Running Suite: Kubernetes e2e suite =================================== Random Seed: 1621885399 - Will randomize all specs Will run 5667 specs Running in parallel across 10 nodes May 24 19:43:21.236: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.239: INFO: Waiting up to 30m0s for all (but 0) nodes to be schedulable May 24 19:43:21.264: INFO: Waiting up to 10m0s for all pods (need at least 0) in namespace 'kube-system' to be running and ready May 24 19:43:21.313: INFO: 21 / 21 pods in namespace 'kube-system' are running and ready (0 seconds elapsed) May 24 19:43:21.313: INFO: expected 2 pod replicas in namespace 'kube-system', 2 are Running and Ready. May 24 19:43:21.313: INFO: Waiting up to 5m0s for all daemonsets in namespace 'kube-system' to start May 24 19:43:21.326: INFO: 3 / 3 pods ready in namespace 'kube-system' in daemonset 'create-loop-devs' (0 seconds elapsed) May 24 19:43:21.326: INFO: 3 / 3 pods ready in namespace 'kube-system' in daemonset 'kindnet' (0 seconds elapsed) May 24 19:43:21.326: INFO: 3 / 3 pods ready in namespace 'kube-system' in daemonset 'kube-multus-ds' (0 seconds elapsed) May 24 19:43:21.326: INFO: 3 / 3 pods ready in namespace 'kube-system' in daemonset 'kube-proxy' (0 seconds elapsed) May 24 19:43:21.326: INFO: 3 / 3 pods ready in namespace 'kube-system' in daemonset 'tune-sysctls' (0 seconds elapsed) May 24 19:43:21.326: INFO: e2e test version: v1.20.6 May 24 19:43:21.327: INFO: kube-apiserver version: v1.20.7 May 24 19:43:21.328: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.334: INFO: Cluster IP family: ipv4 May 24 19:43:21.340: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.360: INFO: Cluster IP family: ipv4 SSSSSSSSSSSSSSSSSSSSSS ------------------------------ May 24 19:43:21.342: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.363: INFO: Cluster IP family: ipv4 May 24 19:43:21.342: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.364: INFO: Cluster IP family: ipv4 SSSS ------------------------------ May 24 19:43:21.347: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.366: INFO: Cluster IP family: ipv4 SSSSSSSSSS ------------------------------ May 24 19:43:21.348: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.369: INFO: Cluster IP family: ipv4 SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ May 24 19:43:21.361: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.383: INFO: Cluster IP family: ipv4 May 24 19:43:21.365: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.383: INFO: Cluster IP family: ipv4 SSSSSSSSSSSSSSSSSSSSS ------------------------------ May 24 19:43:21.372: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.388: INFO: Cluster IP family: ipv4 SSSSSSSSSSSSS ------------------------------ May 24 19:43:21.369: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:21.390: INFO: Cluster IP family: ipv4 SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.428: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz May 24 19:43:21.464: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.471: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.480: INFO: >>> kubeConfig: /root/.kube/config [It] Getting a non-existent secret should exit with the Forbidden error, not a NotFound error /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:74 [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:21.489: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-3489" for this suite. •SSSSSSSSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] Getting a non-existent secret should exit with the Forbidden error, not a NotFound error","total":-1,"completed":1,"skipped":27,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.494: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz May 24 19:43:21.518: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.522: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.531: INFO: >>> kubeConfig: /root/.kube/config [It] Getting an existing secret should exit with the Forbidden error /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:79 [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:21.535: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-2202" for this suite. •SSSSSSSSSSSSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] Getting an existing secret should exit with the Forbidden error","total":-1,"completed":1,"skipped":64,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.675: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz May 24 19:43:21.700: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.703: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.711: INFO: >>> kubeConfig: /root/.kube/config [It] Getting an existing configmap should exit with the Forbidden error /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:89 STEP: Create a configmap for testing [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:21.719: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-7798" for this suite. •SSSSSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] Getting an existing configmap should exit with the Forbidden error","total":-1,"completed":1,"skipped":215,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.831: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.865: INFO: >>> kubeConfig: /root/.kube/config [It] A node shouldn't be able to create another node /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:167 STEP: Create node foo by user: system:node:leguer-control-plane [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:21.871: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-2773" for this suite. •SSSSSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] A node shouldn't be able to create another node","total":-1,"completed":2,"skipped":299,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.893: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz May 24 19:43:21.920: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.924: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.932: INFO: >>> kubeConfig: /root/.kube/config [It] Getting a non-existent configmap should exit with the Forbidden error, not a NotFound error /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:84 [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:21.937: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-8363" for this suite. •SSSSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] Getting a non-existent configmap should exit with the Forbidden error, not a NotFound error","total":-1,"completed":1,"skipped":384,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] Metadata Concealment /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.262: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename metadata-concealment May 24 19:43:22.293: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:22.298: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [It] should run a check-metadata-concealment job to completion /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/metadata_concealment.go:34 May 24 19:43:22.302: INFO: Only supported for providers [gce] (not skeleton) [AfterEach] [sig-auth] Metadata Concealment /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:22.303: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "metadata-concealment-690" for this suite. S [SKIPPING] [0.051 seconds] [sig-auth] Metadata Concealment /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should run a check-metadata-concealment job to completion [It] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/metadata_concealment.go:34 Only supported for providers [gce] (not skeleton) /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/metadata_concealment.go:35 ------------------------------ SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.335: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz May 24 19:43:22.367: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:22.371: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:22.382: INFO: >>> kubeConfig: /root/.kube/config [It] A node shouldn't be able to delete another node /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:180 STEP: Create node foo by user: system:node:leguer-control-plane [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:22.388: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-571" for this suite. •SSS ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] A node shouldn't be able to delete another node","total":-1,"completed":1,"skipped":733,"failed":0} SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS ------------------------------ May 24 19:43:22.847: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.451: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename svcaccounts STEP: Waiting for a default service account to be provisioned in namespace [It] should guarantee kube-root-ca.crt exist in any namespace /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:860 May 24 19:43:22.483: INFO: Got root ca configmap in namespace "svcaccounts-7326" May 24 19:43:22.489: INFO: Deleted root ca configmap in namespace "svcaccounts-7326" STEP: waiting for a new root ca configmap created May 24 19:43:22.992: INFO: Recreated root ca configmap in namespace "svcaccounts-7326" May 24 19:43:22.997: INFO: Updated root ca configmap in namespace "svcaccounts-7326" STEP: waiting for the root ca configmap reconciled May 24 19:43:23.527: INFO: Reconciled root ca configmap in namespace "svcaccounts-7326" [AfterEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:23.527: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "svcaccounts-7326" for this suite. • ------------------------------ {"msg":"PASSED [sig-auth] ServiceAccounts should guarantee kube-root-ca.crt exist in any namespace","total":-1,"completed":2,"skipped":775,"failed":0} May 24 19:43:23.541: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.965: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authz STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:50 STEP: Creating a kubernetes client that impersonates a node May 24 19:43:21.993: INFO: >>> kubeConfig: /root/.kube/config [It] Getting a secret for a workload the node has access to should succeed /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authz.go:106 STEP: Create a secret for testing STEP: Node should not get the secret STEP: Create a pod that use the secret STEP: The node should able to access the secret [AfterEach] [sig-auth] [Feature:NodeAuthorizer] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:24.010: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authz-7262" for this suite. • ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthorizer] Getting a secret for a workload the node has access to should succeed","total":-1,"completed":2,"skipped":413,"failed":0} May 24 19:43:24.020: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.675: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authn May 24 19:43:21.700: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.703: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authn.go:39 [It] The kubelet's main port 10250 should reject requests with no credentials /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authn.go:59 May 24 19:43:23.728: INFO: Running '/usr/local/bin/kubectl --server=https://172.30.13.89:44097 --kubeconfig=/root/.kube/config --namespace=node-authn-9931 exec agnhost-pod -- /bin/sh -x -c curl -sIk -o /dev/null -w '%{http_code}' https://172.18.0.6:10250/metrics' May 24 19:43:24.104: INFO: stderr: "+ curl -sIk -o /dev/null -w %{http_code} https://172.18.0.6:10250/metrics\n" May 24 19:43:24.104: INFO: stdout: "401" May 24 19:43:24.104: INFO: stdout: 401 [AfterEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:24.105: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authn-9931" for this suite. • ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthenticator] The kubelet's main port 10250 should reject requests with no credentials","total":-1,"completed":1,"skipped":194,"failed":0} May 24 19:43:24.118: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.750: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename node-authn STEP: Waiting for a default service account to be provisioned in namespace [BeforeEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authn.go:39 [It] The kubelet can delegate ServiceAccount tokens to the API server /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/node_authn.go:68 STEP: create a new ServiceAccount for authentication May 24 19:43:26.807: INFO: Running '/usr/local/bin/kubectl --server=https://172.30.13.89:44097 --kubeconfig=/root/.kube/config --namespace=node-authn-7782 exec agnhost-pod -- /bin/sh -x -c curl -sIk -o /dev/null -w '%{http_code}' --header "Authorization: Bearer `cat /var/run/secrets/kubernetes.io/serviceaccount/token`" https://172.18.0.6:10250/metrics' May 24 19:43:27.191: INFO: stderr: "+ cat /var/run/secrets/kubernetes.io/serviceaccount/token\n+ curl -sIk -o /dev/null -w %{http_code} --header Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ilk0UDF3RXVyYVlsM3pja0hCN0xrZUJYQVRxaFhmSHoza2hjQXQwYnZGZmsifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJub2RlLWF1dGhuLTc3ODIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGVmYXVsdC10b2tlbi1mYmJsdiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMWUxOTc1MTQtNWZlMC00M2MxLWJiNzgtYjFkNmY1ZDFhNjEzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Om5vZGUtYXV0aG4tNzc4MjpkZWZhdWx0In0.cDJjtWs0VO09MhYC7Src407OfT7sDOZLYz5tJFYICQ7VtlCiu1VFrjXhh-G87khRs7cBqGeDREqu5XK4TGiY9wqgvOOA-L4xw0nmC3T7GwRJiOtgNDBkDL6sy1NFOcZy_M-SVW7-xBnV6qVJMN_DDzxko2ZLQO63PlBvU3f0jOO1T3huxkio34eygAhnf0zPs1EVwyLZFcgRw2o3jFzoKqZEcC3m4bE68I2ZYZKouO9qpWf_gZdc83DhkIMkfrV36xDK274b_GBOSeicPWlfmpSFvp-de_XMnSoLscJlS7M0Ip8fVkZJeWzABoSh7M-AqRFVb-O03PhfaAHSd-rZgw https://172.18.0.6:10250/metrics\n" May 24 19:43:27.191: INFO: stdout: "403" May 24 19:43:27.191: INFO: stdout: 403 [AfterEach] [sig-auth] [Feature:NodeAuthenticator] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:27.191: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "node-authn-7782" for this suite. • ------------------------------ {"msg":"PASSED [sig-auth] [Feature:NodeAuthenticator] The kubelet can delegate ServiceAccount tokens to the API server","total":-1,"completed":2,"skipped":984,"failed":0} May 24 19:43:27.200: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.641: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename svcaccounts May 24 19:43:21.667: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.671: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [It] should ensure a single API token exists /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:52 STEP: waiting for a single token reference May 24 19:43:22.177: INFO: default service account has a single secret reference STEP: ensuring the single token reference persists STEP: deleting the service account token STEP: waiting for a new token reference May 24 19:43:24.690: INFO: default service account has a new single secret reference STEP: ensuring the single token reference persists STEP: deleting the reference to the service account token STEP: waiting for a new token to be created and added May 24 19:43:27.421: INFO: default service account has a new single secret reference STEP: ensuring the single token reference persists [AfterEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:29.525: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "svcaccounts-2668" for this suite. • [SLOW TEST:7.895 seconds] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should ensure a single API token exists /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:52 ------------------------------ {"msg":"PASSED [sig-auth] ServiceAccounts should ensure a single API token exists","total":-1,"completed":1,"skipped":158,"failed":0} May 24 19:43:29.538: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.941: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename svcaccounts STEP: Waiting for a default service account to be provisioned in namespace [It] should set ownership and permission when RunAsUser or FsGroup is present [LinuxOnly] [NodeFeature:FSGroup] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:488 STEP: Creating a pod to test service account token: May 24 19:43:21.969: INFO: Waiting up to 5m0s for pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" in namespace "svcaccounts-6022" to be "Succeeded or Failed" May 24 19:43:21.972: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Pending", Reason="", readiness=false. Elapsed: 2.367511ms May 24 19:43:23.975: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Succeeded", Reason="", readiness=false. Elapsed: 2.005925914s STEP: Saw pod success May 24 19:43:23.975: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" satisfied condition "Succeeded or Failed" May 24 19:43:23.982: INFO: Trying to get logs from node leguer-worker pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 container agnhost-container: STEP: delete the pod May 24 19:43:24.011: INFO: Waiting for pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 to disappear May 24 19:43:24.013: INFO: Pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 no longer exists STEP: Creating a pod to test service account token: May 24 19:43:24.017: INFO: Waiting up to 5m0s for pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" in namespace "svcaccounts-6022" to be "Succeeded or Failed" May 24 19:43:24.020: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Pending", Reason="", readiness=false. Elapsed: 2.653266ms May 24 19:43:26.025: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Succeeded", Reason="", readiness=false. Elapsed: 2.007114507s STEP: Saw pod success May 24 19:43:26.025: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" satisfied condition "Succeeded or Failed" May 24 19:43:26.028: INFO: Trying to get logs from node leguer-worker pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 container agnhost-container: STEP: delete the pod May 24 19:43:26.044: INFO: Waiting for pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 to disappear May 24 19:43:26.047: INFO: Pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 no longer exists STEP: Creating a pod to test service account token: May 24 19:43:26.052: INFO: Waiting up to 5m0s for pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" in namespace "svcaccounts-6022" to be "Succeeded or Failed" May 24 19:43:26.056: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Pending", Reason="", readiness=false. Elapsed: 4.170387ms May 24 19:43:28.066: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Succeeded", Reason="", readiness=false. Elapsed: 2.014492069s STEP: Saw pod success May 24 19:43:28.066: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" satisfied condition "Succeeded or Failed" May 24 19:43:28.071: INFO: Trying to get logs from node leguer-worker2 pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 container agnhost-container: STEP: delete the pod May 24 19:43:28.103: INFO: Waiting for pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 to disappear May 24 19:43:28.105: INFO: Pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 no longer exists STEP: Creating a pod to test service account token: May 24 19:43:28.110: INFO: Waiting up to 5m0s for pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" in namespace "svcaccounts-6022" to be "Succeeded or Failed" May 24 19:43:28.113: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Pending", Reason="", readiness=false. Elapsed: 2.922805ms May 24 19:43:30.117: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557": Phase="Succeeded", Reason="", readiness=false. Elapsed: 2.007124454s STEP: Saw pod success May 24 19:43:30.117: INFO: Pod "test-pod-54cef95a-887a-453c-a702-fcf11f06e557" satisfied condition "Succeeded or Failed" May 24 19:43:30.120: INFO: Trying to get logs from node leguer-worker pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 container agnhost-container: STEP: delete the pod May 24 19:43:30.139: INFO: Waiting for pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 to disappear May 24 19:43:30.142: INFO: Pod test-pod-54cef95a-887a-453c-a702-fcf11f06e557 no longer exists [AfterEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:30.143: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "svcaccounts-6022" for this suite. • [SLOW TEST:8.210 seconds] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should set ownership and permission when RunAsUser or FsGroup is present [LinuxOnly] [NodeFeature:FSGroup] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:488 ------------------------------ {"msg":"PASSED [sig-auth] ServiceAccounts should set ownership and permission when RunAsUser or FsGroup is present [LinuxOnly] [NodeFeature:FSGroup]","total":-1,"completed":3,"skipped":350,"failed":0} May 24 19:43:30.153: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] Certificates API [Privileged:ClusterAdmin] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:21.699: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename certificates May 24 19:43:21.722: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:21.726: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [It] should support building a client with a CSR /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/certificates.go:55 May 24 19:43:21.970: INFO: creating CSR May 24 19:43:21.973: INFO: approving CSR May 24 19:43:27.026: INFO: waiting for CSR to be signed May 24 19:43:32.032: INFO: testing the client May 24 19:43:32.032: INFO: >>> kubeConfig: /root/.kube/config May 24 19:43:32.034: INFO: creating CSR as new client [AfterEach] [sig-auth] Certificates API [Privileged:ClusterAdmin] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:32.084: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "certificates-2554" for this suite. • [SLOW TEST:10.395 seconds] [sig-auth] Certificates API [Privileged:ClusterAdmin] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should support building a client with a CSR /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/certificates.go:55 ------------------------------ {"msg":"PASSED [sig-auth] Certificates API [Privileged:ClusterAdmin] should support building a client with a CSR","total":-1,"completed":1,"skipped":220,"failed":0} May 24 19:43:32.096: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.043: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename svcaccounts May 24 19:43:22.071: INFO: Found PodSecurityPolicies; testing pod creation to see if PodSecurityPolicy is enabled May 24 19:43:22.075: INFO: No PSP annotation exists on dry run pod; assuming PodSecurityPolicy is disabled STEP: Waiting for a default service account to be provisioned in namespace [It] should support OIDC discovery of service account issuer [Feature:ServiceAccountIssuerDiscovery] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:676 May 24 19:43:22.087: INFO: created pod May 24 19:43:22.087: INFO: Waiting up to 5m0s for pod "oidc-discovery-validator" in namespace "svcaccounts-7123" to be "Succeeded or Failed" May 24 19:43:22.090: INFO: Pod "oidc-discovery-validator": Phase="Pending", Reason="", readiness=false. Elapsed: 2.702052ms May 24 19:43:24.094: INFO: Pod "oidc-discovery-validator": Phase="Succeeded", Reason="", readiness=false. Elapsed: 2.006682627s STEP: Saw pod success May 24 19:43:24.094: INFO: Pod "oidc-discovery-validator" satisfied condition "Succeeded or Failed" May 24 19:43:54.094: INFO: polling logs May 24 19:43:54.101: INFO: Pod logs: 2021/05/24 19:43:23 OK: Got token 2021/05/24 19:43:23 OK: got issuer https://kubernetes.default.svc.cluster.local 2021/05/24 19:43:23 Full, not-validated claims: openidmetadata.claims{Claims:jwt.Claims{Issuer:"https://kubernetes.default.svc.cluster.local", Subject:"system:serviceaccount:svcaccounts-7123:default", Audience:jwt.Audience{"oidc-discovery-test"}, Expiry:1621886002, NotBefore:1621885402, IssuedAt:1621885402, ID:""}, Kubernetes:openidmetadata.kubeClaims{Namespace:"svcaccounts-7123", ServiceAccount:openidmetadata.kubeName{Name:"default", UID:"ae2111c4-81f4-43c8-bb29-d153382f22ab"}}} 2021/05/24 19:43:23 OK: Constructed OIDC provider for issuer https://kubernetes.default.svc.cluster.local 2021/05/24 19:43:23 OK: Validated signature on JWT 2021/05/24 19:43:23 OK: Got valid claims from token! 