Manual sync (#117)

.github/workflows/kind.yml

@@ -21,6 +21,7 @@ jobs:
     env:
       REGISTRY: localhost:5000
     strategy:
+      fail-fast: false
       matrix:
         # Run tests on minimum and newest supported OCP Kubernetes
         # The "minimum" tag is set in the Makefile

.tekton/config-policy-controller-0pyc-pull-request.yaml

@@ -247,7 +247,7 @@ spec:
         values:
         - "false"
       workspaces:
-      - name: sanity-ws
+      - name: test-ws
         workspace: workspace
     - name: clair-scan
       params:

Makefile

@@ -211,6 +211,10 @@ e2e-test: e2e-dependencies
 e2e-test-coverage: E2E_TEST_ARGS = --json-report=report_e2e.json --label-filter='!hosted-mode && !running-in-cluster' --output-dir=.
 e2e-test-coverage: e2e-run-instrumented e2e-test e2e-stop-instrumented
 
+.PHONY: e2e-test-coverage-foreground
+e2e-test-coverage-foreground: LOG_REDIRECT = 
+e2e-test-coverage-foreground: e2e-test-coverage
+
 .PHONY: e2e-test-hosted-mode-coverage
 e2e-test-hosted-mode-coverage: E2E_TEST_ARGS = --json-report=report_e2e_hosted_mode.json --label-filter="hosted-mode && !running-in-cluster" --output-dir=.
 e2e-test-hosted-mode-coverage: COVERAGE_E2E_OUT = coverage_e2e_hosted_mode.out
@@ -226,8 +230,9 @@ e2e-build-instrumented:
 	go test -covermode=atomic -coverpkg=$(shell cat go.mod | head -1 | cut -d ' ' -f 2)/... -c -tags e2e ./ -o build/_output/bin/$(IMG)-instrumented
 
 .PHONY: e2e-run-instrumented
+LOG_REDIRECT ?= &>build/_output/controller.log
 e2e-run-instrumented: e2e-build-instrumented
-	WATCH_NAMESPACE="$(WATCH_NAMESPACE)" ./build/_output/bin/$(IMG)-instrumented -test.run "^TestRunMain$$" -test.coverprofile=$(COVERAGE_E2E_OUT) &>build/_output/controller.log &
+	WATCH_NAMESPACE="$(WATCH_NAMESPACE)" ./build/_output/bin/$(IMG)-instrumented -test.run "^TestRunMain$$" -test.coverprofile=$(COVERAGE_E2E_OUT) $(LOG_REDIRECT) &
 
 .PHONY: e2e-stop-instrumented
 e2e-stop-instrumented:

controllers/configurationpolicy_controller.go

@@ -517,13 +517,21 @@ func (r *ConfigurationPolicyReconciler) cleanUpChildObjects(plc policyv1.Configu
 		// determine whether object should be deleted
 		needsDelete := false
 
-		existing, _ := getObject(
+		existing, err := getObject(
 			namespaced,
 			object.Object.Metadata.Namespace,
 			object.Object.Metadata.Name,
 			mapping.Resource,
 			r.TargetK8sDynamicClient,
 		)
+		if err != nil {
+			log.Error(err, "Failed to get child object")
+
+			deletionFailures = append(deletionFailures, gvk.String()+fmt.Sprintf(` "%s" in namespace %s`,
+				object.Object.Metadata.Name, object.Object.Metadata.Namespace))
+
+			continue
+		}
 
 		// object does not exist, no deletion logic needed
 		if existing == nil {
@@ -554,7 +562,7 @@ func (r *ConfigurationPolicyReconciler) cleanUpChildObjects(plc policyv1.Configu
 			// if object has already been deleted and is stuck, no need to redo delete request
 			_, deletionTimeFound, _ := unstructured.NestedString(existing.Object, "metadata", "deletionTimestamp")
 			if deletionTimeFound {
-				log.Error(err, "Error: tried to delete object, but delete is hanging")
+				log.Error(fmt.Errorf("tried to delete object, but delete is hanging"), "Error")
 
 				deletionFailures = append(deletionFailures, gvk.String()+fmt.Sprintf(` "%s" in namespace %s`,
 					object.Object.Metadata.Name, object.Object.Metadata.Namespace))
@@ -2108,7 +2116,7 @@ func getObject(
 			return nil, nil
 		}
 
-		objLog.Error(err, "Could not retrieve object from the API server")
+		objLog.V(2).Error(err, "Could not retrieve object from the API server")
 
 		return nil, err
 	}
@@ -2702,7 +2710,7 @@ func (r *ConfigurationPolicyReconciler) addForUpdate(policy *policyv1.Configurat
 	policy.Status.LastEvaluated = time.Now().UTC().Format(time.RFC3339)
 	policy.Status.LastEvaluatedGeneration = policy.Generation
 
-	_, err := r.updatePolicyStatus(policy, sendEvent)
+	err := r.updatePolicyStatus(policy, sendEvent)
 	policyLog := log.WithValues("name", policy.Name, "namespace", policy.Namespace)
 
 	if k8serrors.IsConflict(err) {
@@ -2724,14 +2732,14 @@ func (r *ConfigurationPolicyReconciler) addForUpdate(policy *policyv1.Configurat
 func (r *ConfigurationPolicyReconciler) updatePolicyStatus(
 	policy *policyv1.ConfigurationPolicy,
 	sendEvent bool,
-) (*policyv1.ConfigurationPolicy, error) {
+) error {
 	if sendEvent {
 		log.V(1).Info("Sending parent policy compliance event")
 
 		// If the compliance event can't be created, then don't update the ConfigurationPolicy
 		// status. As long as that hasn't been updated, everything will be retried next loop.
 		if err := r.sendComplianceEvent(policy); err != nil {
-			return policy, err
+			return err
 		}
 	}
 
@@ -2741,7 +2749,7 @@ func (r *ConfigurationPolicyReconciler) updatePolicyStatus(
 
 	err := r.Status().Update(context.TODO(), policy)
 	if err != nil {
-		return policy, err
+		return err
 	}
 
 	if sendEvent {
@@ -2751,7 +2759,7 @@ func (r *ConfigurationPolicyReconciler) updatePolicyStatus(
 			fmt.Sprintf("Policy status is: %v", policy.Status.ComplianceState))
 	}
 
-	return nil, nil
+	return nil
 }
 
 func (r *ConfigurationPolicyReconciler) sendComplianceEvent(instance *policyv1.ConfigurationPolicy) error {

test/e2e/case20_delete_objects_test.go

@@ -609,7 +609,7 @@ var _ = Describe("Test objects are not deleted when the CRD is removed", Ordered
 	})
 })
 
-var _ = Describe("Clean up old object when configuraionpolicy is changed", Ordered, func() {
+var _ = Describe("Clean up old object when configurationpolicy is changed", Ordered, func() {
 	const (
 		oldPodName             string = "case29-name-changed-pod"
 		newPodName             string = "case29-name-changed-new"