wait for group cache to avoid flake in templateinstance test
package templates
import (
+ "fmt"
"time"
g "github.com/onsi/ginkgo"
@@ -67,17 +68,52 @@ var _ = g.Describe("[Conformance][templates] templateinstance security tests", f
}
)
+ g.Context("", func() {
g.BeforeEach(func() {
adminuser = createUser(cli, "adminuser", bootstrappolicy.AdminRoleName)
edituser = createUser(cli, "edituser", bootstrappolicy.EditRoleName)
- editgroup = createGroup(cli, "editgroup", bootstrappolicy.EditRoleName)
editbygroupuser = createUser(cli, "editbygroupuser", "")
+
+ editgroup = createGroup(cli, "editgroup", bootstrappolicy.EditRoleName)
addUserToGroup(cli, editbygroupuser.Name, editgroup.Name)
+
+ // I think we get flakes when the group cache hasn't yet noticed the
+ // new group membership made above. Wait until all it looks like
+ // all the users above have access to the namespace as expected.
+ err := wait.PollImmediate(time.Second, 30*time.Second, func() (done bool, err error) {
+ for _, user := range []*userapi.User{adminuser, edituser, editbygroupuser} {
+ cli.ChangeUser(user.Name)
+ sar, err := cli.AuthorizationClient().Authorization().LocalSubjectAccessReviews(cli.Namespace()).Create(&authorizationapi.LocalSubjectAccessReview{
+ Action: authorizationapi.Action{
+ Verb: "get",
+ Resource: "pods",
+ },
+ })
+ if err != nil {
+ return false, err
+ }
+ if !sar.Allowed {
+ return false, nil
+ }
+ }
+ return true, nil
+ })
+ o.Expect(err).NotTo(o.HaveOccurred())
})
g.AfterEach(func() {
+ if g.CurrentGinkgoTestDescription().Failed {
+ templateinstances, err := cli.AdminTemplateClient().Template().TemplateInstances(cli.Namespace()).List(metav1.ListOptions{})
+ if err == nil {
+ fmt.Fprintf(g.GinkgoWriter, "TemplateInstances: %#v", templateinstances.Items)
+ }
+ }
+
deleteUser(cli, adminuser)
deleteUser(cli, edituser)
+ deleteUser(cli, editbygroupuser)
+
+ deleteGroup(cli, editgroup)
})
g.It("should pass security tests", func() {
@@ -244,3 +280,4 @@ var _ = g.Describe("[Conformance][templates] templateinstance security tests", f
}
})
})
+})
