node

README

Node E2E Tests

This directory contains OpenShift end-to-end tests for node-related features.

Test Suites

Suite: openshift/disruptive-longrunning

• kubeletconfig_features.go - Tests applying KubeletConfig to custom machine config pools, requires node reboots
• kubelet_secret_pulled_images.go - Tests kubelet credential verification for image pulls (KubeletEnsureSecretPulledImages feature gate). Covers multi-tenancy isolation, credential rotation, ImagePullPolicy behavior, credential verification policy (NeverVerify/AlwaysVerify), and registry availability scenarios. Requires TechPreviewNoUpgrade or CustomNoUpgrade FeatureSet.
• node_e2e/container_runtime_config.go - ContainerRuntimeConfig pidsLimit (OCP-45351) and overlaySize (OCP-46313) - Verifies CTRCFG settings are applied via MCO rollout and reflected on nodes [Disruptive]
• node_e2e/image_registry_config.go - Container registry config change (OCP-44820) - Verifies search registry update triggers MCO rollout and lands on nodes [Disruptive]
• node_e2e/netns_cleanup.go - Network namespace cleanup - Verifies kubelet/CRI-O properly deletes network namespace when a pod is deleted [OTP]
• node_e2e/pdb_drain.go - PodDisruptionBudget drain blocking (OCP-67564) - Tests that node drain is blocked when PDB has minAvailable=100% with empty selector [Disruptive] [Lifecycle:informing]

Suite: openshift/usernamespace

• nested_container.go - Tests running nested containers (podman-in-pod) with user namespaces and nested-container SCC

Default Suite

• dra.go - Tests that DRA (Dynamic Resource Allocation) v1 API is available and beta/alpha APIs are disabled
• image_volume.go - Tests mounting container images as volumes in pods, including subPath and error handling
• node_swap.go - Tests default kubelet swap settings (failSwapOn and swapBehavior) and rejection of user overrides
• zstd_chunked.go - Tests building and running images with zstd:chunked compression format
• node_e2e/probe_termination.go - Probe-level terminationGracePeriodSeconds (OCP-44493) - Tests configurable termination grace period for liveness and startup probes. Includes 3 test cases: probe-level config for liveness probe, probe-level config for startup probe, and fallback to pod-level config when probe-level is not set [Lifecycle:informing]

Directory Structure

Test Files

• All *.go files in the root directory are Ginkgo-based test suites
• Each file focuses on a specific node feature

Utility Files

• node_utils.go - Shared helper functions for node selection and kubelet configuration retrieval

Test Data

Test fixtures are referenced via exutil.FixturePath from:

• testdata/node/machineconfigpool/ - Machine config pool fixtures
• testdata/node/kubeletconfig/ - Kubelet config fixtures
• testdata/node/zstd-chunked/, testdata/node/nested_container/ - Custom build fixtures

Running Tests

Running Long-Running Disruptive Tests

The openshift/disruptive-longrunning suite is a general-purpose suite for long-running disruptive tests across all teams. Node team tests are tagged with [sig-node] to identify them.

To run the entire long-running disruptive test suite on a cluster manually:

./openshift-tests run "openshift/disruptive-longrunning" --cluster-stability=Disruptive

To run only node-specific long-running disruptive tests:

./openshift-tests run "openshift/disruptive-longrunning" --dry-run | grep "\[sig-node\]" | ./openshift-tests run -f - --cluster-stability=Disruptive

Running User Namespace Tests

./openshift-tests run "openshift/usernamespace"

Prerequisites

• Make sure to set oc binary to match the cluster version
• Make sure to set the kubeconfig to point to a live OCP cluster

Submitting PRs

Adding Tests to openshift/disruptive-longrunning

Before submitting a PR that adds a test to the openshift/disruptive-longrunning suite, run the following payload job and include the results in your PR:

/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-disruptive-longrunning

Useful links for periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-disruptive-longrunning:

• Previous runs (Sippy)
• Job history for latest runs (Prow)

Important Notes

• Note that dry-run option won't list the test as it does not connect to a live cluster
• Run make update if the test data is changed

Documentation

Index

• Constants
• func CalculateEventTimeDiff(startEvent, endEvent *corev1.Event) time.Duration
• func CheckNetNsCleaned(oc *exutil.CLI, nodeName, netNsPath string) error
• func ExecOnNodeWithChroot(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)
• func ExecOnNodeWithNsenter(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)
• func GetFirstReadyWorkerNode(oc *exutil.CLI) string
• func GetPodNetNs(oc *exutil.CLI, nodeName, podName string) (string, error)
• func WaitMCPAllowDegraded() func(*waitMCPOptions)
• func WaitMCPWithMachineCount(count int32) func(*waitMCPOptions)

Constants

const (
	// DebugNamespace is the namespace for debug pods
	DebugNamespace = "openshift-machine-config-operator"
)

Functions

func CalculateEventTimeDiff

func CalculateEventTimeDiff(startEvent, endEvent *corev1.Event) time.Duration

CalculateEventTimeDiff calculates the time difference between two Kubernetes events. It uses LastTimestamp for both events to handle repeated events correctly. For repeated events (like container restarts), Kubernetes reuses the event object and updates LastTimestamp while keeping FirstTimestamp at the original occurrence. Falls back to FirstTimestamp if LastTimestamp is zero.

func CheckNetNsCleaned

func CheckNetNsCleaned(oc *exutil.CLI, nodeName, netNsPath string) error

CheckNetNsCleaned verifies that the network namespace file has been cleaned up. It checks if the NetNS path no longer exists on the node. Returns nil if the file is cleaned, error if it still exists.

func ExecOnNodeWithChroot

func ExecOnNodeWithChroot(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)

ExecOnNodeWithChroot runs a command on a node using oc debug with chroot /host

func ExecOnNodeWithNsenter

func ExecOnNodeWithNsenter(oc *exutil.CLI, nodeName string, cmd ...string) (string, error)

ExecOnNodeWithNsenter runs a command on a node using nsenter to access host namespaces This is needed for swap operations (swapon/swapoff) that require direct namespace access

func GetFirstReadyWorkerNode

func GetFirstReadyWorkerNode(oc *exutil.CLI) string

GetFirstReadyWorkerNode returns the name of the first Ready worker node in the cluster.

func GetPodNetNs

func GetPodNetNs(oc *exutil.CLI, nodeName, podName string) (string, error)

GetPodNetNs retrieves the network namespace path for a pod using crictl. It uses crictl to get the sandbox ID and then inspects it to extract the NetNS path. Returns the NetNS path and an error if not found.

func WaitMCPAllowDegraded

func WaitMCPAllowDegraded() func(*waitMCPOptions)

WaitMCPAllowDegraded tolerates transient Degraded/RenderDegraded during polling instead of failing immediately. The pool must still become fully healthy (!degraded, !renderDegraded, updated, all machines ready) before this wait succeeds.

func WaitMCPWithMachineCount

func WaitMCPWithMachineCount(count int32) func(*waitMCPOptions)

WaitMCPWithMachineCount waits until the pool has the exact machine count.