Make seccomp status checks in e2e tests more robust #119880
Conversation
The tests have been introduced in kubernetes@ca7be7d and checked for `ecc` in `/proc/self/status` since its creation. We got a new field `Seccomp_filters:` with the Linux commit torvalds/linux@c818c03, means that `ecc` would now match both and interfere with possible test results depending on the host. The field `Seccomp:` got introduced in torvalds/linux@2f4b3bf and has never changed since then, means we can use it directly to make the tests more strict. Refers to kubernetes-sigs/cri-tools#1236 Signed-off-by: Sascha Grunert <[email protected]>
k8s-ci-robot
added
release-note-none
|
Please note that we're already in Test Freeze for the Fast forwards are scheduled to happen every 6 hours, whereas the most recent run was: Thu Aug 10 04:35:24 UTC 2023. |
k8s-ci-robot
added
area/test
cncf-cla: yes
|
/triage accepted |
k8s-ci-robot
added
the
triage/accepted
k8s-ci-robot
added
priority/important-longterm
k8s-ci-robot
added
lgtm
|
LGTM label has been added. Git tree hash: 10e800482460d2d5373dd3ee0c7d882c3bcbacb5
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: saschagrunert, SergeyKanzhelev The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
| @@ -30,6 +30,7 @@ import ( | |||
| kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config" | |||
| "k8s.io/kubernetes/test/e2e/framework" | |||
| e2eoutput "k8s.io/kubernetes/test/e2e/framework/pod/output" | |||
| "k8s.io/kubernetes/test/e2e/node" | |||
There was a problem hiding this comment.
This import appears to add 120 new tests to the node E2E tests, many of which are failing.
See https://testgrid.k8s.io/sig-node-release-blocking#node-kubelet-serial-containerd
There was a problem hiding this comment.
oh, talking about unexpected...
There was a problem hiding this comment.
I found out this was the problem commit and it took several minutes to figure out why it was causing a problem 😆
There was a problem hiding this comment.
Oh, do we need an additional CI check to prevent such imports?
There was a problem hiding this comment.
There is import boss. You could create a test/e2e_node/.import-restrictions file and add an entry for k8s.io/kubernetes/test/e2e/.*.
There was a problem hiding this comment.
thank you! @dims already helped with this. So many cool features in the codebase
There was a problem hiding this comment.
Thank you folks for the support here!
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
The tests have been introduced in ca7be7d and checked for
eccin/proc/self/statussince its creation.We got a new field
Seccomp_filters:with the Linux commit torvalds/linux@c818c03, means thateccwould now match both and interfere with possible test results depending on the host.The field
Seccomp:got introduced in torvalds/linux@2f4b3bf and has never changed since then, means we can use it directly to make the tests more strict.Which issue(s) this PR fixes:
Refers to kubernetes-sigs/cri-tools#1236
Special notes for your reviewer:
None
Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: