[test-operator] Move away from Jobs to Pods #2604
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
The test-operator is using Jobs to spawn test pods even though it does not use any features of this k8s object. Plus usage of the Jobs requires creation of ServiceAccount in the target namespaces. In order to be able to create a new, SA the test-oprator has to have a rights to create new roles and rolebindings which in our case makes the attack surface larger. This patch drops the usage of Jobs and moves to Pods. Depends-On: openstack-k8s-operators/ci-framework#2604
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/f7a064a541ce4ca396fd07d4a987c964 ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 48m 35s |
lpiwowar
force-pushed
the
move-to-pods
branch
from
1b557d1 to
aa161d6
Compare
With this PR [1] the test operator dropped the usage of OCP Jobs for spawning of the test pods. This change updates the test-operator role so that it works with the new version of the test-operator that spawns test pods directly through the OCP Pods object. [1] openstack-k8s-operators/test-operator#266
lpiwowar
force-pushed
the
move-to-pods
branch
from
aa161d6 to
46c954f
Compare
|
/hold These PRs need to be merged at the same time. The idea is to first get |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/59ad346a9c9648ffa3aeedd5d6ce94af ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 26m 55s |
|
recheck |
The test-operator is using Jobs to spawn test pods even though it does not use any features of this k8s object. Plus usage of the Jobs requires creation of ServiceAccount in the target namespaces. In order to be able to create a new, SA the test-oprator has to have a rights to create new roles and rolebindings which in our case makes the attack surface larger. This patch drops the usage of Jobs and moves to Pods. Depends-On: openstack-k8s-operators/ci-framework#2604
With this PR [1] the test operator dropped the usage of OCP Jobs for
spawning of the test pods.
This change updates the test-operator role so that it works with the
new version of the test-operator that spawns test pods directly through
the OCP Pods object.
[1] openstack-k8s-operators/test-operator#266