Skip to content

NO-ISSUE: Remove openshift/ e2e related to deprecated Servic… - #770

Closed
tmshort wants to merge 1 commit into
openshift:mainfrom
tmshort:disable-sa-tests
Closed

NO-ISSUE: Remove openshift/ e2e related to deprecated Servic…#770
tmshort wants to merge 1 commit into
openshift:mainfrom
tmshort:disable-sa-tests

Conversation

@tmshort

@tmshorttmshort commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

…eAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions

Summary by CodeRabbit

  • New Features

    • Enabled support for single-namespace operator installations and OpenShift service CA webhook certificates in experimental environments.
    • Added coverage for watching namespaces, own-namespace installations, successful upgrades, and version downgrades.
  • Bug Fixes

    • Updated experimental feature settings to prevent unsupported runtime and certificate providers from being enabled.
    • Removed obsolete preflight permission scenarios and outdated permission-related test configurations.
  • Tests

    • Updated installation and deployment validation scenarios to reflect the current ClusterExtension workflow.

…eAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions
Signed-off-by: Daniel Franz <dfranz@redhat.com>
@openshift-ci-robotopenshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 23, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@tmshort: This pull request explicitly references no jira issue.

Details

In response to this:

…eAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@tmshort

Copy link
Copy Markdown
ContributorAuthor

Alternative to the sync+removal PR #767

@coderabbitai

coderabbitaiBot commented Jul 23, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 84141795-8d68-4b33-b622-8f07fa81d539

📥 Commits

Reviewing files that changed from the base of the PR and between 186c9e6 and 89be801.

📒 Files selected for processing (48)
  • openshift/helm/experimental.yaml
  • openshift/operator-controller/manifests-experimental.yaml
  • openshift/tests-extension/.openshift-tests-extension/openshift_payload_olmv1.json
  • openshift/tests-extension/pkg/bindata/qe/bindata.go
  • openshift/tests-extension/pkg/helpers/cluster_extension.go
  • openshift/tests-extension/pkg/helpers/in_cluster_bundles.go
  • openshift/tests-extension/test/olmv1-deploymentconfig.go
  • openshift/tests-extension/test/olmv1-preflight.go
  • openshift/tests-extension/test/olmv1-singleownnamespace.go
  • openshift/tests-extension/test/qe/specs/olmv1_cc.go
  • openshift/tests-extension/test/qe/specs/olmv1_ce.go
  • openshift/tests-extension/test/qe/specs/olmv1_ce_deploymentconfig.go
  • openshift/tests-extension/test/qe/specs/olmv1_ce_watchns.go
  • openshift/tests-extension/test/qe/specs/olmv1_stress.go
  • openshift/tests-extension/test/qe/testdata/olm/binding-prefligth.yaml
  • openshift/tests-extension/test/qe/testdata/olm/binding-prefligth_multirole.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-watchns-config.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorExpressions-WithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorLableExpressions-WithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-OwnSingle.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutChannel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-inlineconfig.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-withoutChannel-OwnSingle.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutChannel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/prefligth-clusterrole.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-admin.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-bundle-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-bundle.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-clusterrole-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-clusterrole.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-rbac-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-rbac.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-limited-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-limited.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa.yaml
  • openshift/tests-extension/test/qe/util/olmv1util/clusterextension.go
  • openshift/tests-extension/test/qe/util/olmv1util/sa-clusterrolebinding.go
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/ce.yml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/clusterrole.yml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/clusterrolebinding.yml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/sa.yml
  • openshift/tests-extension/test/webhooks.go
💤 Files with no reviewable changes (37)
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-bundle-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-bundle.yaml
  • openshift/tests-extension/test/qe/testdata/olm/binding-prefligth.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa.yaml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/sa.yml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/ce.yml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/clusterrolebinding.yml
  • openshift/tests-extension/test/qe/testdata/olm/binding-prefligth_multirole.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-admin.yaml
  • openshift/tests-extension/test/qe/testdata/olm/prefligth-clusterrole.yaml
  • openshift/tests-extension/test/qe/util/stress/manifests/config/pkg-ins-v1/templates/clusterrole.yml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorLableExpressions-WithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-limited.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-clusterrole.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-rbac-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-clusterrole-boxcutter.yaml
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-insufficient-operand-rbac.yaml
  • openshift/tests-extension/test/qe/util/olmv1util/sa-clusterrolebinding.go
  • openshift/tests-extension/test/qe/testdata/olm/sa-nginx-limited-boxcutter.yaml
  • openshift/operator-controller/manifests-experimental.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-withoutChannel-OwnSingle.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-WithoutChannel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-OwnSingle.yaml
  • openshift/tests-extension/test/qe/util/olmv1util/clusterextension.go
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorlabel-inlineconfig.yaml
  • openshift/tests-extension/test/olmv1-preflight.go
  • openshift/helm/experimental.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-watchns-config.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutChannel.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutChannelVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextensionWithoutVersion.yaml
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension.yaml
  • openshift/tests-extension/.openshift-tests-extension/openshift_payload_olmv1.json
  • openshift/tests-extension/test/qe/testdata/olm/clusterextension-withselectorExpressions-WithoutChannelVersion.yaml

Walkthrough

Changes

The operator-controller experimental feature gates now enable own-namespace and OpenShift Service CA support while disabling CertManager and Boxcutter runtime features. OLMv1 helpers, templates, manifests, and tests remove explicit ServiceAccount/RBAC setup, and payload coverage shifts from preflight permission checks to installation, downgrade, upgrade, and watch-mode scenarios.

OLMv1 feature configuration

Layer / File(s)Summary
Feature-gate configuration
openshift/helm/experimental.yaml, openshift/operator-controller/manifests-experimental.yaml
Updates enabled and disabled operator-controller feature gates.
ClusterExtension construction contract
openshift/tests-extension/pkg/helpers/*, openshift/tests-extension/test/qe/util/olmv1util/*
Removes ServiceAccount parameters and RBAC helper APIs from ClusterExtension creation paths.
Template and embedded assets
openshift/tests-extension/test/qe/testdata/olm/*, openshift/tests-extension/pkg/bindata/qe/bindata.go
Removes SANAME and spec.serviceAccount from templates and embedded assets, including obsolete preflight bindings.
Test setup migration
openshift/tests-extension/test/*, openshift/tests-extension/test/qe/specs/*, openshift/tests-extension/test/webhooks.go
Removes ServiceAccount and ClusterRoleBinding provisioning, wiring, and cleanup across OLMv1 tests.
Payload scenario coverage
openshift/tests-extension/.openshift-tests-extension/openshift_payload_olmv1.json, openshift/tests-extension/test/qe/specs/olmv1_ce.go
Replaces permission scenarios with own-namespace, downgrade, upgrade, and updated disruption/install scenarios.

Estimated code review effort: 4 (Complex) | ~60 minutes

Suggested reviewers:dtfranz


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning, 1 inconclusive)

Check nameStatusExplanationResolution
Stable And Deterministic Test Names❌ Errorolmv1_ce.go and olmv1_stress.go use timeout-encoded test names ([Timeout:40m], [Timeout:330m]), which are overly specific and prone to churn.Rename those It() titles to static descriptions and keep timeout values in the test body/config instead of the title.
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check❓ InconclusiveThe title is only loosely descriptive and is truncated, so it does not clearly convey the main change.Use a concise, complete title that names the main change, e.g. removing OpenShift e2e tests tied to deprecated ServiceAccount usage.
✅ Passed checks (12 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Test Structure And Quality✅ PassedPASS: The changed Ginkgo tests use BeforeEach/DeferCleanup, explicit timeouts on all Eventually/Consistently waits, and focused per-It behavior; no cleanup or wait regressions found.
Microshift Test Compatibility✅ PassedThe added/changed QE Ginkgo suites all call SkipMicroshift in BeforeEach; the non-QE files are helper refactors, not new tests.
Single Node Openshift (Sno) Test Compatibility✅ PassedNew Ginkgo tests only create namespaces/ClusterExtensions and check install/version behavior; no multi-node/HA assumptions or SNO-sensitive scheduling logic found.
Topology-Aware Scheduling Compatibility✅ PassedDiffs only remove PreflightPermissions and SA/RBAC test wiring; no added/changed nodeSelector, affinity, topologySpreadConstraints, replicas, or PDBs.
Ote Binary Stdout Contract✅ PassedThe only process-level startup hook calls env.Init/InitClusterEnv/Image.InitializeImages; these use GinkgoWriter or stderr, and no stdout writes were found in main/init/suite setup.
Ipv6 And Disconnected Network Test Compatibility✅ PassedNo new IPv4-only IP handling or external internet calls were added; the changed e2e cases are cluster-local or already marked Skipped:Disconnected.
No-Weak-Crypto✅ PassedExact diff scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or non-constant-time secret comparisons; the changes only remove SA/RBAC test scaffolding.
Container-Privileges✅ PassedNo changed manifest adds privileged/host settings; the only securityContext found is allowPrivilegeEscalation: false with capabilities.drop: ALL.
No-Sensitive-Data-In-Logs✅ PassedPASS: The patch adds no new log calls with secrets/tokens; it only adds resource-name-only error text and removes SA/RBAC logging steps.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ciopenshift-ciBot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2026
@tmshort

Copy link
Copy Markdown
ContributorAuthor

/test unit

@tmshort

Copy link
Copy Markdown
ContributorAuthor

/retest

@openshift-ci

Copy link
Copy Markdown
Contributor

@tmshort: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test nameCommitDetailsRequiredRerun command
ci/prow/openshift-e2e-aws89be801linktrue/test openshift-e2e-aws
ci/prow/e2e-aws-upgrade-ovn-single-node89be801linkfalse/test e2e-aws-upgrade-ovn-single-node
ci/prow/openshift-e2e-aws-techpreview89be801linktrue/test openshift-e2e-aws-techpreview
ci/prow/e2e-aws-olmv1-ext89be801linktrue/test e2e-aws-olmv1-ext
ci/prow/e2e-aws-techpreview-olmv1-ext89be801linktrue/test e2e-aws-techpreview-olmv1-ext

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.jira/valid-referenceIndicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@tmshort@openshift-ci-robot@dtfranz