denis256 notes and projects

Recent OpenShift Origin activity is mostly about the extended test suite, which is the right place to look if you operate OpenShift or maintain tests around cluster behavior. In five commits, the project added conformance coverage for Additional Storage Support, stabilized aggregated upgrade JUnit output, and fixed a proxied CI failure in the internal release image workload test. For engineers searching what changed in OpenShift Origin this week, the headline is clear: node and installer tests got sharper around storage, image registries, namespace setup, and upgrade preconditions.

Additional storage API coverage moves into conformance

The largest change is the commit adding Additional Storage Support API validation tests. It creates test/extended/node/additional_storage_api.go, documents it in test/extended/node/README.md, and adds prerequisite checks in test/extended/node/node_utils.go. The important part is that these tests use DryRun, so they validate the API server admission path without forcing Machine Config Operator reconciliation. That makes the tests fit the parallel conformance suite.

Coverage is narrow, but useful. It checks the store fields that tend to hurt later when invalid data reaches node level config:

• additionalLayerStores: empty paths, relative paths, spaces, invalid characters, over length paths, duplicates, too many entries, and repeated slashes
• additionalImageStores: invalid path smoke coverage
• additionalArtifactStores: invalid path smoke coverage
• combined store configs: bad image path, layer count limits, and duplicate image paths

The documented filter is direct:

./openshift-tests run "openshift/conformance/parallel" --dry-run | \
  grep "\[Feature:AdditionalStorageSupport\]" | \
  ./openshift-tests run -f -

Notice the skips. MicroShift is out because MachineConfig resources are not available, and Azure is skipped due to known platform issues. That is plain test hygiene. The suite should fail on API contract breaks, not on environments where the contract cannot be exercised.

CI result aggregation gets a stable precondition signal

Another small patch changes a sharp failure mode in pkg/test/ginkgo/cmd_runsuite.go. The maintainers now always emit the precondition validation synthetic test entry, even when no precondition checks ran. The issue was not a cluster behavior bug. Aggregated upgrade jobs could have clean child runs with no emitted entry, then the aggregator saw fewer passes than required and rejected the payload.

That matters to anyone looking at CI flakes. A missing synthetic result is not a cluster failure. It is accounting. By returning a passing JUnit case when checks were skipped or not performed, the run suite gives the aggregator a consistent counter. Less drama, better signal.

The subtle part is the meaning of a pass. A passing synthetic precondition entry now means one of two things: checks ran and passed, or no precondition check path ran. That is still better than absence, because absence made child run counts inconsistent.

Internal release image tests avoid the proxy trap

The most recent commit moves the IRI workload test to admin client namespace creation. In test/extended/internalreleaseimage/internalreleaseimage.go, the suite changes from NewCLI("no-registry") to NewCLIWithoutNamespace("no-registry") and asks helper code to create a namespace. In test/extended/internalreleaseimage/helper.go, CreateSimpleNamespace creates an e2e-test-* namespace with restricted pod security labels and waits for SCC annotations.

The practical reason is proxy handling. The older setup path created a user kubeconfig and lost proxy-url during SetupProject, which could turn into DNS failures in proxied CI. The new helper stays on admin clients and deletes the namespace with a thirty second timeout.

For test authors, this is a useful pattern. Avoid user project setup when the test only needs a temporary namespace and the environment has special network routing. Also keep the SCC annotation wait. Without it, the test can race policy sync and then report a pod admission problem that is really test setup noise.

Node suite metadata gets cleaned up

Two smaller node changes are still worth noting. The team removed the Feature:NodeSwap tag from the CNV swap test in test/extended/node/node_swap_cnv.go. The test is still serial, disruptive, and part of openshift/disruptive-longrunning; the change is about how it is selected and reported. The accompanying CNV swap README update also trims the test case list from fourteen entries to twelve and aligns the example openshift-tests run-test command with the current suite label.

The image registry reboot test also got a one line fix. The commit allows registry.redhat.io in the reboot required test by adding it to AllowedRegistries in test/extended/node/node_e2e/image_registry_config.go. That reads tiny, but tests that modify registry source policy are sensitive. Missing one required registry can produce a failure that says little about the reboot behavior being tested.

What to watch

First, Additional Storage Support is moving through the normal OpenShift maturity path. The README says OCP 4.22 needs TechPreviewNoUpgrade, while OCP 4.23 and later are GA for this API area. If you run conformance subsets, make sure the AdditionalStorageConfig feature gate state matches the cluster you think you are testing.

Second, CI consumers should account for the always present precondition synthetic entry. If dashboards used absence of that entry as a special case, that assumption is now stale. A pass can mean checks passed, or that no check path ran.

Third, test contributors should copy the admin namespace pattern carefully. It sets pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/warn, and pod-security.kubernetes.io/audit labels and waits for SCC annotations before creating pods. That wait is not decorative. It prevents a test from racing policy sync and then reporting a problem in the wrong subsystem.