integration: ctb: apiserversigner test to use certbeta api

Author: stlaz

test/integration/clustertrustbundles/apiserversigner_test.go

@@ -30,7 +30,7 @@ import (
 	"testing"
 	"time"
 
-	"k8s.io/api/certificates/v1alpha1"
+	"k8s.io/api/certificates/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -47,9 +47,6 @@ import (
 )
 
 func TestClusterTrustBundlesPublisherController(t *testing.T) {
-	// KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE allows for APIs pending removal to not block tests
-	// TODO: Remove this line once certificates v1alpha1 types to be removed in 1.32 are fully removed
-	t.Setenv("KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE", "true")
 	ctx := ktesting.Init(t)
 
 	certBytes := mustMakeCertificate(t, &x509.Certificate{
@@ -73,7 +70,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 		"--disable-admission-plugins", "ServiceAccount",
 		"--authorization-mode=RBAC",
 		"--feature-gates", "ClusterTrustBundle=true",
-		fmt.Sprintf("--runtime-config=%s=true", v1alpha1.SchemeGroupVersion),
+		fmt.Sprintf("--runtime-config=%s=true", v1beta1.SchemeGroupVersion),
 	}
 	storageConfig := framework.SharedEtcd()
 	server := kubeapiservertesting.StartTestServerOrDie(t, nil, apiServerFlags, storageConfig)
@@ -108,12 +105,12 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 	unrelatedPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: unrelatedSigner})
 	// set up a signer that's completely unrelated to the controller to check
 	// it's not anyhow handled by it
-	unrelatedCTB, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx,
-		&v1alpha1.ClusterTrustBundle{
+	unrelatedCTB, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx,
+		&v1beta1.ClusterTrustBundle{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "test.test:unrelated:0",
 			},
-			Spec: v1alpha1.ClusterTrustBundleSpec{
+			Spec: v1beta1.ClusterTrustBundleSpec{
 				SignerName:  "test.test/unrelated",
 				TrustBundle: string(unrelatedPEM),
 			},
@@ -127,11 +124,11 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 	waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM)
 
 	t.Log("check that the controller deletes any additional bundles for the same signer")
-	if _, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx, &v1alpha1.ClusterTrustBundle{
+	if _, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx, &v1beta1.ClusterTrustBundle{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "kubernetes.io:kube-apiserver-serving:testname",
 		},
-		Spec: v1alpha1.ClusterTrustBundleSpec{
+		Spec: v1beta1.ClusterTrustBundleSpec{
 			SignerName:  "kubernetes.io/kube-apiserver-serving",
 			TrustBundle: string(certPEM),
 		},
@@ -152,7 +149,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 	})
 	differentSignerPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: differentSigner})
 
-	ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
+	ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
 		FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving",
 	})
 	if err != nil || len(ctbList.Items) != 1 {
@@ -162,13 +159,13 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 	ctbToUpdate := ctbList.Items[0].DeepCopy()
 	ctbToUpdate.Spec.TrustBundle = string(differentSignerPEM)
 
-	if _, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil {
+	if _, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil {
 		t.Fatalf("failed to update ctb with new PEM bundle: %v", err)
 	}
 
 	waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM)
 
-	unrelatedCTB, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{})
+	unrelatedCTB, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{})
 	if err != nil {
 		t.Fatalf("failed to get the unrelated CTB back: %v", err)
 	}
@@ -184,7 +181,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
 
 func waitUntilSingleKASSignerCTB(ctx context.Context, t *testing.T, clientSet *clientset.Clientset, caPEM []byte) {
 	err := wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 30*time.Second, true, func(ctx context.Context) (done bool, err error) {
-		ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
+		ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
 			FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving",
 		})