exec: /Users/rohit/Documents/chart-test-swarm/examples/sample-product-chart/chart-test/assertions/opa-gatekeeper-required-labels.sh (RELEASE=sample NAMESPACE=sample)
=== OPA Gatekeeper: Required Labels ===
==> Phase 0: Wait for gatekeeper controller + nginx ingress pods Ready
pod/gatekeeper-controller-manager-64bbbfbdbb-2w26g condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-7mdnf condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-vhrnr condition met
PASS: gatekeeper controller Ready
pod/ingress-nginx-controller-d74c658c5-4bwmn condition met
PASS: nginx ingress controller Ready
pod/sample-69469cb4c6-x26cz condition met
PASS: product pod Ready
==> Phase 1: Verify ConstraintTemplate applied
Waiting for ConstraintTemplate k8srequiredlabels to reconcile (60s max)...
PASS: observedGeneration (1) >= generation (1) at attempt 1
==> Wait for CRD Established (90s max)
customresourcedefinition.apiextensions.k8s.io/k8srequiredlabels.constraints.gatekeeper.sh condition met
PASS: CRD k8srequiredlabels.constraints.gatekeeper.sh Established=True
==> Apply Constraint
k8srequiredlabels.constraints.gatekeeper.sh/require-app-name-label created
PASS: K8sRequiredLabels constraint applied
==> Phase 2a: Non-compliant Deployment (missing app.kubernetes.io/name)
Error from server (Forbidden): error when creating "/Users/rohit/Documents/chart-test-swarm/examples/sample-product-chart/chart-test/fixtures/policy/test-deploy-noncompliant-labels.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [require-app-name-label] Missing required label(s): {"app.kubernetes.io/name"}
PASS: non-compliant Deployment rejected (missing required label)
==> Phase 2b: Compliant Deployment (has app.kubernetes.io/name)
deployment.apps/test-compliant created (server dry run)
PASS: compliant Deployment accepted
==> Phase 3a: Non-compliant Ingress (missing app.kubernetes.io/name)
Error from server (Forbidden): error when creating "/Users/rohit/Documents/chart-test-swarm/examples/sample-product-chart/chart-test/fixtures/policy/test-ingress-noncompliant.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [require-app-name-label] Missing required label(s): {"app.kubernetes.io/name"}
PASS: non-compliant Ingress rejected (missing required label)
==> Phase 3b: Compliant Ingress (has app.kubernetes.io/name)
ingress.networking.k8s.io/test-compliant-ingress created
PASS: compliant Ingress applied
NOTE: compliant Ingress may not yet have address (NGINX controller processes async)
==> Phase 4: Webhook failure mode — verify Fail policy + outage behavior
PASS: webhook gatekeeper-validating-webhook-configuration failurePolicy=Fail
Scaling gatekeeper-controller-manager to 0 in gatekeeper-system (original replicas: 3)...
deployment.apps/gatekeeper-controller-manager scaled
pod/gatekeeper-controller-manager-64bbbfbdbb-2w26g condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-7mdnf condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-vhrnr condition met
PASS: gatekeeper controller scaled to 0
Attempting kubectl apply with webhook unavailable...
Error from server (InternalError): error when creating "/Users/rohit/Documents/chart-test-swarm/examples/sample-product-chart/chart-test/fixtures/policy/test-deploy-compliant.yaml": Internal error occurred: failed calling webhook "validation.gatekeeper.sh": failed to call webhook: Post "https://gatekeeper-webhook-service.gatekeeper-system.svc:443/v1/admit?timeout=3s": dial tcp 10.96.151.238:443: connect: connection refused
PASS: admission correctly blocked during webhook outage (Fail policy)
Restoring gatekeeper-controller-manager to 3 in gatekeeper-system...
deployment.apps/gatekeeper-controller-manager scaled
Waiting for gatekeeper controller pods to be Ready again...
pod/gatekeeper-controller-manager-64bbbfbdbb-8258d condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-ldqpb condition met
pod/gatekeeper-controller-manager-64bbbfbdbb-m5qxb condition met
PASS: gatekeeper controller pods Ready
Waiting for admission webhook to accept requests (180s max, may be slow on resource-constrained clusters)...
endpoints "gatekeeper-webhook-service" deleted from gatekeeper-system namespace
FAIL: admission still failing after controller restore (36 attempts, 180s)