enable PIS & MCN tests on SNO & target SNO PISs to master roles

Author: isabella-janssen

test/extended/machine_config/helpers.go

@@ -430,19 +430,19 @@ func ValidateMCNForNodeInPool(oc *exutil.CLI, clientSet *machineconfigclient.Cli
 	return nil
 }
 
-// `GetRandomNode` gets a random node from a given MCP and checks whether the node is ready. If no
+// `GetRandomNode` gets a random node from with a given role and checks whether the node is ready. If no
 // nodes are ready, it will wait for up to 5 minutes for a node to become available.
-func GetRandomNode(oc *exutil.CLI, pool string) corev1.Node {
-	if node := getRandomNode(oc, pool); isNodeReady(node) {
+func GetRandomNode(oc *exutil.CLI, role string) corev1.Node {
+	if node := getRandomNode(oc, role); isNodeReady(node) {
 		return node
 	}
 
 	// If no nodes are ready, wait for up to 5 minutes for one to be ready
 	waitPeriod := time.Minute * 5
-	framework.Logf("No ready nodes found for pool '%s', waiting up to %s for a ready node to become available", pool, waitPeriod)
+	framework.Logf("No ready nodes found with role '%s', waiting up to %s for a ready node to become available", role, waitPeriod)
 	var targetNode corev1.Node
 	o.Eventually(func() bool {
-		if node := getRandomNode(oc, pool); isNodeReady(node) {
+		if node := getRandomNode(oc, role); isNodeReady(node) {
 			targetNode = node
 			return true
 		}
@@ -453,9 +453,9 @@ func GetRandomNode(oc *exutil.CLI, pool string) corev1.Node {
 	return targetNode
 }
 
-// `getRandomNode` gets a random node from a given pool
-func getRandomNode(oc *exutil.CLI, pool string) corev1.Node {
-	nodes, err := GetNodesByRole(oc, pool)
+// `getRandomNode` gets a random node with a given role
+func getRandomNode(oc *exutil.CLI, role string) corev1.Node {
+	nodes, err := GetNodesByRole(oc, role)
 	o.Expect(err).NotTo(o.HaveOccurred())
 	o.Expect(nodes).ShouldNot(o.BeEmpty())
 

test/extended/machine_config/machine_config_node.go

@@ -99,12 +99,10 @@ var _ = g.Describe("[sig-mco][OCPFeatureGate:MachineConfigNodes]", func() {
 	})
 
 	g.It("Should properly block MCN updates by impersonation of the MCD SA [apigroup:machineconfiguration.openshift.io]", func() {
-		skipOnSingleNodeTopology(oc) //skip this test for SNO
 		ValidateMCNScopeImpersonationPathTest(oc)
 	})
 
 	g.It("Should properly update the MCN from the associated MCD [apigroup:machineconfiguration.openshift.io]", func() {
-		skipOnSingleNodeTopology(oc) //skip this test for SNO
 		ValidateMCNScopeHappyPathTest(oc)
 	})
 })
@@ -571,7 +569,7 @@ func ValidateMCNScopeSadPathTest(oc *exutil.CLI) {
 	// Grab two different nodes, so we don't end up testing and targeting the same node.
 	nodeUnderTest := nodes[0]
 	targetNode := nodes[1]
-	framework.Logf("Testing with nodes '%v' and '%v'.", nodeUnderTest, targetNode)
+	framework.Logf("Testing with nodes '%v' and '%v'.", nodeUnderTest.Name, targetNode.Name)
 
 	// Attempt to patch the MCN owned by targetNode from nodeUnderTest's MCD. This should fail.
 	// This oc command effectively use the service account of the nodeUnderTest's MCD pod, which should only be able to edit nodeUnderTest's MCN.
@@ -584,9 +582,10 @@ func ValidateMCNScopeSadPathTest(oc *exutil.CLI) {
 
 // `ValidateMCNScopeImpersonationPathTest` checks that MCN updates by impersonation of the MCD SA are blocked
 func ValidateMCNScopeImpersonationPathTest(oc *exutil.CLI) {
-	// Grab a random node from the worker pool
+	// Grab a random node with a worker role
 	nodeUnderTest := GetRandomNode(oc, "worker")
-	framework.Logf("Testing with node '%v'.", nodeUnderTest)
+	o.Expect(nodeUnderTest.Name).NotTo(o.Equal(""), "Could not get a `worker` node.")
+	framework.Logf("Testing with node '%v'.", nodeUnderTest.Name)
 
 	var errb bytes.Buffer
 	// Attempt to patch the MCN owned by nodeUnderTest by impersonating the MCD SA. This should fail.
@@ -602,17 +601,18 @@ func ValidateMCNScopeImpersonationPathTest(oc *exutil.CLI) {
 
 // `ValidateMCNScopeHappyPathTest` checks that MCN updates from the associated MCD are allowed
 func ValidateMCNScopeHappyPathTest(oc *exutil.CLI) {
-	// Grab a random node from the worker pool
+	// Grab a random node with a worker role
 	nodeUnderTest := GetRandomNode(oc, "worker")
-	framework.Logf("Testing with node '%v'.", nodeUnderTest)
+	o.Expect(nodeUnderTest.Name).NotTo(o.Equal(""), "Could not get a `worker` node.")
+	framework.Logf("Testing with node '%v'.", nodeUnderTest.Name)
 
 	// Get node's starting desired version
 	nodeDesiredConfig := nodeUnderTest.Annotations[desiredConfigAnnotationKey]
 
