test: add e2e to validate native sidecar

Signed-off-by: Anish Ramasekar <[email protected]>

Author: aramase

test/e2e/e2e.go

@@ -16,6 +16,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilversion "k8s.io/apimachinery/pkg/util/version"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/kubernetes/test/e2e/framework"
 	e2edebug "k8s.io/kubernetes/test/e2e/framework/debug"
@@ -32,6 +33,8 @@ var (
 		metav1.NamespaceSystem,
 		"azure-workload-identity-system",
 	}
+
+	useNativeSidecar bool
 )
 
 var _ = ginkgo.SynchronizedBeforeSuite(func(ctx context.Context) []byte {
@@ -81,7 +84,15 @@ var _ = ginkgo.SynchronizedBeforeSuite(func(ctx context.Context) []byte {
 	if serverVersion != nil {
 		framework.Logf("kube-apiserver version: %s", serverVersion.GitVersion)
 	}
-
+	sv, err := utilversion.ParseSemantic(serverVersion.GitVersion)
+	if err != nil {
+		framework.Failf("unexpected server error parsing version: %v", err)
+	}
+	// "SidecarContainers" went beta in 1.29. With the 3 version skew policy,
+	// between API server and kubelet, 1.32 is the earliest version this can be
+	// safely used.
+	useNativeSidecar = sv.AtLeast(utilversion.MajorMinor(1, 32))
+	framework.Logf("proxy should use native sidecar: %t", useNativeSidecar)
 	return nil
 }, func(data []byte) {})
 

test/e2e/helpers.go

@@ -320,3 +320,31 @@ func getVolumeProjectionSources(serviceAccountName string) []corev1.VolumeProjec
 		}},
 	}
 }
+
+func validateProxySideCarInMutatedPod(pod *corev1.Pod) {
+	framework.Logf("validating that the proxy sidecar is injected to %s", pod.Name)
+	containers := pod.Spec.Containers
+	if useNativeSidecar {
+		framework.Logf("validating that the proxy init container is injected as native sidecar to %s", pod.Name)
+		containers = pod.Spec.InitContainers
+	}
+
+	proxySidecar := getProxySidecarContainer(containers)
+	gomega.Expect(proxySidecar).NotTo(gomega.BeNil(), "proxy sidecar is not injected to pod %s", pod.Name)
+
+	if useNativeSidecar {
+		gomega.Expect(proxySidecar.RestartPolicy).ToNot(gomega.BeNil(), "proxy sidecar in pod %s should have a restart policy", pod.Name)
+		gomega.Expect(*proxySidecar.RestartPolicy).To(gomega.Equal(corev1.ContainerRestartPolicyAlways), "proxy sidecar in pod %s should have restart policy 'Always'", pod.Name)
+	} else {
+		gomega.Expect(proxySidecar.RestartPolicy).To(gomega.BeNil(), "proxy sidecar in pod %s should not have a restart policy", pod.Name)
+	}
+}
+
+func getProxySidecarContainer(containers []corev1.Container) *corev1.Container {
+	for _, container := range containers {
+		if container.Name == "azwi-proxy" {
+			return &container
+		}
+	}
+	return nil
+}

test/e2e/proxy_test.go

@@ -59,6 +59,8 @@ var _ = ginkgo.Describe("Proxy [LinuxOnly] [AKSSoakOnly]", func() {
 			}
 		}()
 
+		validateProxySideCarInMutatedPod(pod)
+
 		for _, container := range []string{busybox1, busybox2} {
 			framework.Logf("validating that %s in %s has acquired a valid AAD token via the proxy", container, pod.Name)
 			gomega.Eventually(func() bool {
@@ -113,6 +115,8 @@ var _ = ginkgo.Describe("Proxy [LinuxOnly] [AKSSoakOnly]", func() {
 			}
 		}()
 
+		validateProxySideCarInMutatedPod(pod)
+
 		for _, container := range []string{busybox1, busybox2} {
 			framework.Logf("validating that %s in %s has acquired a valid AAD token via the proxy using AZURE_CLIENT_ID", container, pod.Name)
 			gomega.Eventually(func() bool {