added more tests which are ok to fail.

Author: guettli

Tests/kaas/sonobuoy_handler/sonobuoy_handler.py

@@ -147,14 +147,50 @@ def sonobuoy_parse_result(plugin, sonobuoy_results_yaml_path):
 
 def ok_to_fail(test_name):
     # TODO: Make this configurable
-    regexs = [
-        "HostPort validates that there is no conflict between pods with same hostPort but different hostIP and protocol",
-        "Services should be able to switch session affinity for NodePort service",
-        "Services should have session affinity work for NodePort service",
-        "validates that there exists conflict between pods with same hostPort and protocol but one using 0.0.0.0 hostIP",
+    regexs_and_reason = [
+        # InternalIP still used in tests. Having only an ExternalIP is considered valid by SCS:
+        (
+            "HostPort validates that there is no conflict between pods with same hostPort but different hostIP and protocol",
+            "Fails when a cluster has no InternalIP (only ExternalIP): https://github.com/kubernetes/kubernetes/issues/136626",
+        ),
+        (
+            "Services should be able to switch session affinity for NodePort service",
+            "Fails when a cluster has no InternalIP (only ExternalIP): https://github.com/kubernetes/kubernetes/issues/136626",
+        ),
+        (
+            "Services should have session affinity work for NodePort service",
+            "Fails when a cluster has no InternalIP (only ExternalIP): https://github.com/kubernetes/kubernetes/issues/136626",
+        ),
+        (
+            "validates that there exists conflict between pods with same hostPort and protocol but one using 0.0.0.0 hostIP",
+            "Fails when a cluster has no InternalIP (only ExternalIP): https://github.com/kubernetes/kubernetes/issues/136626",
+        ),
+        # Was flaky
+        (
+            "Netpol NetworkPolicy between server and client should allow ingress access from updated namespace",
+            "Flaky test. Fix in v1.36 (https://github.com/kubernetes/kubernetes/pull/136715)",
+        ),
+        # SCTP is optional
+        (
+            "Feature:SCTPConnectivity",
+            "SCTPConnectivity is optional. Currently Cilium does not support it by default.",
+        ),
+        # Tests skipped by Cilium: https://github.com/cilium/cilium/blob/main/.github/workflows/k8s-kind-network-policies-e2e.yaml#L177-L185
+        (
+            "should.allow.egress.access.to.server.in.CIDR.block",
+            "https://github.com/cilium/cilium/issues/9209",
+        ),
+        (
+            "should.ensure.an.IP.overlapping.both.IPBlock.CIDR.and.IPBlock.Except.is.allowed",
+            "https://github.com/cilium/cilium/issues/9209",
+        ),
+        (
+            "should.enforce.except.clause.while.egress.access.to.server.in.CIDR.block",
+            "https://github.com/cilium/cilium/issues/9209",
+        ),
     ]
     name = test_name
-    for regex in regexs:
+    for regex, _reason in regexs_and_reason:
         if re.search(regex, name):
             return True
     return False