 	// Attempt to patch the MCN owned by nodeUnderTest from nodeUnderTest's MCD. This should succeed.
 	// This oc command effectively use the service account of the nodeUnderTest's MCD pod, which should only be able to edit nodeUnderTest's MCN.
 	ExecCmdOnNode(oc, nodeUnderTest, "chroot", "/rootfs", "oc", "patch", "machineconfignodes", nodeUnderTest.Name, "--type=merge", "-p", "{\"spec\":{\"configVersion\":{\"desired\":\"rendered-worker-test\"}}}")
-	framework.Logf("MCN '%v' patched successfully.", nodeUnderTest)
+	framework.Logf("MCN '%v' patched successfully.", nodeUnderTest.Name)
 
 	// Cleanup by updating the MCN desired config back to the original value.
 	framework.Logf("Cleaning up patched MCN's desired config value.")

test/extended/machine_config/pinnedimages.go

@@ -33,11 +33,13 @@ var _ = g.Describe("[sig-mco][OCPFeatureGate:PinnedImages][OCPFeatureGate:Machin
 		MCOKubeletConfigBaseDir     = exutil.FixturePath("testdata", "machine_config", "kubeletconfig")
 
 		pinnedImageSetFixture              = filepath.Join(MCOPinnedImageBaseDir, "pis.yaml")
+		masterPinnedImageSetFixture        = filepath.Join(MCOPinnedImageBaseDir, "masterPis.yaml")
 		customMCPFixture                   = filepath.Join(MCOMachineConfigPoolBaseDir, "customMCP.yaml")
 		customMCPpinnedImageSetFixture     = filepath.Join(MCOPinnedImageBaseDir, "customMCPpis.yaml")
 		customGCMCPpinnedImageSetFixture   = filepath.Join(MCOPinnedImageBaseDir, "customGCMCPpis.yaml")
 		customGcKCFixture                  = filepath.Join(MCOKubeletConfigBaseDir, "gcKC.yaml")
 		invalidPinnedImageSetFixture       = filepath.Join(MCOPinnedImageBaseDir, "invalidPis.yaml")
+		masterInvalidPinnedImageSetFixture = filepath.Join(MCOPinnedImageBaseDir, "masterInvalidPis.yaml")
 		customInvalidPinnedImageSetFixture = filepath.Join(MCOPinnedImageBaseDir, "customInvalidPis.yaml")
 
 		oc = exutil.NewCLIWithoutNamespace("machine-config")
@@ -109,21 +111,31 @@ var _ = g.Describe("[sig-mco][OCPFeatureGate:PinnedImages][OCPFeatureGate:Machin
 	})
 
 	g.It("All Nodes in a standard Pool should have the PinnedImages PIS [apigroup:machineconfiguration.openshift.io]", func() {
-		// TODO (ijanssen/rsaini): re-enable this test on SNO after fixing OCPBUGS-55384
-		// (temporarily) skip these tests on SNO
-		skipOnSingleNodeTopology(oc)
-
 		kubeClient, err := kubernetes.NewForConfig(oc.KubeFramework().ClientConfig())
 		o.Expect(err).NotTo(o.HaveOccurred(), "Get KubeClient")
 
-		SimplePISTest(oc, kubeClient, pinnedImageSetFixture, true)
+		// Since the node in a SNO cluster is a part of the master MCP, the PIS for this test on a
+		// single node topology should target `master`.
+		pisFixture := pinnedImageSetFixture
+		if IsSingleNode(oc) {
+			pisFixture = masterPinnedImageSetFixture
+		}
+
+		SimplePISTest(oc, kubeClient, pisFixture, true)
 	})
 
 	g.It("Invalid PIS leads to degraded MCN in a standard Pool [apigroup:machineconfiguration.openshift.io]", func() {
 		kubeClient, err := kubernetes.NewForConfig(oc.KubeFramework().ClientConfig())
 		o.Expect(err).NotTo(o.HaveOccurred(), "Get KubeClient")
 
-		SimplePISTest(oc, kubeClient, invalidPinnedImageSetFixture, false)
+		// Since the node in a SNO cluster is a part of the master MCP, the PIS for this test on a
+		// single node topology should target `master`.
+		pisFixture := invalidPinnedImageSetFixture
+		if IsSingleNode(oc) {
+			pisFixture = masterInvalidPinnedImageSetFixture
+		}
+
+		SimplePISTest(oc, kubeClient, pisFixture, false)
 	})
 
 	g.It("Invalid PIS leads to degraded MCN in a custom Pool [apigroup:machineconfiguration.openshift.io]", func() {

test/extended/testdata/bindata.go

@@ -0,0 +1,9 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: PinnedImageSet
+metadata:
+  name: test-pinned
+  labels:
+    machineconfiguration.openshift.io/role: "master"
+spec:
+  pinnedImages:
+   - name: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:86d26e7ebcccd6f07a75db5b1e56283b25c2ee1c6a755d6ffc5a4d59beb9cdef

test/extended/testdata/machine_config/pinnedimage/masterInvalidPis.yaml

@@ -0,0 +1,9 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: PinnedImageSet
+metadata:
+  name: test-pinned
+  labels:
+    machineconfiguration.openshift.io/role: "master"
+spec:
+  pinnedImages:
+   - name: quay.io/openshifttest/busybox@sha256:c5439d7db88ab5423999530349d327b04279ad3161d7596d2126dfb5b02bfd1f