OCPBUGS-97603: Use framework-managed namespace for workload test by andfasano · Pull Request #31366 · openshift/origin

andfasano · 2026-07-03T17:06:22Z

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Summary by CodeRabbit

Tests
- Updated internal release image test setup to use a non-namespace-specific CLI and the framework-managed namespace.
- Simplified the test workflow by removing custom namespace creation, readiness polling for SCC UID-range annotation, and bespoke namespace deletion behavior.
- Improved project setup logic by further gating image-registry-related default secret/role-binding expectations based on the image registry operator’s management state (treating management state Removed as disabled).

openshift-merge-bot · 2026-07-03T17:06:25Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-07-03T17:06:29Z

@andfasano: This pull request references Jira Issue OCPBUGS-97603, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

andfasano · 2026-07-03T17:06:56Z

cc @bfournie

andfasano · 2026-07-03T17:07:07Z

/test ?

coderabbitai · 2026-07-03T17:07:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6e66a633-76c5-468d-aa7b-eea44c2dbf32

📥 Commits

Reviewing files that changed from the base of the PR and between 5a94570 and c140a0b.

📒 Files selected for processing (1)

test/extended/util/client.go

🚧 Files skipped from review as they are similar to previous changes (1)

test/extended/util/client.go

Walkthrough

The internal release image test now uses the framework namespace instead of creating a separate namespace, and project setup skips image-registry expectations when the registry operator is removed.

Changes

Internal release image test flow

Layer / File(s)	Summary
Helper cleanup `test/extended/internalreleaseimage/helper.go`	Removes `CreateSimpleNamespace` and `DeleteNamespace`, and drops now-unused imports.
Test namespace selection `test/extended/internalreleaseimage/internalreleaseimage.go`	Creates the CLI with `exutil.NewCLI("no-registry")` and uses `oc.Namespace()` for workload pod creation.
Registry capability gating `test/extended/util/client.go`	Checks the image registry operator management state and disables dockercfg-secret and role-binding expectations when it is `Removed`.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching the workload test to the framework-managed namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All Ginkgo titles in the touched tests are static strings; only runtime values were moved into bodies/logs, not titles.
Test Structure And Quality	✅ Passed	PASS: The new pod test uses framework-managed namespace cleanup, bounded waits, and labeled assertions; no new multi-behavior or cleanup regressions found.
Microshift Test Compatibility	✅ Passed	The added/modified Ginkgo It blocks all carry [apigroup:machineconfiguration.openshift.io], so MicroShift auto-skips them; no untagged test path was added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Modified InternalReleaseImage workload test only uses one pod in the framework namespace and has no multi-node/HA assumptions; no SNO-specific skip needed.
Topology-Aware Scheduling Compatibility	✅ Passed	Test-only namespace/registry setup changes; no new pod affinity, spread, nodeSelector, taints, PDB, or replica logic was introduced.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were introduced; the new logging uses framework/GinkgoWriter, and CLI construction only registers BeforeEach hooks.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The new workload test uses cluster-managed release images in the framework namespace and adds no IPv4 literals, IP parsing, or public internet access.
No-Weak-Crypto	✅ Passed	PR patch adds no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret-comparison code; only namespace and registry-setup test logic changed.
Container-Privileges	✅ Passed	No privileged settings were added; the pod uses restricted security contexts (runAsNonRoot, non-root UID, allowPrivilegeEscalation=false, drop ALL) and no manifests were changed.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only changes Outputs() in client.go; no new logs or sensitive fields are added anywhere in the commit.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-03T17:08:29Z

@andfasano: This pull request references Jira Issue OCPBUGS-97603, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Summary by CodeRabbit

Tests

Updated internal release image test setup to use the framework-managed namespace during cluster install checks.

Simplified test helper usage by removing custom namespace creation and cleanup steps.

