Update tests for k8s version policy to reflect new language in standard

Signed-off-by: Matthias Büchse <matthias.buechse@alasca.cloud>

Author: mbuechse

Tests/kaas/k8s-version-policy/k8s_version_policy.py

@@ -46,7 +46,8 @@
 
 MINOR_VERSION_CADENCE = timedelta(days=120)
 PATCH_VERSION_CADENCE = timedelta(days=31)
-CVE_VERSION_CADENCE = timedelta(days=2)
+CVE_VERSION_CADENCE = timedelta(weeks=2)
+CVE_VERSION_CADENCE_WARN = timedelta(days=2)
 CVE_SEVERITY = 8  # CRITICAL
 
 HERE = Path(__file__).parent
@@ -420,19 +421,19 @@ def check_k8s_version_recency(
             # whoops, the cluster should have been updated to this (or a higher version) already!
             return False
         ranges = [_range for _range in cve_affected_ranges if my_version in _range]
-        if ranges and release.age > CVE_VERSION_CADENCE:
-            # -- two FIXMEs:
-            # (a) if the release still has the CVE, then there is no use if we updated to it?
-            # (b) the standard says "time period MUST be even shorter ... it is RECOMMENDED that ...",
-            #     so what is it now, a requirement or a recommendation?
+        if ranges and release.age > CVE_VERSION_CADENCE_WARN:
+            # -- FIXME:
+            # if the release still has the CVE, then there is no use if we updated to it?
             # shouldn't we check for CVEs of my_version and then check whether the new one still has them?
             # -- so, this has to be reworked in a major way, but for the time being, just emit an INFO
             # (unfortunately, the cluster name is not available here)
-            logger.info(
+            logger.warning(
                 "Consider updating from %s to %s to avoid a CVE",
                 my_version,
                 release.version,
             )
+            if release.age > CVE_VERSION_CADENCE:
+                return False
     return True
 
 

Tests/kaas/k8s-version-policy/k8s_version_policy_test.py

@@ -65,8 +65,11 @@ def test_check_version_recency_with_cve(caplog, release_data):
         # 2 days after release of patch for affected_version
         dt.now.return_value = datetime(2024, 1, 20)
         assert check_k8s_version_recency(affected_version, release_data, fake_ranges)
-    assert len(caplog.records) == 1, "expected a log message"
-    assert caplog.records[0].levelname == "INFO"
+        # 2 weeks after the release
+        dt.now.return_value = datetime(2024, 2, 1)
+        assert not check_k8s_version_recency(affected_version, release_data, fake_ranges)
+    assert len(caplog.records) >= 1, "expected a log message"
+    assert caplog.records[0].levelname == "WARNING"
     assert "Consider updating from 1.28.5" in caplog.records[0].message