Skip to content

Promote Ordered Namespace Deletion Tests to Conformance #131532

@BenTheElder

Description

@BenTheElder

If we're advertising this as a security fix going GA (in v1.34 #131514) then as a user I'd want confidence that this is standard and nobody has patched it to break the security mitigation it provides. I think we should promote this test to conformance.

I worry if we don't that we provide a false sense of closing the gap that led to this KEP (a CVE with network policy potentially being deleted before workloads fundamentally leaving an exploitable enforcement gap across implementations of network policy #126587)

There was a flakiness issue from another unrelated test making the namespace controller have high load, a patch for that is in flight (#131518), but later when we have proven the test stable, I think we should be looking at this behavior in-scope.

https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/5080-ordered-namespace-deletion/README.md#design-details
kubernetes/enhancements#5080

Specifically this ensures that pods are deleted and waited on before other resources.
https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/5080-ordered-namespace-deletion/README.md#deletionorderpriority-mechanism

/milestone v1.34
/sig architecture api-machinery
/area conformance
cc @dims @johnbelamaric @cici37

details above pulled from: https://kubernetes.slack.com/archives/C5P3FE08M/p1745939545014909 (#sig-architecture in https://slack.k8s.io)

Metadata

Metadata

Labels

area/conformanceIssues or PRs related to kubernetes conformance testssig/api-machineryCategorizes an issue or PR as relevant to SIG API Machinery.sig/architectureCategorizes an issue or PR as relevant to SIG Architecture.triage/acceptedIndicates an issue or PR is ready to be actively worked on.

Type

No type

Projects

Status

Pending inclusion

Relationships

None yet

Development

No branches or pull requests

Issue actions