Merge pull request #27000 from stlaz/fix_privileged

actually set default PSa labels if unset

Author: openshift-merge-robot

test/extended/util/client.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
-	"k8s.io/client-go/util/retry"
 	"net"
 	"net/http"
 	"os"
@@ -20,26 +19,10 @@ import (
 
 	g "github.com/onsi/ginkgo"
 	o "github.com/onsi/gomega"
-	oauthv1 "github.com/openshift/api/oauth/v1"
-	projectv1 "github.com/openshift/api/project/v1"
-	userv1 "github.com/openshift/api/user/v1"
-	appsv1client "github.com/openshift/client-go/apps/clientset/versioned"
-	authorizationv1client "github.com/openshift/client-go/authorization/clientset/versioned"
-	buildv1client "github.com/openshift/client-go/build/clientset/versioned"
-	configv1client "github.com/openshift/client-go/config/clientset/versioned"
-	imagev1client "github.com/openshift/client-go/image/clientset/versioned"
-	oauthv1client "github.com/openshift/client-go/oauth/clientset/versioned"
-	operatorv1client "github.com/openshift/client-go/operator/clientset/versioned"
-	projectv1client "github.com/openshift/client-go/project/clientset/versioned"
-	quotav1client "github.com/openshift/client-go/quota/clientset/versioned"
-	routev1client "github.com/openshift/client-go/route/clientset/versioned"
-	securityv1client "github.com/openshift/client-go/security/clientset/versioned"
-	templatev1client "github.com/openshift/client-go/template/clientset/versioned"
-	userv1client "github.com/openshift/client-go/user/clientset/versioned"
-	"github.com/openshift/library-go/test/library/metrics"
 	"github.com/pborman/uuid"
 	prometheusv1 "github.com/prometheus/client_golang/api/prometheus/v1"
 	yaml "gopkg.in/yaml.v2"
+
 	kubeauthorizationv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -62,8 +45,27 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	watchtools "k8s.io/client-go/tools/watch"
 	"k8s.io/client-go/util/flowcontrol"
+	"k8s.io/client-go/util/retry"
 	"k8s.io/kubernetes/test/e2e/framework"
 	admissionapi "k8s.io/pod-security-admission/api"
+
+	oauthv1 "github.com/openshift/api/oauth/v1"
+	projectv1 "github.com/openshift/api/project/v1"
+	userv1 "github.com/openshift/api/user/v1"
+	appsv1client "github.com/openshift/client-go/apps/clientset/versioned"
+	authorizationv1client "github.com/openshift/client-go/authorization/clientset/versioned"
+	buildv1client "github.com/openshift/client-go/build/clientset/versioned"
+	configv1client "github.com/openshift/client-go/config/clientset/versioned"
+	imagev1client "github.com/openshift/client-go/image/clientset/versioned"
+	oauthv1client "github.com/openshift/client-go/oauth/clientset/versioned"
+	operatorv1client "github.com/openshift/client-go/operator/clientset/versioned"
+	projectv1client "github.com/openshift/client-go/project/clientset/versioned"
+	quotav1client "github.com/openshift/client-go/quota/clientset/versioned"
+	routev1client "github.com/openshift/client-go/route/clientset/versioned"
+	securityv1client "github.com/openshift/client-go/security/clientset/versioned"
+	templatev1client "github.com/openshift/client-go/template/clientset/versioned"
+	userv1client "github.com/openshift/client-go/user/clientset/versioned"
+	"github.com/openshift/library-go/test/library/metrics"
 )
 
 // CLI provides function to call the OpenShift CLI and Kubernetes and OpenShift
@@ -306,7 +308,7 @@ func (c *CLI) SetupProject() string {
 			return err
 		}
 
-		if c.kubeFramework.NamespacePodSecurityEnforceLevel != "" {
+		if len(c.kubeFramework.NamespacePodSecurityEnforceLevel) == 0 {
 			// TODO(sur): set to restricted in a separate PR and fix failing tests
 			c.kubeFramework.NamespacePodSecurityEnforceLevel = admissionapi.LevelPrivileged
 		}