Description
If we're advertising this as a security fix going GA (in v1.34 #131514) then as a user I'd want confidence that this is standard and nobody has patched it to break the security mitigation it provides. I think we should promote this test to conformance.
I worry if we don't that we provide a false sense of closing the gap that led to this KEP (a CVE with network policy potentially being deleted before workloads fundamentally leaving an exploitable enforcement gap across implementations of network policy #126587)
There was a flakiness issue from another unrelated test making the namespace controller have high load, a patch for that is in flight (#131518), but later when we have proven the test stable, I think we should be looking at this behavior in-scope.
https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/5080-ordered-namespace-deletion/README.md#design-details
kubernetes/enhancements#5080
Specifically this ensures that pods are deleted and waited on before other resources.
https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/5080-ordered-namespace-deletion/README.md#deletionorderpriority-mechanism
/milestone v1.34
/sig architecture api-machinery
/area conformance
cc @dims @johnbelamaric @cici37
details above pulled from: https://kubernetes.slack.com/archives/C5P3FE08M/p1745939545014909 (#sig-architecture in https://slack.k8s.io)
Metadata
Metadata
Assignees
Labels
Type
Projects
Status