2021/05/24 19:43:23 Full, validated claims: &openidmetadata.claims{Claims:jwt.Claims{Issuer:"https://kubernetes.default.svc.cluster.local", Subject:"system:serviceaccount:svcaccounts-7123:default", Audience:jwt.Audience{"oidc-discovery-test"}, Expiry:1621886002, NotBefore:1621885402, IssuedAt:1621885402, ID:""}, Kubernetes:openidmetadata.kubeClaims{Namespace:"svcaccounts-7123", ServiceAccount:openidmetadata.kubeName{Name:"default", UID:"ae2111c4-81f4-43c8-bb29-d153382f22ab"}}} May 24 19:43:54.101: INFO: completed pod [AfterEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:43:54.102: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "svcaccounts-7123" for this suite. • [SLOW TEST:32.071 seconds] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should support OIDC discovery of service account issuer [Feature:ServiceAccountIssuerDiscovery] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:676 ------------------------------ {"msg":"PASSED [sig-auth] ServiceAccounts should support OIDC discovery of service account issuer [Feature:ServiceAccountIssuerDiscovery]","total":-1,"completed":1,"skipped":502,"failed":0} May 24 19:43:54.115: INFO: Running AfterSuite actions on all nodes [BeforeEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:174 STEP: Creating a kubernetes client May 24 19:43:22.757: INFO: >>> kubeConfig: /root/.kube/config STEP: Building a namespace api object, basename svcaccounts STEP: Waiting for a default service account to be provisioned in namespace [It] should support InClusterConfig with token rotation [Slow] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:584 May 24 19:43:22.794: INFO: created pod May 24 19:43:22.794: INFO: Waiting up to 1m0s for 1 pods to be running and ready: [inclusterclient] May 24 19:43:22.794: INFO: Waiting up to 1m0s for pod "inclusterclient" in namespace "svcaccounts-8628" to be "running and ready" May 24 19:43:22.797: INFO: Pod "inclusterclient": Phase="Pending", Reason="", readiness=false. Elapsed: 3.317172ms May 24 19:43:24.800: INFO: Pod "inclusterclient": Phase="Pending", Reason="", readiness=false. Elapsed: 2.006224579s May 24 19:43:26.803: INFO: Pod "inclusterclient": Phase="Running", Reason="", readiness=true. Elapsed: 4.008891826s May 24 19:43:26.803: INFO: Pod "inclusterclient" satisfied condition "running and ready" May 24 19:43:26.803: INFO: Wanted all 1 pods to be running and ready. Result: true. Pods: [inclusterclient] May 24 19:43:26.803: INFO: pod is ready May 24 19:44:26.803: INFO: polling logs May 24 19:44:26.811: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:45:26.803: INFO: polling logs May 24 19:45:26.812: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:46:26.803: INFO: polling logs May 24 19:46:26.828: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:47:26.803: INFO: polling logs May 24 19:47:26.812: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:48:26.803: INFO: polling logs May 24 19:48:26.827: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:49:26.804: INFO: polling logs May 24 19:49:26.813: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:50:26.803: INFO: polling logs May 24 19:50:26.813: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:51:26.803: INFO: polling logs May 24 19:51:26.813: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:52:26.803: INFO: polling logs May 24 19:52:26.812: INFO: Retrying. Still waiting to see more unique tokens: got=1, want=2 May 24 19:53:26.803: INFO: polling logs [AfterEach] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:175 May 24 19:53:26.943: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready STEP: Destroying namespace "svcaccounts-8628" for this suite. • [SLOW TEST:604.196 seconds] [sig-auth] ServiceAccounts /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/framework.go:23 should support InClusterConfig with token rotation [Slow] /workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:584 ------------------------------ {"msg":"PASSED [sig-auth] ServiceAccounts should support InClusterConfig with token rotation [Slow]","total":-1,"completed":2,"skipped":1019,"failed":0} May 24 19:53:26.955: INFO: Running AfterSuite actions on all nodes May 24 19:53:26.956: INFO: Running AfterSuite actions on node 1 May 24 19:53:26.956: INFO: Skipping dumping logs from cluster Ran 15 of 5667 Specs in 605.799 seconds SUCCESS! -- 15 Passed | 0 Failed | 0 Pending | 5652 Skipped Ginkgo ran 1 suite in 10m7.55988376s Test Suite Passed