Adjusted test logging to match the new namespace handling.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

andfasano · 2026-07-06T08:07:07Z

/test verify

openshift-merge-bot · 2026-07-06T14:54:51Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

bfournie · 2026-07-06T18:21:14Z

Testing this in an installed ISO_NO_REGISTRY cluster, I see a timeout waiting for the default SA

[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io]
  github.com/openshift/origin/test/extended/internalreleaseimage/internalreleaseimage.go:163
    STEP: Creating a kubernetes client @ 07/06/26 19:25:30.932
  I0706 19:25:30.933802   12058 discovery.go:214] Invalidating discovery information
  I0706 19:25:31.017313 12058 client.go:293] configPath is now "/tmp/configfile3685918507"
  I0706 19:25:31.017345 12058 client.go:368] The user is now "e2e-test-no-registry-fshvs-user"
  I0706 19:25:31.017355 12058 client.go:370] Creating project "e2e-test-no-registry-fshvs"
  I0706 19:25:31.106030 12058 client.go:378] Waiting on permissions in project "e2e-test-no-registry-fshvs" ...
  I0706 19:25:31.134728 12058 client.go:407] DeploymentConfig capability is enabled, adding 'deployer' SA to the list of default SAs
  I0706 19:25:31.140852 12058 client.go:422] Waiting for ServiceAccount "default" to be provisioned...
  I0706 19:25:31.249367 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...
  I0706 19:25:31.350374 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...

I tested a fix to test/extended/util/client.go to skip the default SA in test/extended/util/client.go

--- a/test/extended/util/client.go
+++ b/test/extended/util/client.go
@@ -409,10 +409,20 @@ func (c *CLI) setupProject() string {
                defaultRoleBindings = append(defaultRoleBindings, "system:deployers")
        }
 
-       // If image registry is not enabled set default service account and default role bindings to empty slice,
-       // the SA will not contain the docker secret and the role binding is not expected to be present.
-       imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
-       o.Expect(err).NotTo(o.HaveOccurred())
+        // If image registry is not enabled or its management state is Removed, set default service account
+        // and default role bindings to empty slice, as the SA will not contain the docker secret and the
+        // role binding is not expected to be present.
+        imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
+        o.Expect(err).NotTo(o.HaveOccurred())
+        if imageRegistryEnabled {
+                out, err := c.AsAdmin().Run("get").Args("configs.imageregistry.operator.openshift.io", "cluster", "-o", "jsonpath={.spec.managementState}").Output()
+                if err != nil {
+                        framework.Logf("Error checking image registry management state: %v", err)
+                } else if out == "Removed" {
+                        framework.Logf("Image registry management state is Removed, skipping dockercfg secret and role binding checks")
+                        imageRegistryEnabled = false
+                }
+        }

This worked...

  Ran 1 of 1 Specs in 6.906 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/parallel]",
    "lifecycle": "blocking",
    "duration": 6906,
    "startTime": "2026-07-06 18:03:58.022129 UTC",
    "endTime": "2026-07-06 18:04:04.928305 UTC",
    "result": "passed",

andfasano · 2026-07-07T11:31:39Z

Testing this in an installed ISO_NO_REGISTRY cluster, I see a timeout waiting for the default SA

[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io]
  github.com/openshift/origin/test/extended/internalreleaseimage/internalreleaseimage.go:163
    STEP: Creating a kubernetes client @ 07/06/26 19:25:30.932
  I0706 19:25:30.933802   12058 discovery.go:214] Invalidating discovery information
  I0706 19:25:31.017313 12058 client.go:293] configPath is now "/tmp/configfile3685918507"
  I0706 19:25:31.017345 12058 client.go:368] The user is now "e2e-test-no-registry-fshvs-user"
  I0706 19:25:31.017355 12058 client.go:370] Creating project "e2e-test-no-registry-fshvs"
  I0706 19:25:31.106030 12058 client.go:378] Waiting on permissions in project "e2e-test-no-registry-fshvs" ...
  I0706 19:25:31.134728 12058 client.go:407] DeploymentConfig capability is enabled, adding 'deployer' SA to the list of default SAs
  I0706 19:25:31.140852 12058 client.go:422] Waiting for ServiceAccount "default" to be provisioned...
  I0706 19:25:31.249367 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...
  I0706 19:25:31.350374 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...

