Skip to content

Commit f6ced3e

Browse files
QiWang19QiWang19
committed
SigstoreImageVerification:update waitForMCP different config name
Signed-off-by: Qi Wang <[email protected]>
1 parent 9f7348b commit f6ced3e

File tree

1 file changed

+71
-44
lines changed

1 file changed

+71
-44
lines changed

‎test/extended/imagepolicy/imagepolicy.go‎

Lines changed: 71 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ import (
99
g "github.com/onsi/ginkgo/v2"
1010
o "github.com/onsi/gomega"
1111
configv1 "github.com/openshift/api/config/v1"
12+
mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
13+
machineconfigclient "github.com/openshift/client-go/machineconfiguration/clientset/versioned"
1214
machineconfighelper "github.com/openshift/origin/test/extended/machine_config"
1315
exutil "github.com/openshift/origin/test/extended/util"
1416
kapiv1 "k8s.io/api/core/v1"
@@ -76,8 +78,6 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
7678
createClusterImagePolicy(oc, testClusterImagePolicies[invalidPublicKeyClusterImagePolicyName])
7779
g.DeferCleanup(deleteClusterImagePolicy, oc, invalidPublicKeyClusterImagePolicyName)
7880

79-
waitForPoolComplete(oc)
80-
8181
pod, err := launchTestPod(tctx, clif, testPodName, testSignedPolicyScope)
8282
o.Expect(err).NotTo(o.HaveOccurred())
8383
g.DeferCleanup(deleteTestPod, tctx, clif, testPodName)
@@ -95,8 +95,6 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
9595
createClusterImagePolicy(oc, testClusterImagePolicies[invalidPublicKeyClusterImagePolicyName])
9696
g.DeferCleanup(deleteClusterImagePolicy, oc, invalidPublicKeyClusterImagePolicyName)
9797

98-
waitForPoolComplete(oc)
99-
10098
pod, err := launchTestPod(tctx, clif, testPodName, testSignedPolicyScope)
10199
o.Expect(err).NotTo(o.HaveOccurred())
102100
g.DeferCleanup(deleteTestPod, tctx, clif, testPodName)
@@ -109,8 +107,6 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
109107
createClusterImagePolicy(oc, testClusterImagePolicies[publiKeyRekorClusterImagePolicyName])
110108
g.DeferCleanup(deleteClusterImagePolicy, oc, publiKeyRekorClusterImagePolicyName)
111109

112-
waitForPoolComplete(oc)
113-
114110
pod, err := launchTestPod(tctx, clif, testPodName, testSignedPolicyScope)
115111
o.Expect(err).NotTo(o.HaveOccurred())
116112
g.DeferCleanup(deleteTestPod, tctx, clif, testPodName)
@@ -122,12 +118,6 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
122118
g.It("Should fail imagepolicy signature validation in different namespaces root of trust does not match the identity in the signature", func() {
123119
createImagePolicy(oc, testImagePolicies[invalidPublicKeyImagePolicyName], imgpolicyClif.Namespace.Name)
124120
g.DeferCleanup(deleteImagePolicy, oc, invalidPublicKeyImagePolicyName, imgpolicyClif.Namespace.Name)
125-
waitForPoolComplete(oc)
126-
127-
createImagePolicy(oc, testImagePolicies[invalidPublicKeyImagePolicyName], clif.Namespace.Name)
128-
g.DeferCleanup(deleteImagePolicy, oc, invalidPublicKeyImagePolicyName, clif.Namespace.Name)
129-
130-
waitForPoolComplete(oc)
131121

132122
pod, err := launchTestPod(tctx, imgpolicyClif, testPodName, testSignedPolicyScope)
133123
o.Expect(err).NotTo(o.HaveOccurred())
@@ -136,32 +126,14 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
136126
err = waitForTestPodContainerToFailSignatureValidation(tctx, imgpolicyClif, pod)
137127
o.Expect(err).NotTo(o.HaveOccurred())
138128

139-
pod, err = launchTestPod(tctx, clif, testPodName, testSignedPolicyScope)
140-
o.Expect(err).NotTo(o.HaveOccurred())
141-
g.DeferCleanup(deleteTestPod, tctx, clif, testPodName)
142-
143-
err = waitForTestPodContainerToFailSignatureValidation(tctx, clif, pod)
144-
o.Expect(err).NotTo(o.HaveOccurred())
145129
})
146130

