OCPBUGS-106190: Make oc rsh test resilient

[ardaguclu]

When ExtendWebSocketsToKubelet is enabled (Beta in 1.36), WebSocket exec/attach connections are proxied through the API server's UpgradeAwareHandler to the kubelet. The proxy tears down both connections as soon as one direction's io.Copy completes. For fast-completing commands (e.g., mkdir), the kubelet's WebSocket close frame can be lost.

This PR updates the test to make it more resilient to the new behavior.

Summary by CodeRabbit

• Tests
  • Updated remote shell coverage to validate directory creation through a shell command.
  • Added a brief delay to improve reliability for both default and explicitly selected containers.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@ardaguclu: This pull request explicitly references no jira issue.

Details

In response to this:

When ExtendWebSocketsToKubelet is enabled (Beta in 1.36), WebSocket exec/attach connections are proxied through the API server's UpgradeAwareHandler to the kubelet. The proxy tears down both connections as soon as one direction's io.Copy completes. For fast-completing commands (e.g., mkdir), the kubelet's WebSocket close frame can be lost.

This PR updates the test to make it more resilient to the new behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d633465c-323f-48f1-8d47-ec2f74587b39

📥 Commits

Reviewing files that changed from the base of the PR and between 2843387 and e775c9d.

📒 Files selected for processing (1)

• test/extended/cli/rsh.go

---

Walkthrough

The oc rsh test now runs directory creation through sh -c with a brief sleep for default-container and explicitly selected-container cases. Existing output validation and container selection remain unchanged.

Changes

oc rsh command execution

Layer / File(s)	Summary
Run directory creation through a shell test/extended/cli/rsh.go	Both oc rsh commands use sh -c to create test directories and sleep briefly. The test keeps its default-container output validation and explicit container and shell selection.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to e775c

This PR only makes the oc rsh test more resilient to expected WebSocket behavior; no actionable merge-blocking risk remains after normal verification checks.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only command arguments in rsh.go; Ginkgo titles remain static: "[sig-cli] oc rsh", "specific flags", and "should work well when access to a remote shell".
Test Structure And Quality	✅ Passed	The diff only wraps two existing mkdir commands in finite sh -c ... sleep 1 calls; the existing pod wait has a 4-minute timeout, and no setup, cleanup, or assertion structure changed.
Microshift Test Compatibility	✅ Passed	The diff changes two command arguments inside an existing Ginkgo test; it adds no new It/Describe/Context/When test and introduces no MicroShift-incompatible API or feature.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR only changes commands in an existing oc rsh test. It creates and checks one pod with two containers and adds no multi-node or HA assumption.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only test/extended/cli/rsh.go, replacing mkdir arguments with sh -c and sleep; it adds no manifests, operators, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The diff changes only two commands inside a Ginkgo It body; it adds no process-level stdout writer, and CLI Output captures subprocess streams in buffers.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff only changes two existing oc rsh commands to run sh -c; it adds no Ginkgo test, IPv4 assumption, or external connectivity requirement.
No-Weak-Crypto	✅ Passed	The diff only changes mkdir invocations to sh -c commands with sleep; it introduces no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparison.
Container-Privileges	✅ Passed	The commit changes only oc rsh test command arguments; it adds no manifest or security settings for privileged mode, host namespaces, SYS_ADMIN, or privilege escalation.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only adds literal commands to create temporary files and sleep; it introduces no passwords, tokens, keys, PII, hostnames, or customer data in logs.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the change to make the oc rsh test resilient.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ardaguclu]

/test e2e-gcp-ovn-rhcos9-techpreview

[ardaguclu]

/test e2e-gcp-ovn-techpreview
/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[ardaguclu]

/retitle OCPBUGS-106190: Make oc rsh test resilient

[openshift-ci-robot]

@ardaguclu: This pull request references Jira Issue OCPBUGS-106190, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

When ExtendWebSocketsToKubelet is enabled (Beta in 1.36), WebSocket exec/attach connections are proxied through the API server's UpgradeAwareHandler to the kubelet. The proxy tears down both connections as soon as one direction's io.Copy completes. For fast-completing commands (e.g., mkdir), the kubelet's WebSocket close frame can be lost.

This PR updates the test to make it more resilient to the new behavior.

Summary by CodeRabbit

• Tests
• Updated remote shell coverage to validate directory creation through a shell command.
• Added a brief delay to improve reliability for both default and explicitly selected containers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ardaguclu]

/retest

[ardaguclu]

/retest

[ardaguclu]

/retest

[ardaguclu]

/retest

[oceanc80]

/lgtm

[xueqzhan]

@ardaguclu Thank you for taking on the fix for this!! In your mind, will this be a concern in the real world? Will a certain percentage of short rsh commands from users fail and cause confusion?

[ardaguclu]

@ardaguclu Thank you for taking on the fix for this!! In your mind, will this be a concern in the real world? Will a certain percentage of short rsh commands from users fail and cause confusion?

This is tracked in upstream kubernetes/kubernetes#140102. Feature gate is still in Beta. I think, this won't be a production issue.

[ardaguclu]

Will a certain percentage of short rsh commands from users fail and cause confusion?

This rarely occurs, only when Close signal is missed under excessive CPU load.

[xueqzhan]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, oceanc80, xueqzhan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [xueqzhan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ardaguclu]

/retest

[ardaguclu]

/retest

[openshift-ci]

@ardaguclu: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere-ovn	e775c9d	link	true	/test e2e-vsphere-ovn
ci/prow/e2e-aws-ovn-fips	e775c9d	link	true	/test e2e-aws-ovn-fips
ci/prow/e2e-vsphere-ovn-upi	e775c9d	link	true	/test e2e-vsphere-ovn-upi
ci/prow/e2e-gcp-ovn-techpreview	e775c9d	link	false	/test e2e-gcp-ovn-techpreview
ci/prow/e2e-gcp-ovn	e775c9d	link	true	/test e2e-gcp-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-trt]

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: e775c9d

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-vsphere-ovn-upi	High - "Find all of the input images from ocp/5.1 and tag them into the stable stream" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-vsphere-ovn-upi	High - "Find all of the input images from ocp/5.1 and tag them into the stable-initial stream" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: e775c9d

• "Find all of the input images from ocp/5.1 and tag them into the stable stream" [Total: 3, Pass: 3, Fail: 0, Flake: 0]
• "Find all of the input images from ocp/5.1 and tag them into the stable-initial stream" [Total: 3, Pass: 3, Fail: 0, Flake: 0]