Skip to content

Fix e2e rate limiter timeout in namespace permission probe#495

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
dustman9000:fix-e2e-ratelimiter
Apr 27, 2026
Merged

Fix e2e rate limiter timeout in namespace permission probe#495
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
dustman9000:fix-e2e-ratelimiter

Conversation

@dustman9000
Copy link
Copy Markdown
Member

@dustman9000 dustman9000 commented Apr 27, 2026

Summary

  • Fix sre-regular-user-validation e2e test failing with client rate limiter Wait returned an error: context deadline exceeded
  • The createNS helper passed a shared 120s context to every Create call in the retry loop. When the client rate limiter was exhausted, Create blocked in ratelimiter.Wait(ctx) until the context expired
  • Use a per-attempt 10s context so each Create call fails fast and retries, instead of blocking on the rate limiter for the full timeout

Test plan

  • Verify MCVW e2e test passes on integration after merge
  • Verify auto-promotion pipeline unblocks for SSS STAGE targets

Summary by CodeRabbit

  • Tests
    • Improved validation webhook test reliability with enhanced timeout and error handling mechanisms.

The createNS helper passed a shared 120s context to every Create call
in the retry loop. When the client rate limiter was exhausted from
prior operations, Create blocked in ratelimiter.Wait(ctx) until the
context expired, producing "client rate limiter Wait returned an error:
context deadline exceeded".

Use a per-attempt 10s context so each Create call can fail fast and
retry, rather than blocking on the rate limiter for the full timeout.
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 27, 2026

Walkthrough

The namespace-permissions readiness probe in the test suite now enforces an overall 120-second limit using a computed deadline rather than a single shared timeout context. Each probe attempt uses its own 10-second timeout for the create operation, with timeout detection shifted from checking context errors to comparing against the deadline. Error handling now treats "context deadline exceeded" errors as non-fatal alongside Forbidden errors.

Changes

Cohort / File(s) Summary
Readiness Probe Timeout Handling
test/e2e/validation_webhook_tests.go
Modified namespace-permissions probe to use deadline-based timeout enforcement with separate per-attempt contexts. Changed timeout detection from ctx.Err() to deadline comparison, updated error filtering for context deadline scenarios, and switched deletion context from context.TODO() to context.Background().

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 10 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Microshift Test Compatibility ⚠️ Warning The pull request adds Ginkgo e2e tests using MicroShift-incompatible APIs (configv1.FeatureGate, configv1.ClusterVersion, quotav1.ClusterResourceQuota) without protective mechanisms like [Skipped:MicroShift] labels or [apigroup:...] tags. Add [apigroup:config.openshift.io] or [apigroup:quota.openshift.io] tags to test names, or wrap in Describe blocks with tags to allow MicroShift CI to skip these tests automatically.
Ipv6 And Disconnected Network Test Compatibility ❓ Inconclusive Unable to verify: git diff command failed or file does not exist. Cannot determine if new Ginkgo e2e tests were added. Provide the pull request files or git diff output to verify new test additions.
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The pull request title directly addresses the main change: fixing a timeout issue in the namespace permission probe's rate limiter handling in e2e tests.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed All Ginkgo test declarations use stable, deterministic test names with static strings only. Dynamic values are properly isolated to test bodies, not test titles.
Test Structure And Quality ✅ Passed The pull request successfully addresses the test timeout issue with proper retry logic, meaningful assertions, and correct resource lifecycle management.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR introduces e2e tests for validating webhook policies that apply uniformly across all cluster topologies, including SNO, without assuming multiple nodes or distinct node roles.
Topology-Aware Scheduling Compatibility ✅ Passed PR modifies only e2e test file with timeout/context changes, not deployment manifests, operator code, or controllers.
Ote Binary Stdout Contract ✅ Passed Changes to createNS function involve timeout/context handling and error filtering with no new stdout writes at process level.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from aliceh and anispate April 27, 2026 21:23
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 27, 2026
@aliceh
Copy link
Copy Markdown
Contributor

aliceh commented Apr 27, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 27, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 27, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aliceh, dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 27, 2026

@dustman9000: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/e2e/validation_webhook_tests.go (1)

84-84: Prefer typed timeout checks over error-string matching.

Line 84 uses strings.Contains(createErr.Error(), "context deadline exceeded"), which is brittle and may misclassify unrelated errors. Use standard-library errors.Is(createErr, context.DeadlineExceeded) (with an alias to avoid collision with k8s errors import).

♻️ Proposed refactor
 import (
 	"context"
+	goerrors "errors"
 	"strconv"
 	"strings"
 	"time"
@@
-			if !errors.IsForbidden(createErr) && !strings.Contains(createErr.Error(), "context deadline exceeded") {
+			if !errors.IsForbidden(createErr) && !goerrors.Is(createErr, context.DeadlineExceeded) {
 				Expect(createErr).ShouldNot(HaveOccurred(), "Unexpected error probing namespace readiness")
 			}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@test/e2e/validation_webhook_tests.go` at line 84, Replace the brittle string
check for timeouts with a proper typed check: where you currently test createErr
with errors.IsForbidden(createErr) and strings.Contains(createErr.Error(),
"context deadline exceeded"), stop using the string match and instead use the
standard library errors.Is(createErr, context.DeadlineExceeded); to avoid import
collision alias the k8s error package (e.g., k8serrors) and ensure the std
"errors" and "context" packages are imported, keeping the existing createErr and
errors.IsForbidden usage but changing the timeout branch to errors.Is(createErr,
context.DeadlineExceeded).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@test/e2e/validation_webhook_tests.go`:
- Line 84: Replace the brittle string check for timeouts with a proper typed
check: where you currently test createErr with errors.IsForbidden(createErr) and
strings.Contains(createErr.Error(), "context deadline exceeded"), stop using the
string match and instead use the standard library errors.Is(createErr,
context.DeadlineExceeded); to avoid import collision alias the k8s error package
(e.g., k8serrors) and ensure the std "errors" and "context" packages are
imported, keeping the existing createErr and errors.IsForbidden usage but
changing the timeout branch to errors.Is(createErr, context.DeadlineExceeded).

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f4b8d172-f4aa-4868-bb8b-107dda5c299d

📥 Commits

Reviewing files that changed from the base of the PR and between 9151595 and a6b4a69.

📒 Files selected for processing (1)
  • test/e2e/validation_webhook_tests.go

@openshift-merge-bot openshift-merge-bot Bot merged commit b2bea18 into openshift:master Apr 27, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants