Add logs and e2e test cases

Signed-off-by: Nont <nont@duck.com>

Author: Nont

cmd/hubagent/main.go

@@ -196,11 +196,6 @@ func main() {
 		exitWithErrorFunc()
 	}
 
-	if err := managedresource.EnsureVAP(ctx, mgr.GetClient(), true); err != nil {
-		klog.Errorf("unable to create managed resource validating admission policy: %s", err)
-		exitWithErrorFunc()
-	}
-
 	// +kubebuilder:scaffold:builder
 
 	wg.Add(1)
@@ -216,6 +211,18 @@ func main() {
 		klog.InfoS("The controller manager has exited")
 	}()
 
+	// Wait for the cache to sync before creating managed resources
+	if !mgr.GetCache().WaitForCacheSync(ctx) {
+		klog.Error("failed to wait for cache sync")
+		exitWithErrorFunc()
+	}
+
+	if err := managedresource.EnsureVAP(ctx, mgr.GetClient(), true); err != nil {
+		klog.Errorf("unable to create managed resource validating admission policy: %s", err)
+		exitWithErrorFunc()
+	}
+	klog.Info("managed resource validating admission policy is successfully setup")
+
 	// Wait for the controller manager and the scheduler to exit.
 	wg.Wait()
 }

pkg/controllers/internalmembercluster/v1beta1/member_controller.go

@@ -217,6 +217,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		if err := managedresource.EnsureVAP(ctx, r.memberClient, false); err != nil {
 			return ctrl.Result{}, err
 		}
+		klog.V(2).InfoS("Successfully installed managed resource validating admission policy")
 		if err := r.startAgents(ctx, &imc); err != nil {
 			return ctrl.Result{}, err
 		}
@@ -249,6 +250,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		if err := managedresource.EnsureNoVAP(ctx, r.memberClient, false); err != nil {
 			return ctrl.Result{}, err
 		}
+		klog.V(2).InfoS("Successfully uninstalled managed resource validating admission policy")
 		if err := r.stopAgents(ctx, &imc); err != nil {
 			return ctrl.Result{}, err
 		}

test/e2e/managed_resource_vap_test.go

@@ -29,6 +29,7 @@ import (
 	k8sErrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	placementv1beta1 "go.goms.io/fleet/apis/placement/v1beta1"
 )
@@ -126,14 +127,43 @@ func expectDeniedByVAP(err error) {
 	), "Error should indicate policy violation")
 }
 
-var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("managedresource"), Ordered, func() {
-	It("The VAP and its binding should exist", func() {
-		var vap admissionregistrationv1.ValidatingAdmissionPolicy
-		Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).Should(Succeed(), "ValidatingAdmissionPolicy should be installed")
+func checkVAPAndBindingExistence(client client.Client) {
+	By(fmt.Sprintf("Checking existence of ValidatingAdmissionPolicy: %s", vapName))
+	var vap admissionregistrationv1.ValidatingAdmissionPolicy
+	Expect(client.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).To(Succeed(),
+		fmt.Sprintf("ValidatingAdmissionPolicy %s should exist", vapName))
 
-		var vapBinding admissionregistrationv1.ValidatingAdmissionPolicyBinding
-		Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vapBinding)).Should(Succeed(), "ValidatingAdmissionPolicyBinding should be installed")
-	})
+	By(fmt.Sprintf("Checking existence of ValidatingAdmissionPolicyBinding: %s", vapName))
+	var vapBinding admissionregistrationv1.ValidatingAdmissionPolicyBinding
+	Expect(client.Get(ctx, types.NamespacedName{Name: vapName}, &vapBinding)).To(Succeed(),
+		fmt.Sprintf("ValidatingAdmissionPolicyBinding %s should exist", vapName))
+
+	By("Verifying VAP has validations configured")
+	Expect(vap.Spec.Validations).ToNot(BeEmpty(), "VAP should have validation rules")
+
+	By("Verifying VAP binding references the correct policy")
+	Expect(vapBinding.Spec.PolicyName).To(Equal(vapName),
+		fmt.Sprintf("VAP binding should reference policy %s", vapName))
+
+	By("Verifying VAP binding has validation actions configured")
+	Expect(vapBinding.Spec.ValidationActions).ToNot(BeEmpty(), "VAP binding should have validation actions")
+}
+
+func checkVAPAndBindingAbsence(client client.Client) {
+	By(fmt.Sprintf("Checking absence of ValidatingAdmissionPolicy: %s", vapName))
+	var vap admissionregistrationv1.ValidatingAdmissionPolicy
+	err := client.Get(ctx, types.NamespacedName{Name: vapName}, &vap)
+	Expect(k8sErrors.IsNotFound(err)).To(BeTrue(),
+		fmt.Sprintf("ValidatingAdmissionPolicy %s should not exist", vapName))
+
+	By(fmt.Sprintf("Checking absence of ValidatingAdmissionPolicyBinding: %s", vapName))
+	var vapBinding admissionregistrationv1.ValidatingAdmissionPolicyBinding
+	err = client.Get(ctx, types.NamespacedName{Name: vapName}, &vapBinding)
+	Expect(k8sErrors.IsNotFound(err)).To(BeTrue(),
+		fmt.Sprintf("ValidatingAdmissionPolicyBinding %s should not exist", vapName))
+}
+
+var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("managedresource"), Ordered, func() {
 
 	It("should allow operations on unmanaged namespace for non-system:masters user", func() {
 		unmanagedNS := createUnmanagedNamespace("test-unmanaged-ns")

test/e2e/setup_test.go

@@ -380,6 +380,9 @@ func beforeSuiteForAllProcesses() {
 		_, err := os.Stat(fleetBinaryPath)
 		Expect(os.IsNotExist(err)).To(BeFalse(), fmt.Sprintf("kubectl-fleet binary not found at %s", fleetBinaryPath))
 	})
+
+	// Expect that the managedResource VAP and its binding to exist when hub starts
+	checkVAPAndBindingExistence(hubClient)
 }
 
 func maxDuration(a, b time.Duration) time.Duration {
@@ -394,6 +397,10 @@ func beforeSuiteForProcess1() {
 
 	setAllMemberClustersToJoin()
 	checkIfAllMemberClustersHaveJoined()
+	for _, c := range allMemberClusters {
+		checkVAPAndBindingExistence(c.KubeClient)
+	}
+
 	checkIfAzurePropertyProviderIsWorking()
 
 	// Simulate that member cluster 4 become unhealthy, and member cluster 5 has left the fleet.
@@ -411,5 +418,8 @@ var _ = SynchronizedAfterSuite(func() {}, func() {
 	deleteTestResourceCRD()
 	setAllMemberClustersToLeave()
 	checkIfAllMemberClustersHaveLeft()
+	for _, c := range allMemberClusters {
+		checkVAPAndBindingAbsence(c.KubeClient)
+	}
 	cleanupInvalidClusters()
 })