather information") |
There was a problem hiding this comment.
Remove unconditional FailNow; this makes the test permanently fail.
Line 123 aborts the test regardless of behavior, so this cannot be merged as-is. Convert this investigation block into a concrete RBAC assertion (delete on namespaces) instead of forced failure.
Proposed change
- // DELETEME - printing the member service account's cluster role to check
- // its permissions.
+ // Verify that the member cluster role can delete namespaces.
clusterRole := rbacv1.ClusterRole{}
err = hostAwaitily.Client.Get(context.TODO(), types.NamespacedName{Name: "toolchaincluster-" + memberAwaitily.Namespace}, &clusterRole)
require.NoError(s.T(), err, "unable to obtain the cluster role")
- s.T().Logf("ClusterRole: %+v", clusterRole)
-
- require.FailNow(s.T(), "the test succeeded but we are failing to gather information")
+ hasDeleteNamespaces := false
+ for _, rule := range clusterRole.Rules {
+ matchesCoreNamespaces := false
+ for _, apiGroup := range rule.APIGroups {
+ if apiGroup == "" || apiGroup == "*" {
+ for _, resource := range rule.Resources {
+ if resource == "namespaces" || resource == "*" {
+ matchesCoreNamespaces = true
+ break
+ }
+ }
+ }
+ if matchesCoreNamespaces {
+ break
+ }
+ }
+ if !matchesCoreNamespaces {
+ continue
+ }
+ for _, verb := range rule.Verbs {
+ if verb == "delete" || verb == "*" {
+ hasDeleteNamespaces = true
+ break
+ }
+ }
+ if hasDeleteNamespaces {
+ break
+ }
+ }
+ require.True(s.T(), hasDeleteNamespaces, "expected ClusterRole %q to allow deleting namespaces", clusterRole.Name)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@test/e2e/namespaces_reset_test.go` around lines 115 - 123, The test contains
an investigation block that unconditionally aborts via require.FailNow (remove
the call to require.FailNow) — instead replace the temporary dump of clusterRole
with a concrete RBAC assertion: fetch the ClusterRole (variable clusterRole via
hostAwaitily.Client.Get with types.NamespacedName{Name:
"toolchaincluster-"+memberAwaitily.Namespace}), then assert that the role grants
namespace delete permission (e.g., check rules in clusterRole.Rules include
verbs ["delete"] for resources ["namespaces"] and appropriate API groups) and
use require.NoError/require.True assertions rather than forcing a failure; keep
the logging line if helpful but do not call require.FailNow.
|
/retest |
|
@MikelAlejoBR: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
The "reset namespaces" test passes even though the PR which adds the "member" service account the, in theory, required permission to delete namespaces has not been merged.
The test does not pass when running the tests locally, and in stage and production the feature does not work without that permission.
Jira ticket
[SANDBOX-1067]
Summary by CodeRabbit