147131
g.It("Should pass imagepolicy signature validation with signed image in namespaces", func() {
148-
createImagePolicy(oc, testImagePolicies[publiKeyRekorImagePolicyName], clif.Namespace.Name)
149-
g.DeferCleanup(deleteImagePolicy, oc, publiKeyRekorImagePolicyName, clif.Namespace.Name)
150-
waitForPoolComplete(oc)
151132

152133
createImagePolicy(oc, testImagePolicies[publiKeyRekorImagePolicyName], imgpolicyClif.Namespace.Name)
153134
g.DeferCleanup(deleteImagePolicy, oc, publiKeyRekorImagePolicyName, imgpolicyClif.Namespace.Name)
154135

155-
waitForPoolComplete(oc)
156-
157-
pod, err := launchTestPod(tctx, clif, testPodName, testSignedPolicyScope)
158-
o.Expect(err).NotTo(o.HaveOccurred())
159-
g.DeferCleanup(deleteTestPod, tctx, clif, testPodName)
160-
161-
err = e2epod.WaitForPodSuccessInNamespace(tctx, clif.ClientSet, pod.Name, pod.Namespace)
162-
o.Expect(err).NotTo(o.HaveOccurred())
163-
164-
pod, err = launchTestPod(tctx, imgpolicyClif, testPodName, testSignedPolicyScope)
136+
pod, err := launchTestPod(tctx, imgpolicyClif, testPodName, testSignedPolicyScope)
165137
o.Expect(err).NotTo(o.HaveOccurred())
166138
g.DeferCleanup(deleteTestPod, tctx, imgpolicyClif, testPodName)
167139

@@ -170,13 +142,11 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
170142
})
171143
})
172144

173-
func waitForPoolComplete(oc *exutil.CLI) {
174-
time.Sleep(10 * time.Second)
175-
machineconfighelper.WaitForConfigAndPoolComplete(oc, workerPool, registriesWorkerPoolMachineConfig)
176-
machineconfighelper.WaitForConfigAndPoolComplete(oc, masterPool, registriesMasterPoolMachineConfig)
177-
}
178-
179145
func updateImageConfig(oc *exutil.CLI, allowedRegistries []string) {
146+
e2e.Logf("Updating image config with allowed registries")
147+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
148+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
149+
180150
err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
181151
imageConfig, err := oc.AdminConfigClient().ConfigV1().Images().Get(
182152
context.Background(), "cluster", metav1.GetOptions{},
@@ -191,13 +161,15 @@ func updateImageConfig(oc *exutil.CLI, allowedRegistries []string) {
191161
return err
192162
})
193163
o.Expect(err).NotTo(o.HaveOccurred(), "error updating image config")
194-
time.Sleep(10 * time.Second)
195-
machineconfighelper.WaitForConfigAndPoolComplete(oc, workerPool, registriesWorkerPoolMachineConfig)
196-
machineconfighelper.WaitForConfigAndPoolComplete(oc, masterPool, registriesMasterPoolMachineConfig)
164+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
165+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
197166
}
198167

199168
func cleanupImageConfig(oc *exutil.CLI) error {
200-
return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
169+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
170+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
171+
172+
err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
201173
imageConfig, err := oc.AdminConfigClient().ConfigV1().Images().Get(
202174
context.Background(), "cluster", metav1.GetOptions{},
203175
)
@@ -208,9 +180,12 @@ func cleanupImageConfig(oc *exutil.CLI) error {
208180
_, err = oc.AdminConfigClient().ConfigV1().Images().Update(
209181
context.Background(), imageConfig, metav1.UpdateOptions{},
210182
)
211-
waitForPoolComplete(oc)
212183
return err
213184
})
185+
o.Expect(err).NotTo(o.HaveOccurred(), "error cleaning up image config")
186+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
187+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
188+
return nil
214189
}
215190

216191
func launchTestPod(ctx context.Context, f *e2e.Framework, podName, image string) (*kapiv1.Pod, error) {
@@ -248,28 +223,53 @@ func waitForTestPodContainerToFailSignatureValidation(ctx context.Context, f *e2
248223
}
249224

