OpenShift Origin holds the extended conformance and integration tests used to validate OpenShift clusters. Recent activity improves storage, network, DNS, and PKI coverage, with several fixes aimed at stopping test setup defects from hiding real data platform regressions.
Storage coverage now checks real data movement ¶
The largest functional addition is an end to end test for additional container storage. The new additional_storage_e2e.go creates a dedicated MachineConfigPool, configures image, layer, and artifact stores, and waits up to 15 minutes for rollout. It then checks storage.conf, the CRI O artifact store fragment, and the active service state.
The useful part is the functional path. The test places an image only in the additional image store and starts a pod with ImagePullPolicy: Never. It removes that image, starts another pod with ImagePullPolicy: IfNotPresent, and confirms a registry pull event. For teams running image heavy Spark, Flink, or batch workers, this covers both local cache use and registry fallback after node storage configuration changes.
A follow up change excludes single node clusters. The test drains a node through a custom pool, but a single node cluster cannot drain its only control plane node reliably. This is a coverage gap, not evidence that additional storage fails on that topology.
GCP storage receives a separate regional persistent disk test. It provisions a 200 GiB regional disk across two zones, writes data from one pod, removes that pod, mounts the volume from another zone, and verifies the same content. That is a direct durability check. It does not simulate abrupt node loss or measure recovery time, so operators still need failure drills for stateful pipelines.
Network tests separate policy defects from setup noise ¶
The MultiNetworkPolicy IPv6 correction changes three test addresses from a /32 prefix to /64 in multinetpolicy.go. The commit records a 97.95 percent pass rate for the IPv6 case, compared with 100 percent for IPv4. With /32, the kernel treated too much address space as local and did not perform the expected neighbor discovery. The connection failed before policy enforcement was tested.
Another check now rejects named ports in platform NetworkPolicies because some CNI implementations can turn those rules into broader access than intended. The initial validation commit added a known exception list. A scope correction then limited networkpolicy_validation.go to openshift, kube, and default namespaces. That avoids failures from tenant tests that intentionally exercise named ports, while keeping the platform contract strict.
Router testing also became more isolated. A Squid proxy fix clears inherited proxy variables when a router container uses curl against its own loopback interface. The change in config_manager_ingress.go prevents a cluster proxy from receiving a synthetic hostname that only the local curl command can resolve.
Single node upgrade checks get a realistic DNS budget ¶
The DNS availability adjustment changes dns.go in two ways. Each dig probe now uses a one second timeout with no retry, which makes silent packet loss and immediate ICMP failures comparable. The accepted failure share for a single node upgrade rises from 1 percent to 15 percent because its expected reboot creates about 75 seconds of DNS outage.
That threshold is specific to upgrade testing on a topology with no redundant DNS pod. It should not become a normal service target. A scheduler, catalog service, or checkpoint writer that depends on DNS can still lose useful work during that window.
PKI coverage expands as well. A new serial suite exercises RSA 4096, ECDSA P384, and mixed signer and serving key settings for kube-apiserver and service-ca. The tests in pki_kube_apiserver.go and pki_service_ca.go delete certificate secrets, wait for regeneration, and verify the resulting algorithm and key parameters. This tests reconciliation behavior used by internal TLS consumers, but it remains behind the ConfigurablePKI feature gate.
The headline diff is mostly fixture churn ¶
The seven day summary reports 470656 insertions and 406021 deletions. Almost all of that volume comes from an automated synthetic test data update: 468852 insertions and 405936 deletions across two JSON result fixtures. The changed alert query results dominate the statistics.
Review the Go test changes as the engineering signal. Treat the generated JSON as a baseline update that deserves validation, but not as hundreds of thousands of lines of new runtime behavior.
What to watch ¶
Single node additional storage still lacks an equivalent test that avoids draining the only control plane node.
The GCP regional disk case proves data survives a controlled move across zones. Abrupt loss, attach latency, and workload recovery remain outside its scope.
Named port exceptions remain in the platform policy test. Their removal will show whether the affected operators have moved to numeric ports.