Skip to content

Avoid copy of the oc binary, to support heterogeneous environments #30992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jogeo wants to merge 2 commits into
base: main
Choose a base branch
from
+18 −10
Open

Avoid copy of the oc binary, to support heterogeneous environments #30992

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a4a9c33
Avoid copy of the oc binary, which can fail in heterogeneous environm…
jogeo Apr 9, 2026
a854b14
Resolve Code Rabbit comments.
jogeo Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions test/extended/apiserver/kubeconfigs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,17 +112,25 @@ func testKubeApiserverContainer(oc *exutil.CLI, kubeconfig, masterName string) e
return fmt.Errorf("location for %s kubeconfig not found", kubeconfig)
}

framework.Logf("Copying oc binary from host to kube-apiserver container in master %q", masterName)
out, err := oc.AsAdmin().Run("debug").Args("node/"+masterName, "--", "chroot", "/host", "/bin/bash", "-euxo", "pipefail", "-c",
fmt.Sprintf(`oc --kubeconfig /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig -n openshift-kube-apiserver cp /usr/bin/oc kube-apiserver-%s:/tmp`, masterName)).Output()
framework.Logf("%s", out)
if err != nil {
return fmt.Errorf("%s", out)
}

framework.Logf("Verifying kubeconfig %q in kube-apiserver container in master %q", kubeconfig, masterName)
out, err = oc.AsAdmin().Run("exec").Args("-n", "openshift-kube-apiserver", "kube-apiserver-"+masterName, "--", "/bin/bash", "-euxo", "pipefail", "-c",
fmt.Sprintf(`/tmp/oc --kubeconfig "%s" get nodes`, kubeconfigPath)).Output()
// Use curl to verify the kubeconfig is present and functional, extracting
// cert paths directly from the kubeconfig file. This avoids copying the oc
// binary from the host into the container, which fails when the host OS
// (e.g., RHCOS 10 with glibc 2.38) has a newer glibc than the container.
out, err := oc.AsAdmin().Run("exec").Args("-n", "openshift-kube-apiserver", "kube-apiserver-"+masterName, "--", "/bin/bash", "-euxo", "pipefail", "-c",
fmt.Sprintf(`for k in server client-certificate client-key certificate-authority; do
count=$(grep -Ec "^[[:space:]]*${k}:[[:space:]]+" "%[1]s")
[ "$count" -eq 1 ] || { echo "expected exactly one ${k} in %[1]s, got $count" >&2; exit 1; }
done
server=$(grep '^[[:space:]]*server:' "%[1]s" | head -1 | awk '{print $2}')
cert=$(grep '^[[:space:]]*client-certificate:' "%[1]s" | head -1 | awk '{print $2}')
key=$(grep '^[[:space:]]*client-key:' "%[1]s" | head -1 | awk '{print $2}')
ca=$(grep '^[[:space:]]*certificate-authority:' "%[1]s" | head -1 | awk '{print $2}')
for v in server cert key ca; do
eval "val=\$$v"
[ -n "$val" ] || { echo "${v} field extraction failed from %[1]s" >&2; exit 1; }
done
curl -Ssf --connect-timeout 10 --max-time 45 --cert "$cert" --key "$key" --cacert "$ca" "${server}/api?timeout=32s"`, kubeconfigPath)).Output()
Copy link
Copy Markdown
Contributor

@dgoodwin dgoodwin Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codrabbitai could this log any sensitive cert details

framework.Logf("%s", out)
if err != nil {
return fmt.Errorf("%s", out)
Expand Down