From 780cc1321e3f2f548a4e261430ebd3d49f2dda5a Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Fri, 21 Aug 2026 15:38:30 +0200 Subject: [PATCH] Add no-reboot assertion to kubelet TLS upgrade test The TLS drop-in change (openshift/machine-config-operator#6426) makes KubeletConfig TLS profile changes trigger a kubelet restart instead of a full node reboot. Static pods with TLS args baked in their manifests (e.g. crio metrics proxy) are also recreated by kubelet. No drain occurs. Assert that the node BootID remains unchanged after the MCP rollout completes. Also move the test from [Disruptive] to [Serial] since the operation no longer reboots the node or drains workloads. --- test/extended/node/kubeletconfig_tls.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/test/extended/node/kubeletconfig_tls.go b/test/extended/node/kubeletconfig_tls.go index 367b6d7476e8..8789830300e6 100644 --- a/test/extended/node/kubeletconfig_tls.go +++ b/test/extended/node/kubeletconfig_tls.go @@ -18,9 +18,10 @@ import ( // This test suite validates that the kubelet TLS configuration can be upgraded // from TLS 1.2 to TLS 1.3 via a KubeletConfig resource applied to a custom -// MachineConfigPool containing a single worker node. Using a custom pool -// avoids rebooting all workers and makes the test significantly faster. -var _ = g.Describe("[Suite:openshift/disruptive-longrunning][sig-node][Disruptive] Kubelet TLS configuration", func() { +// MachineConfigPool containing a single worker node. +// [Serial] because the MCP rollout restarts kubelet and static pods whose +// manifests embed TLS settings. +var _ = g.Describe("[sig-node][Serial] Kubelet TLS configuration", func() { var ( oc = exutil.NewCLIWithoutNamespace("node-kubeletconfig-tls") kubeletConfigName = "tls13-kubelet-config" @@ -49,6 +50,12 @@ var _ = g.Describe("[Suite:openshift/disruptive-longrunning][sig-node][Disruptiv o.Expect(isNodeInReadyState(&workerNodes[0])).To(o.BeTrue(), "Worker node %s is not in Ready state", testNode) framework.Logf("Selected node %s for TLS upgrade test", testNode) + g.By("Recording node BootID before TLS change") + nodeSnapshot, err := oc.AdminKubeClient().CoreV1().Nodes().Get(ctx, testNode, metav1.GetOptions{}) + o.Expect(err).NotTo(o.HaveOccurred()) + originalBootID := nodeSnapshot.Status.NodeInfo.BootID + framework.Logf("Node %s BootID before change: %s", testNode, originalBootID) + g.By("Checking default TLS configuration") nodeCfg, err := getKubeletConfigFromNode(ctx, oc, testNode) o.Expect(err).NotTo(o.HaveOccurred(), "Error reading kubelet config from node %s", testNode) @@ -119,7 +126,12 @@ var _ = g.Describe("[Suite:openshift/disruptive-longrunning][sig-node][Disruptiv o.Expect(actualTLSVersion).To(o.Equal(expectedTLSVersion), "TLS version should be %q, but got %q", expectedTLSVersion, actualTLSVersion) - framework.Logf("Successfully verified kubelet TLS upgrade from %s to %s on node %s", + g.By("Verifying no node reboot occurred (BootID unchanged)") + o.Expect(updatedNode.Status.NodeInfo.BootID).To(o.Equal(originalBootID), + "Node %s rebooted (BootID changed from %s to %s), expected only kubelet restart", + testNode, originalBootID, updatedNode.Status.NodeInfo.BootID) + + framework.Logf("Successfully verified kubelet TLS upgrade from %s to %s on node %s without reboot", defaultTLSVersion, actualTLSVersion, testNode) }) })