Skip to content

CNTRLPLANE-3033:test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite#332

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
wangke19:ote-migrate-ca-bundle-update
Mar 19, 2026
Merged

CNTRLPLANE-3033:test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite#332
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
wangke19:ote-migrate-ca-bundle-update

Conversation

@wangke19
Copy link
Copy Markdown
Contributor

@wangke19 wangke19 commented Mar 18, 2026

Summary

Migrate the apiservice-ca-bundle-injection test from an inline body in TestE2E (e2e_test.go) into a shared testAPIServiceCABundleInjection(testing.TB) function in e2e.go, enabling dual-mode execution via both the legacy go test path and the OTE Ginkgo framework.

Jira: https://redhat.atlassian.net/browse/CNTRLPLANE-3000

Changes

test/e2e/e2e.go

  • Add [Operator][Serial] Ginkgo context for apiservice-ca-bundle-injection
  • Add testAPIServiceCABundleInjection(testing.TB) shared implementation
  • Add pollForSigningCABundleTB and pollForAPIServiceTB TB-compatible poll helpers
  • Add required imports (apiregv1, apiserviceclient, apiserviceclientv1)

test/e2e/e2e_test.go

  • Replace inline test body with a call to testAPIServiceCABundleInjection and standard OTE migration NOTE comment
  • Remove now-unused pollForAPIService helper
  • Remove now-unused apiregv1, apiserviceclient, apiserviceclientv1 imports

Notes

This test is not disruptive (no CA rotation triggered), so it uses [Operator][Serial] without [Disruptive].

Test Plan

  • Verify test passes via legacy go test ./test/e2e/...
  • Verify test passes via OTE Ginkgo runner

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 18, 2026

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fc8e7ece-fbaf-4dae-8a39-961b28b2e055

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Removed inline APIService CA-bundle polling from test/e2e/e2e_test.go and delegated the flow to a new helper; added a serial Ginkgo test and helper pollers in test/e2e/e2e.go that create an annotated aggregated APIService, wait for CA bundle injection, intentionally corrupt spec.CABundle, and verify restoration by the operator.

Changes

Cohort / File(s) Summary
E2E test entrypoint
test/e2e/e2e_test.go
Removed the in-file pollForAPIService helper and kube-aggregator imports; refactored TestE2E to call testAPIServiceCABundleInjection for the apiservice-ca-bundle-injection subtest. Retained NOTE about temporary duplication with OTE framework.
E2E test implementations & helpers
test/e2e/e2e.go
Added a serial Ginkgo test apiservice-ca-bundle-injection; implemented testAPIServiceCABundleInjection to create an annotated aggregated APIService, poll for signing CA bundle injection, corrupt spec.CABundle, and poll for operator restoration. Added pollForSigningCABundleTB and pollForAPIServiceTB helper pollers and introduced kube-aggregator API types/clients for typed APIService operations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
📝 Coding Plan
  • Generate coding plan for human review comments

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from bertinatto and p0lyn0mial March 18, 2026 15:26
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 18, 2026
@wangke19 wangke19 force-pushed the ote-migrate-ca-bundle-update branch from 2b8b928 to a64dbd5 Compare March 19, 2026 05:58
@wangke19 wangke19 changed the title test/e2e: add OTE migration note for ca-bundle-injection-configmap-update test/e2e: migrate apiservice, crd, and webhook CA bundle injection tests to OTE Mar 19, 2026
@wangke19 wangke19 force-pushed the ote-migrate-ca-bundle-update branch from a64dbd5 to fc2f346 Compare March 19, 2026 06:12
@wangke19 wangke19 changed the title test/e2e: migrate apiservice, crd, and webhook CA bundle injection tests to OTE test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite Mar 19, 2026
@wangke19 wangke19 force-pushed the ote-migrate-ca-bundle-update branch from fc2f346 to aada6d6 Compare March 19, 2026 08:20
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/e2e/e2e.go`:
- Around line 1875-1881: Replace panic-style client construction with explicit
error handling: change apiserviceclient.NewForConfigOrDie(adminConfig) to
apiserviceclient.NewForConfig(adminConfig), check the returned error and call
t.Fatalf("error creating APIService client: %v", err) if non-nil before using
.ApiregistrationV1().APIServices(); do the same in the other occurrence where
apiextclient.NewForConfigOrDie(...) is used (replace with
apiextclient.NewForConfig(...) and t.Fatalf on error) so client creation follows
the prior getKubeClientAndConfig() error-handling pattern.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9d51dd26-0f12-490b-a13a-41deb1809b7a

📥 Commits

Reviewing files that changed from the base of the PR and between fc2f346 and aada6d6.

📒 Files selected for processing (2)
  • test/e2e/e2e.go
  • test/e2e/e2e_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/e2e/e2e_test.go

Comment thread test/e2e/e2e.go
@wangke19 wangke19 force-pushed the ote-migrate-ca-bundle-update branch from aada6d6 to 28be6b6 Compare March 19, 2026 08:33
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/e2e/e2e.go`:
- Around line 1925-1929: The Update of the APIService (client.Update called on
injectedObj) can 409 due to concurrent kube-aggregator reconciliation; wrap the
mutate+update in retry.RetryOnConflict, and inside the retry closure re-fetch
the latest object (client.Get with context.TODO and metav1.GetOptions), modify
injectedObj.Spec.CABundle (append the invalid bytes) and then call
client.Update; this ensures you always operate on the latest resourceVersion and
retry on conflicts.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9c0ab820-219b-497a-b292-c9986de38398

📥 Commits

Reviewing files that changed from the base of the PR and between aada6d6 and 28be6b6.

📒 Files selected for processing (2)
  • test/e2e/e2e.go
  • test/e2e/e2e_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/e2e/e2e_test.go

Comment thread test/e2e/e2e.go
Extract the apiservice-ca-bundle-injection test from TestE2E in
e2e_test.go into a shared testAPIServiceCABundleInjection(testing.TB)
function in e2e.go, enabling dual-mode execution via both the legacy
go test path and the OTE Ginkgo framework.

- Add testAPIServiceCABundleInjection in e2e.go using testing.TB
- Add pollForSigningCABundleTB and pollForAPIServiceTB helpers in
  e2e.go using pollForResourceGinkgo for Ginkgo compatibility
- Add [Operator][Serial] Ginkgo context in e2e.go
- Add required imports (apiregv1, apiserviceclient, apiserviceclientv1)
  to e2e.go
- Replace inline test body in e2e_test.go with a call to the shared
  function and add the standard OTE migration NOTE comment
- Remove now-unused pollForAPIService helper from e2e_test.go
- Remove now-unused apiregv1, apiserviceclient, apiserviceclientv1
  imports from e2e_test.go

This test is not disruptive (no CA rotation triggered) so it uses the
[Operator][Serial] label without [Disruptive].

Jira: https://redhat.atlassian.net/browse/CNTRLPLANE-3000
@wangke19 wangke19 force-pushed the ote-migrate-ca-bundle-update branch from 28be6b6 to 6e2bf9e Compare March 19, 2026 10:35
@wangke19
Copy link
Copy Markdown
Contributor Author

/retest

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 19, 2026

@wangke19: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@wangke19
Copy link
Copy Markdown
Contributor Author

/verified by CI

@gangwgr
Copy link
Copy Markdown

gangwgr commented Mar 19, 2026

/lgtm

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 19, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@wangke19: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@wangke19 wangke19 changed the title test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite CNTRLPLANE-3033:test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite Mar 19, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 19, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Mar 19, 2026

@wangke19: This pull request references CNTRLPLANE-3033 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Migrate the apiservice-ca-bundle-injection test from an inline body in TestE2E (e2e_test.go) into a shared testAPIServiceCABundleInjection(testing.TB) function in e2e.go, enabling dual-mode execution via both the legacy go test path and the OTE Ginkgo framework.

Jira: https://redhat.atlassian.net/browse/CNTRLPLANE-3000

Changes

test/e2e/e2e.go

  • Add [Operator][Serial] Ginkgo context for apiservice-ca-bundle-injection
  • Add testAPIServiceCABundleInjection(testing.TB) shared implementation
  • Add pollForSigningCABundleTB and pollForAPIServiceTB TB-compatible poll helpers
  • Add required imports (apiregv1, apiserviceclient, apiserviceclientv1)

test/e2e/e2e_test.go

  • Replace inline test body with a call to testAPIServiceCABundleInjection and standard OTE migration NOTE comment
  • Remove now-unused pollForAPIService helper
  • Remove now-unused apiregv1, apiserviceclient, apiserviceclientv1 imports

Notes

This test is not disruptive (no CA rotation triggered), so it uses [Operator][Serial] without [Disruptive].

Test Plan

  • Verify test passes via legacy go test ./test/e2e/...
  • Verify test passes via OTE Ginkgo runner

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 19, 2026
@wangke19
Copy link
Copy Markdown
Contributor Author

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Mar 19, 2026

@wangke19: This pull request references CNTRLPLANE-3033 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 19, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gangwgr, wangke19

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot Bot merged commit 0a69686 into openshift:main Mar 19, 2026
12 checks passed
@wangke19 wangke19 deleted the ote-migrate-ca-bundle-update branch March 19, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants