use namespace labels to prevent SCC usage
@@ -206,6 +206,15 @@ func createTestingNS(baseName string, c kclientset.Interface, labels map[string]
return fn(baseName, c, labels)
}
+ // if we're running an upstream test, make sure to skip openshift admission.
+ // TODO we may be able to relax this after the openshift apiserver is back in the openshift/installer
+ if isKubernetesE2ETest() && !skipTestNamespaceCustomization() {
+ if labels == nil {
+ labels = map[string]string{}
+ }
+ labels["openshift.io/run-level"] = "0"
+ }
+
// Otherwise use the upstream default
ns, err := e2e.CreateTestingNS(baseName, c, labels)
if err != nil {
@@ -218,6 +227,10 @@ func createTestingNS(baseName string, c kclientset.Interface, labels map[string]
if err != nil {
return ns, err
}
+
+ // TODO we may restore this after the openshift apiserver is back in the openshift/installer. For now
+ // TODO the SCC isn't needed because of the runlevel
+ if false {
securityClient, err := securityclient.NewForConfig(clientConfig)
if err != nil {
return ns, err
@@ -233,6 +246,7 @@ func createTestingNS(baseName string, c kclientset.Interface, labels map[string]
// add the "hostmount-anyuid" scc to ensure pods using hostPath
// can execute tests
addE2EServiceAccountsToSCC(securityClient, []kapiv1.Namespace{*ns}, "hostmount-anyuid")
+ }
// The intra-pod test requires that the service account have
// permission to retrieve service endpoints.
