Skip to content

OCPBUGS-99047: Fix flaky oc adm storage-admin test #31400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xueqzhan wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −4
Open

OCPBUGS-99047: Fix flaky oc adm storage-admin test #31400

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions test/extended/cli/admin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,15 +265,15 @@ var _ = g.Describe("[sig-cli] oc adm", func() {
g.By("Test storage-admin can not do normal project scoped tasks")
out, err = oc.Run("auth", "can-i").Args("--as=storage-adm", "create", "pods", "--all-namespaces").Output()
o.Expect(err).To(o.HaveOccurred())
o.Expect(out).To(o.HaveSuffix("no"))
o.Expect(out).To(o.MatchRegexp(`(?m)^no`))

@ingvagabund ingvagabund Jul 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the likelihood this will assert a false positive? Is the warning and the extra text always on two lines? Is the extra text after "no" always of the same pattern? If only the missing cluster role reference is the extra text I'd rather prefer to filter it out before the assertion.

@xueqzhan xueqzhan Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The output from oc auth can-i when denied has this format:

no - RBAC: clusterrole.rbac.authorization.k8s.io "basic-user2-pnjfn" not found

The warning and the diagnostic text are on the same line — no followed by - RBAC: .... There are no multi-line patterns here. The (?m)^no regex matches no at the start of a line, which is safe because:

  1. oc auth can-i only outputs yes or no as the first word on the response line. There is no scenario where a non-denial response starts with no.
  2. The preceding o.Expect(err).To(o.HaveOccurred()) already asserts the command returned non-zero (denied), so we are only checking the output format at that point.
  3. Warning lines (e.g., deprecation warnings on stderr) would not start with no — they start with Warning:.

That said, your suggestion to filter the diagnostic suffix is also reasonable. We could use strings.HasPrefix(out, "no") or strings.Split(out, "\n") and check only the relevant line. However, (?m)^no achieves the same result more concisely since the denial response is always the first (and usually only) line starting with no.

@ricardomaraschini ricardomaraschini Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If such warnings are printed on stderr we could also use Outputs() function and then assess with HasPrefix(), only on stdout. I am not sure it does use stderr for the warnings though.


out, err = oc.Run("auth", "can-i").Args("--as=storage-adm", "create", "projects").Output()
o.Expect(err).To(o.HaveOccurred())
o.Expect(out).To(o.HaveSuffix("no"))
o.Expect(out).To(o.MatchRegexp(`(?m)^no`))

out, err = oc.Run("auth", "can-i").Args("--as=storage-adm", "create", "pvc").Output()
o.Expect(err).To(o.HaveOccurred())
o.Expect(out).To(o.HaveSuffix("no"))
o.Expect(out).To(o.MatchRegexp(`(?m)^no`))

g.By("Test storage-admin can read pvc and pods, and create pv and storageclass")
out, err = oc.Run("auth", "can-i").Args("--as=storage-adm", "get", "pvc", "--all-namespaces").Output()
Expand Down Expand Up @@ -314,7 +314,7 @@ var _ = g.Describe("[sig-cli] oc adm", func() {

out, err = oc.Run("auth", "can-i").Args("--namespace="+projectName, "--as=storage-adm2", "create", "pod", "--all-namespaces").Output()
o.Expect(err).To(o.HaveOccurred())
o.Expect(out).To(o.HaveSuffix("no"))
o.Expect(out).To(o.MatchRegexp(`(?m)^no`))

out, err = oc.Run("auth", "can-i").Args("--namespace="+projectName, "--as=storage-adm2", "create", "pod").Output()
o.Expect(err).NotTo(o.HaveOccurred())
Expand Down