250225
func createClusterImagePolicy(oc *exutil.CLI, policy configv1.ClusterImagePolicy) {
226+
e2e.Logf("Creating cluster image policy %s", policy.Name)
227+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
228+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
229+
251230
_, err := oc.AdminConfigClient().ConfigV1().ClusterImagePolicies().Create(context.TODO(), &policy, metav1.CreateOptions{})
252231
o.Expect(err).NotTo(o.HaveOccurred())
232+
233+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
234+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
253235
}
254236

255237
func deleteClusterImagePolicy(oc *exutil.CLI, policyName string) error {
238+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
239+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
240+
256241
if err := oc.AdminConfigClient().ConfigV1().ClusterImagePolicies().Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
257242
return fmt.Errorf("failed to delete cluster image policy %s: %v", policyName, err)
258243
}
259-
waitForPoolComplete(oc)
244+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
245+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
260246
return nil
261247
}
262248

263249
func createImagePolicy(oc *exutil.CLI, policy configv1.ImagePolicy, namespace string) {
250+
// Capture initial rendered config names for both pools before creating the policy
251+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
252+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
253+
254+
e2e.Logf("Creating image policy %s in namespace %s", policy.Name, namespace)
264255
_, err := oc.AdminConfigClient().ConfigV1().ImagePolicies(namespace).Create(context.TODO(), &policy, metav1.CreateOptions{})
265256
o.Expect(err).NotTo(o.HaveOccurred())
257+
258+
// Wait until each pool's Spec.Configuration.Name changes from the initial value
259+
// and the pool reports Updated=true
260+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
261+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
266262
}
267263

268264
func deleteImagePolicy(oc *exutil.CLI, policyName string, namespace string) error {
265+
initialWorkerSpec := getMCPCurrentSpecConfigName(oc, workerPool)
266+
initialMasterSpec := getMCPCurrentSpecConfigName(oc, masterPool)
267+
269268
if err := oc.AdminConfigClient().ConfigV1().ImagePolicies(namespace).Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
270269
return fmt.Errorf("failed to delete image policy %s in namespace %s: %v", policyName, namespace, err)
271270
}
272-
waitForPoolComplete(oc)
271+
waitForMCPConfigSpecChangeAndUpdated(oc, workerPool, initialWorkerSpec)
272+
waitForMCPConfigSpecChangeAndUpdated(oc, masterPool, initialMasterSpec)
273273
return nil
274274
}
275275

@@ -380,3 +380,30 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5
380380
}
381381
return testImagePolicies
382382
}
383+
384+
// getMCPCurrentSpecConfigName returns the current Spec.Configuration.Name for the given MCP
385+
func getMCPCurrentSpecConfigName(oc *exutil.CLI, pool string) string {
386+
clientSet, err := machineconfigclient.NewForConfig(oc.KubeFramework().ClientConfig())
387+
o.Expect(err).NotTo(o.HaveOccurred())
388+
mcp, err := clientSet.MachineconfigurationV1().MachineConfigPools().Get(context.TODO(), pool, metav1.GetOptions{})
389+
o.Expect(err).NotTo(o.HaveOccurred())
390+
return mcp.Spec.Configuration.Name
391+
}
392+
393+
// waitForMCPConfigSpecChangeAndUpdated waits until Spec.Configuration.Name changes from the provided initial value
394+
// and the MCP reports Updated=true
395+
func waitForMCPConfigSpecChangeAndUpdated(oc *exutil.CLI, pool string, initialSpecName string) {
396+
e2e.Logf("Waiting for pool %s to complete", pool)
397+
clientSet, err := machineconfigclient.NewForConfig(oc.KubeFramework().ClientConfig())
398+
o.Expect(err).NotTo(o.HaveOccurred())
399+
o.Eventually(func() bool {
400+
mcp, err := clientSet.MachineconfigurationV1().MachineConfigPools().Get(context.TODO(), pool, metav1.GetOptions{})
401+
if err != nil {
402+
return false
403+
}
404+
if mcp.Status.Configuration.Name == initialSpecName {
405+
return false
406+
}
407+
return machineconfighelper.IsMachineConfigPoolConditionTrue(mcp.Status.Conditions, mcfgv1.MachineConfigPoolUpdated)
408+
}, 20*time.Minute, 10*time.Second).Should(o.BeTrue())
409+
}

0 commit comments

Comments
 (0)