Affected by GO-2022-0505 and 2 other vulnerabilities

GO-2022-0505: Insecure cookies in Openshift Origin in github.com/openshift/origin

GO-2022-0854: Authorization bypass in Openshift in github.com/openshift/origin

GO-2022-0875: Denial of Service in OpenShift Origin in github.com/openshift/origin

node

package

v0.0.0-...-e4a8a9b Latest Latest Go to latest Published: Jul 10, 2026 License: Apache-2.0 Imports: 46 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openshift/origin

Links

README ¶

Node E2E Tests

This directory contains OpenShift end-to-end tests for node-related features.

Test Suites

Suite: openshift/disruptive-longrunning

kubeletconfig_features.go - Tests applying KubeletConfig to custom machine config pools, requires node reboots
kubelet_secret_pulled_images.go - Tests kubelet credential verification for image pulls (KubeletEnsureSecretPulledImages feature gate). Covers multi-tenancy isolation, credential rotation, ImagePullPolicy behavior, credential verification policy (NeverVerify/AlwaysVerify), and registry availability scenarios. Requires TechPreviewNoUpgrade or CustomNoUpgrade FeatureSet.
node_e2e/container_runtime_config.go - ContainerRuntimeConfig pidsLimit (OCP-45351) and overlaySize (OCP-46313) - Verifies CTRCFG settings are applied via MCO rollout and reflected on nodes [Disruptive]
node_e2e/image_registry_config.go - Container registry config change (OCP-44820) - Verifies search registry update triggers MCO rollout and lands on nodes [Disruptive]
node_e2e/netns_cleanup.go - Network namespace cleanup - Verifies kubelet/CRI-O properly deletes network namespace when a pod is deleted [OTP]
node_e2e/pdb_drain.go - PodDisruptionBudget drain blocking (OCP-67564) - Tests that node drain is blocked when PDB has minAvailable=100% with empty selector [Disruptive] [Lifecycle:informing]

Suite: openshift/usernamespace

nested_container.go - Tests running nested containers (podman-in-pod) with user namespaces and nested-container SCC

Default Suite

dra.go - Tests that DRA (Dynamic Resource Allocation) v1 API is available and beta/alpha APIs are disabled
image_volume.go - Tests mounting container images as volumes in pods, including subPath and error handling
node_swap.go - Tests default kubelet swap settings (failSwapOn and swapBehavior) and rejection of user overrides
zstd_chunked.go - Tests building and running images with zstd:chunked compression format
node_e2e/probe_termination.go - Probe-level terminationGracePeriodSeconds (OCP-44493) - Tests configurable termination grace period for liveness and startup probes. Includes 3 test cases: probe-level config for liveness probe, probe-level config for startup probe, and fallback to pod-level config when probe-level is not set [Lifecycle:informing]

Directory Structure

Test Files

All *.go files in the root directory are Ginkgo-based test suites
Each file focuses on a specific node feature

Utility Files

node_utils.go - Shared helper functions for node selection and kubelet configuration retrieval

Test Data

Test fixtures are referenced via exutil.FixturePath from:

testdata/node/machineconfigpool/ - Machine config pool fixtures
testdata/node/kubeletconfig/ - Kubelet config fixtures
testdata/node/zstd-chunked/, testdata/node/nested_container/ - Custom build fixtures

Running Tests

Running Long-Running Disruptive Tests

The openshift/disruptive-longrunning suite is a general-purpose suite for long-running disruptive tests across all teams. Node team tests are tagged with [sig-node] to identify them.

To run the entire long-running disruptive test suite on a cluster manually:

./openshift-tests run "openshift/disruptive-longrunning" --cluster-stability=Disruptive

To run only node-specific long-running disruptive tests:

./openshift-tests run "openshift/disruptive-longrunning" --dry-run | grep "\[sig-node\]" | ./openshift-tests run -f - --cluster-stability=Disruptive

Running User Namespace Tests

./openshift-tests run "openshift/usernamespace"

Prerequisites

Make sure to set oc binary to match the cluster version
Make sure to set the kubeconfig to point to a live OCP cluster

Submitting PRs

Adding Tests to `openshift/disruptive-longrunning`

Before submitting a PR that adds a test to the openshift/disruptive-longrunning suite, run the following payload job and include the results in your PR:

/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-disruptive-longrunning

Useful links for periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-disruptive-longrunning:

Important Notes

Note that dry-run option won't list the test as it does not connect to a live cluster
Run make update if the test data is changed

Documentation ¶

Index ¶

Constants
func CalculateEventTimeDiff(startEvent, endEvent *corev1.Event) time.Duration
func CheckNetNsCleaned(oc *exutil.CLI, nodeName, netNsPath string) error
func ExecOnNodeWithChroot(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)
func ExecOnNodeWithNsenter(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)
func GetFirstReadyWorkerNode(oc *exutil.CLI) string
func GetPodNetNs(oc *exutil.CLI, nodeName, podName string) (string, error)
func WaitMCPAllowDegraded() func(*waitMCPOptions)
func WaitMCPWithMachineCount(count int32) func(*waitMCPOptions)

Constants ¶

View Source

const (
	// DebugNamespace is the namespace for debug pods
	DebugNamespace = "openshift-machine-config-operator"
)

Variables ¶

This section is empty.

Functions ¶

func CalculateEventTimeDiff ¶

func CalculateEventTimeDiff(startEvent, endEvent *corev1.Event) time.Duration

CalculateEventTimeDiff calculates the time difference between two Kubernetes events. It uses LastTimestamp for both events to handle repeated events correctly. For repeated events (like container restarts), Kubernetes reuses the event object and updates LastTimestamp while keeping FirstTimestamp at the original occurrence. Falls back to FirstTimestamp if LastTimestamp is zero.

func CheckNetNsCleaned ¶

func CheckNetNsCleaned(oc *exutil.CLI, nodeName, netNsPath string) error

CheckNetNsCleaned verifies that the network namespace file has been cleaned up. It checks if the NetNS path no longer exists on the node. Returns nil if the file is cleaned, error if it still exists.

func ExecOnNodeWithChroot ¶

func ExecOnNodeWithChroot(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)

ExecOnNodeWithChroot runs a command on a node using oc debug with chroot /host

func ExecOnNodeWithNsenter ¶

func ExecOnNodeWithNsenter(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)

ExecOnNodeWithNsenter runs a command on a node using nsenter to access host namespaces This is needed for swap operations (swapon/swapoff) that require direct namespace access

func GetFirstReadyWorkerNode ¶

func GetFirstReadyWorkerNode(oc *exutil.CLI) string

GetFirstReadyWorkerNode returns the name of the first Ready worker node in the cluster.

func GetPodNetNs ¶

func GetPodNetNs(oc *exutil.CLI, nodeName, podName string) (string, error)

GetPodNetNs retrieves the network namespace path for a pod using crictl. It uses crictl to get the sandbox ID and then inspects it to extract the NetNS path. Returns the NetNS path and an error if not found.

func WaitMCPAllowDegraded ¶

func WaitMCPAllowDegraded() func(*waitMCPOptions)

WaitMCPAllowDegraded tolerates transient Degraded/RenderDegraded during polling instead of failing immediately. The pool must still become fully healthy (!degraded, !renderDegraded, updated, all machines ready) before this wait succeeds.

func WaitMCPWithMachineCount ¶

func WaitMCPWithMachineCount(count int32) func(*waitMCPOptions)

WaitMCPWithMachineCount waits until the pool has the exact machine count.

Types ¶