Skip to content

Rewrite the bash tests into Golang#187

Open
stlaz wants to merge 28 commits intokubernetes-sigs:mainfrom
stlaz:e2e-go
Open

Rewrite the bash tests into Golang#187
stlaz wants to merge 28 commits intokubernetes-sigs:mainfrom
stlaz:e2e-go

Conversation

@stlaz
Copy link
Contributor

@stlaz stlaz commented Feb 13, 2026

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes
Partially addresses #178

Special notes for your reviewer:
Built on top of #186 to get the typed clients for local types

stlaz added 27 commits February 12, 2026 14:20
Annotations are currently unused, there's no point having these
around at the moment. Keep the validation only, simplify
reconcile.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Remove the need for error handling by simply concatenating
the uid/gen strings.

Also remove the "v1" prefix from the final hash. The version was
wrong and therefore likely redundant.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
The TokenClient was not actually client and did not provide
any value on its own. This commit takes out the only function
of it that had any value and extracts it outside, taking the
tokenManager as an argument rather than wrapping it in another
object.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
- pick the first one instead of the last to reduce PEM decoding overhead
- don't unnecessarily decode all keys with all three decoding functions
- document why we cannot simply use k8s keyutil PEM decoding utils

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
There were several issues with the condition system:
1. disappearing conditions - Some conditions would appear and disappear.
2. nonsensical conditions
	- "Unknown" does not make sense for a condition type. What would it
	  even mean?
	- "Create" doesn't really mean anything either, neither does
	  "Update". Compare to the new "SecretCreated" and "SecretUpdated".
3. role confusion - It is unlikely the person viewing the conditions
   will be able to read the controller's logs, making most of the
   hardcoded condition messages not actionable, and therefore
   meaningless.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Improves the QoL by actually printing the failing condition, too.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
The policies would race during secret creation, causing different
causes for secret creation. This might cause condition hotloops
as we're failing to create the secret for different reasons.

This also hardcodes the denied secret types to just
"kubernetes.io/service-account-token" to protect the users from
insecure configurations. Any type that's not allowed is otherwise
denied.

We may want to think about a backoff mechanism for retries in the
future to avoid the controller's sensitivity to these situations.
However, validating the same field of the same resource during the
same conditions should likely be handled by a single policy, as long
as we own the check at least.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>

type policies fixup
The version was wrong (v1, expected v1alpha1) and having this
value versioned would only bring problems.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
This was just confusing.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
A controller should be a self-contained unit, immutable
from outside.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
@k8s-ci-robot k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Feb 13, 2026
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stlaz
Once this PR has been reviewed and has the lgtm label, please assign aramase for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested a review from aramase February 13, 2026 15:48
@k8s-ci-robot k8s-ci-robot requested a review from enj February 13, 2026 15:48
@k8s-ci-robot k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Feb 13, 2026
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If secrets-store-sync-controller contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Feb 13, 2026
@codecov-commenter
Copy link

codecov-commenter commented Feb 13, 2026

Codecov Report

❌ Patch coverage is 26.31579% with 560 lines in your changes missing coverage. Please review.
✅ Project coverage is 28.29%. Comparing base (9f4597d) to head (db4e0dd).
⚠️ Report is 78 commits behind head on main.

Files with missing lines Patch % Lines
pkg/controller/secretsync_controller.go 51.79% 103 Missing and 18 partials ⚠️
cmd/main.go 0.00% 103 Missing ⚠️
client/informers/externalversions/factory.go 0.00% 80 Missing ⚠️
client/clientset/versioned/clientset.go 0.00% 39 Missing ⚠️
pkg/leaderelection/leaderelect.go 0.00% 35 Missing ⚠️
...ned/typed/secretsync/v1alpha1/secretsync_client.go 0.00% 34 Missing ⚠️
...externalversions/secretsync/v1alpha1/secretsync.go 0.00% 27 Missing ⚠️
...nt/clientset/versioned/fake/clientset_generated.go 0.00% 25 Missing ⚠️
.../typed/secretsync/v1alpha1/fake/fake_secretsync.go 0.00% 14 Missing ⚠️
pkg/util/secretutil/secret.go 63.15% 10 Missing and 4 partials ⚠️
... and 12 more
Additional details and impacted files
@@             Coverage Diff             @@
##             main     #187       +/-   ##
===========================================
- Coverage   56.32%   28.29%   -28.04%     
===========================================
  Files          12       24       +12     
  Lines        1051     1145       +94     
===========================================
- Hits          592      324      -268     
- Misses        415      787      +372     
+ Partials       44       34       -10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: Stanislav Láznička <slznika@microsoft.com>
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Feb 13, 2026

@stlaz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-secrets-store-sync-controller-image-scan db4e0dd link false /test pull-secrets-store-sync-controller-image-scan

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@enj enj added this to SIG Auth Feb 14, 2026
@enj enj moved this to Subprojects - Needs Triage in SIG Auth Feb 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants