(HOLD) OPRUN-3941: Add webhook tests with enhancements and fixes #430

camilamacedo86 · 2025-08-13T08:20:15Z

From: #434
- Skips the test that is failing. We will fix it in a follow-up. We need #436 in the payload.
- Add dumping of container logs and kubectl describe pods output for better diagnostics.
- Include targeted certificate details dump (tls.crt parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor with fixes of the code from openshift/origin#30059.

/payload-aggregate periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial 10

Testhing with payload and GCP to ensure that the error: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-shiftstack-ci-release-4.20-techpreview-e2e-openstack-ovn-serial-techpreview/1955816149002227712

Will not be faced

openshift-ci · 2025-08-13T08:20:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: camilamacedo86
Once this PR has been reviewed and has the lgtm label, please assign oceanc80 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift/tests-extension/pkg/helpers/pod_logs.go

openshift-ci-robot · 2025-08-13T10:25:24Z

@camilamacedo86: This pull request references OPRUN-3941 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.20.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

anik120 · 2025-08-13T14:24:02Z

openshift/tests-extension/test/webhooks.go

 	Group:    "webhook.operators.coreos.io",
 	Version:  "v2",
 	Resource: "webhooktests",
 }

-func newWebhookTestV1(name, namespace string, valid bool) *unstructured.Unstructured {
+func newWebhookTest(name, namespace string, valid bool) *unstructured.Unstructured {


Again, this is not anything major at all, it was just bothering me that this function returns a webhook, so that we can use that in our tests, so newTestWebhook seems more of an appropriate name, than newWebhookTest. newWebhookTest means this is a test itself, which it is not.

the common standard is New<StructName|Kind|Class>
In this case, the kind inside of the sample/project that we use to do the test is "kind": "WebhookTest",
so, therefore, make sense newWebhookTest

we are asking for a NEW struct of WebhookTest

See your orginal test: https://github.com/openshift/origin/pull/30059/files#diff-6dd6fa78ac85235012d3c9910f8510bc1640c830a83888681bd5922cec0dffcbR332-R341

openshift/tests-extension/pkg/helpers/pod_logs.go

anik120 · 2025-08-13T14:25:55Z

openshift/tests-extension/pkg/helpers/pod_logs.go

+	fmt.Fprintf(GinkgoWriter, "\n[pod-logs] namespace=%s\n", namespace)
+
+	By("Getting all pods in the namespace")
+	namesOut, err := RunK8sCommand(ctx, "get", "pods", "-n", namespace, "-o", "name")


Do we need a cli tool (kubectl/oc) to get pod logs? Can't we just use controller runtime client to get all the pods?

QE tests will need to use the CLI so here we add the helper already for them
And in this case is more cleaner the code with oc/kubectl then with the API
I mean, the code is KISS. Otherwise, we need add more extra deps

tmshort · 2025-08-13T19:25:22Z

/test openshift-e2e-aws

camilamacedo86 · 2025-08-13T23:08:22Z

/test openshift-e2e-aws

openshift/tests-extension/pkg/helpers/commands.go

openshift/tests-extension/test/olmv1-incompatible.go

openshift-ci · 2025-08-15T16:47:25Z

@camilamacedo86: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/84478cd0-79f7-11f0-868c-f17f1c5c9461-0

tmshort · 2025-08-15T17:17:46Z

Test #436 is a cert fix for our upstream-e2e, and has nothing to do with OTE, so I'm not sure why you're referencing it?

camilamacedo86 · 2025-08-15T17:20:14Z

/hold

camilamacedo86 · 2025-08-15T17:24:05Z

Test #436 is a cert fix for our upstream-e2e, and has nothing to do with OTE, so I'm not sure why you're referencing it?

Because the test that we faced issues in Sippy is should be tolerant to openshift-service-ca certificate rotation ( techpreview ), we deleted the secret, and we expect that it will be re-created and be valid.

Therefore, I wanted to test it with your PR.
Anyway, see: https://redhat-internal.slack.com/archives/C06KP34REFJ/p1755276543066359?thread_ts=1755273190.823239&cid=C06KP34REFJ

camilamacedo86 · 2025-08-16T08:04:20Z

/payload-aggregate periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial 10

openshift-ci · 2025-08-16T08:04:58Z

@camilamacedo86: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/9db3f980-7a77-11f0-9317-77fddb6f96d1-0

camilamacedo86 · 2025-08-17T21:32:16Z

/test openshift-e2e-aws

camilamacedo86 · 2025-08-18T06:04:37Z

/payload-aggregate periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial 10

(we need check if after the cert-fix it is either fixed)

openshift-ci · 2025-08-18T06:04:39Z

@camilamacedo86: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/389f9120-7bf9-11f0-8801-38b19603745e-0

… certificate rotation This change is a refactor of code from openshift/origin#30059. Assisted-by: Gemini

openshift-ci-robot · 2025-08-19T23:13:35Z

@camilamacedo86: This pull request references Jira Issue OCPBUGS-60564, which is invalid:

expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

From: #434

Skips the test that is failing. We will fix it in a follow-up. We need NO-ISSUE: Handle service-ca cert availability/rotation #436 in the payload.

Add dumping of container logs and kubectl describe pods output for better diagnostics.

Include targeted certificate details dump (tls.crt parse) when failures occur.

Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor with fixes of the code from openshift/origin#30059.

/payload-aggregate periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial 10

Testhing with payload and GCP to ensure that the error: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-shiftstack-ci-release-4.20-techpreview-e2e-openstack-ovn-serial-techpreview/1955816149002227712

Will not be faced

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-08-19T23:15:58Z

@camilamacedo86: This pull request references OPRUN-3941 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.20.0" version, but no target version was set.

In response to this:

From: #434

Skips the test that is failing. We will fix it in a follow-up. We need NO-ISSUE: Handle service-ca cert availability/rotation #436 in the payload.

Add dumping of container logs and kubectl describe pods output for better diagnostics.

Include targeted certificate details dump (tls.crt parse) when failures occur.

Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor with fixes of the code from openshift/origin#30059.

/payload-aggregate periodic-ci-openshift-release-master-ci-4.20-e2e-gcp-ovn-techpreview-serial 10

Testhing with payload and GCP to ensure that the error: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-shiftstack-ci-release-4.20-techpreview-e2e-openstack-ovn-serial-techpreview/1955816149002227712

Will not be faced

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

camilamacedo86 · 2025-08-19T23:16:39Z

Closing I will open a new PR to faciliate the review and analise with the test that we do not add due the issues faced, more info: https://redhat-internal.slack.com/archives/C06KP34REFJ/p1755607157127779?thread_ts=1755602572.169319&cid=C06KP34REFJ

openshift-ci bot requested review from LalatenduMohanty and perdasilva August 13, 2025 08:20

camilamacedo86 changed the title ~~[OTE] simplify webhook tests, improve names and logs~~ WIP: [OTE] simplify webhook tests, improve names and logs Aug 13, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2025

camilamacedo86 force-pushed the follow-up-enhance-ote branch 3 times, most recently from 158497e to 44e43f7 Compare August 13, 2025 09:48

camilamacedo86 commented Aug 13, 2025

View reviewed changes

openshift/tests-extension/pkg/helpers/pod_logs.go Outdated Show resolved Hide resolved

camilamacedo86 force-pushed the follow-up-enhance-ote branch from 44e43f7 to 9385026 Compare August 13, 2025 10:22

camilamacedo86 changed the title ~~WIP: [OTE] simplify webhook tests, improve names and logs~~ OPRUN-3941: [OTE] simplify webhook tests, improve names and logs Aug 13, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 13, 2025

anik120 suggested changes Aug 13, 2025

View reviewed changes

openshift-ci bot assigned anik120 Aug 13, 2025

camilamacedo86 force-pushed the follow-up-enhance-ote branch from 9385026 to 8e962e9 Compare August 13, 2025 14:59

camilamacedo86 requested a review from anik120 August 13, 2025 15:38