STOR-2560: Add testcase for readonlyrootfilesystem #30647
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: automatic mode |
|
@chao007: This pull request references STOR-2560 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target either version "4.22." or "openshift-4.22.", but it targets "openshift-4.21" instead. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: chao007 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/test okd-scos-images |
|
/test e2e-vsphere-ovn |
|
@chao007: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Risk analysis has seen new tests most likely introduced by this PR. New Test Risks for sha: 101385b
New tests seen in this PR at sha: 101385b
|
| runReadOnlyRootFsChecks(oc, nodeWorkloads, currentPlatform, true) | ||
| }) | ||
|
|
||
| g.It("should verify CSI controller and node pods are running and ready", func() { |
There was a problem hiding this comment.
If either CSI controller or node pods unheadlthy our CSO should be degrade and installation will be failed, so it seems we do not need check these.
There was a problem hiding this comment.
Agree it is not mandatory.
| }) | ||
|
|
||
| // runReadOnlyRootFsChecks verifies that all containers in the workload have readOnlyRootFilesystem set | ||
| func runReadOnlyRootFsChecks(oc *exutil.CLI, workloads []csiWorkloadCheck, currentPlatform string, checkRunning bool) { |
There was a problem hiding this comment.
checkRunning parameter sounds like unused.
|
|
||
| for _, workload := range workloads { | ||
| // Skip if platform doesn't match | ||
| if workload.Platform != "" && workload.Platform != currentPlatform && workload.Platform != "all" { |
There was a problem hiding this comment.
The condition looks weird ..., from my understanding should be ->
| if workload.Platform != "" && workload.Platform != currentPlatform && workload.Platform != "all" { | |
| if workload.Platform != currentPlatform || workload.Platform != "all" { |
,right?
| deployment, err := oc.AdminKubeClient().AppsV1().Deployments(workload.Namespace).Get(context.TODO(), workload.Name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| if errors.IsNotFound(err) { | ||
| results = append(results, fmt.Sprintf("[SKIP] %s not found", resourceName)) |
There was a problem hiding this comment.
We'd better be careful to use not found skips, since we expect it should exist and we should also consider for hypershift tests.
There was a problem hiding this comment.
There might be some exceptions like Manila(it depends on the backend) or 3rd operators, can we first check if specific CSI Driver is installed and only check the related resource when CSI Driver is installed?
| case WorkloadTypeDaemonSet: | ||
| daemonset, err := oc.AdminKubeClient().AppsV1().DaemonSets(workload.Namespace).Get(context.TODO(), workload.Name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| if errors.IsNotFound(err) { |
| WorkloadTypeDeployment WorkloadType = "Deployment" | ||
| WorkloadTypeDaemonSet WorkloadType = "DaemonSet" |
There was a problem hiding this comment.
| WorkloadTypeDeployment WorkloadType = "Deployment" | |
| WorkloadTypeDaemonSet WorkloadType = "DaemonSet" | |
| Deployment WorkloadType = "Deployment" | |
| DaemonSet WorkloadType = "DaemonSet" |
maybe better, WorkloadTypeDeployment looks a bit clunky.
| WorkloadTypeDaemonSet WorkloadType = "DaemonSet" | ||
| ) | ||
|
|
||
| var _ = g.Describe("[sig-storage][OCPFeature:CSIReadOnlyRootFilesystem] CSI Driver ReadOnly Root Filesystem", func() { |
There was a problem hiding this comment.
| var _ = g.Describe("[sig-storage][OCPFeature:CSIReadOnlyRootFilesystem] CSI Driver ReadOnly Root Filesystem", func() { | |
| var _ = g.Describe("[sig-storage][OCPFeature:CSIReadOnlyRootFilesystem][Jira:"Storage"] CSI Driver ReadOnly Root Filesystem", func() { |
We also need [Jira:"Storage"], xref -> openshift-eng/ai-helpers#186
| // AWS EBS | ||
| { | ||
| WorkloadType: WorkloadTypeDeployment, | ||
| Namespace: CSINamespace, |
There was a problem hiding this comment.
We'd better use a var instead of const since we also need to cover these tests for hcp.
| o.Expect(err).NotTo(o.HaveOccurred()) | ||
| if isMicroShift { | ||
| g.Skip("CSI ReadOnlyRootFilesystem tests are not supported on MicroShift") | ||
| } |
There was a problem hiding this comment.
| } | |
| } | |
| // Check to see if we have Storage enabled | |
| isStorageEnabled, err := exutil.IsCapabilityEnabled(oc, configv1.ClusterVersionCapabilityStorage) | |
| if err != nil || !isStorageEnabled { | |
| g.Skip("skipping, this test is only expected to work with storage enabled clusters") | |
| } |
Better also check storage capability is enabled.
| runReadOnlyRootFsChecks(oc, controllerWorkloads, currentPlatform, true) | ||
| }) | ||
|
|
||
| g.It("should verify CSI node containers have readOnlyRootFilesystem set to true", func() { |
There was a problem hiding this comment.
I think we can combine the controller and node as the runReadOnlyRootFsChecks() can handle both deployment and daemonset. Or do we have any specific reason for dividing them?
| runReadOnlyRootFsChecks(oc, nodeWorkloads, currentPlatform, true) | ||
| }) | ||
|
|
||
| g.It("should verify CSI controller and node pods are running and ready", func() { |
There was a problem hiding this comment.
Agree it is not mandatory.
|
|
||
| // csiWorkloadCheck defines a check for CSI controller or node workloads | ||
| type csiWorkloadCheck struct { | ||
| WorkloadType WorkloadType |
There was a problem hiding this comment.
Will it be better to use "resource" instead of "workload" item in your entire cases？
| deployment, err := oc.AdminKubeClient().AppsV1().Deployments(workload.Namespace).Get(context.TODO(), workload.Name, metav1.GetOptions{}) | ||
| if err != nil { | ||
| if errors.IsNotFound(err) { | ||
| results = append(results, fmt.Sprintf("[SKIP] %s not found", resourceName)) |
There was a problem hiding this comment.
There might be some exceptions like Manila(it depends on the backend) or 3rd operators, can we first check if specific CSI Driver is installed and only check the related resource when CSI Driver is installed?
Test with gcp pd csi driver