I tested a fix to test/extended/util/client.go to skip the default SA in test/extended/util/client.go

--- a/test/extended/util/client.go
+++ b/test/extended/util/client.go
@@ -409,10 +409,20 @@ func (c *CLI) setupProject() string {
                defaultRoleBindings = append(defaultRoleBindings, "system:deployers")
        }
 
-       // If image registry is not enabled set default service account and default role bindings to empty slice,
-       // the SA will not contain the docker secret and the role binding is not expected to be present.
-       imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
-       o.Expect(err).NotTo(o.HaveOccurred())
+        // If image registry is not enabled or its management state is Removed, set default service account
+        // and default role bindings to empty slice, as the SA will not contain the docker secret and the
+        // role binding is not expected to be present.
+        imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
+        o.Expect(err).NotTo(o.HaveOccurred())
+        if imageRegistryEnabled {
+                out, err := c.AsAdmin().Run("get").Args("configs.imageregistry.operator.openshift.io", "cluster", "-o", "jsonpath={.spec.managementState}").Output()
+                if err != nil {
+                        framework.Logf("Error checking image registry management state: %v", err)
+                } else if out == "Removed" {
+                        framework.Logf("Image registry management state is Removed, skipping dockercfg secret and role binding checks")
+                        imageRegistryEnabled = false
+                }
+        }

This worked...

  Ran 1 of 1 Specs in 6.906 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/parallel]",
    "lifecycle": "blocking",
    "duration": 6906,
    "startTime": "2026-07-06 18:03:58.022129 UTC",
    "endTime": "2026-07-06 18:04:04.928305 UTC",
    "result": "passed",

Nice catch @bfournie ! Thanks for your suggestion, I've updated the code to reflect it. Can you please have another look?

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

test/extended/util/client.go (1)
415-425: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use the typed imageregistry client here imageregistry.NewForConfig(c.AdminConfig()).ImageregistryV1().Configs().Get(...).Spec.ManagementState avoids shelling out to oc get ... -o jsonpath for this check and removes the brittle string parsing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/extended/util/client.go` around lines 415 - 425, The image registry
management-state check is shelling out through c.AsAdmin().Run("get") and
parsing jsonpath output, which is brittle. Update the logic in client.go to use
the typed imageregistry client from
imageregistry.NewForConfig(c.AdminConfig()).ImageregistryV1().Configs().Get(...)
and read Spec.ManagementState directly, then keep the existing Removed handling
and logging around imageRegistryEnabled.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extended/util/client.go`:
- Around line 417-424: The image registry state check in client.go is using
c.AsAdmin().Run("get").Args(...).Output(), which can mix stderr into the result
and break the Removed comparison. Update this block to use Outputs() in the
image registryEnabled branch, then compare only the trimmed stdout against
"Removed" before clearing imageRegistryEnabled; keep the existing logging and
control flow around the check.

---

Nitpick comments:
In `@test/extended/util/client.go`:
- Around line 415-425: The image registry management-state check is shelling out
through c.AsAdmin().Run("get") and parsing jsonpath output, which is brittle.
Update the logic in client.go to use the typed imageregistry client from
imageregistry.NewForConfig(c.AdminConfig()).ImageregistryV1().Configs().Get(...)
and read Spec.ManagementState directly, then keep the existing Removed handling
and logging around imageRegistryEnabled.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a6c1af68-0f6b-451d-9076-f3afec4f15e8

📥 Commits

Reviewing files that changed from the base of the PR and between 3f61d95 and 5a94570.

📒 Files selected for processing (3)

test/extended/internalreleaseimage/helper.go
test/extended/internalreleaseimage/internalreleaseimage.go
test/extended/util/client.go

🚧 Files skipped from review as they are similar to previous changes (2)

test/extended/internalreleaseimage/internalreleaseimage.go
test/extended/internalreleaseimage/helper.go

openshift-merge-bot · 2026-07-07T12:39:03Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

andfasano · 2026-07-07T13:54:29Z

/retest-required

Co-authored-by: Bob Fournier <bfournie@redhat.com>

bfournie · 2026-07-07T16:17:49Z

/lgtm

openshift-ci · 2026-07-07T16:18:11Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: andfasano, bfournie
Once this PR has been reviewed and has the lgtm label, please assign dgoodwin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-07-07T16:24:38Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

openshift-ci · 2026-07-07T20:42:40Z

@andfasano: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-csi	`c140a0b`	link	true	`/test e2e-aws-csi`
ci/prow/e2e-aws-ovn-microshift-serial	`c140a0b`	link	true	`/test e2e-aws-ovn-microshift-serial`
ci/prow/e2e-metal-ipi-ovn-ipv6	`c140a0b`	link	true	`/test e2e-metal-ipi-ovn-ipv6`
ci/prow/e2e-gcp-ovn	`c140a0b`	link	true	`/test e2e-gcp-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

bfournie · 2026-07-07T23:32:56Z

/verified by @bfournie

openshift-ci-robot · 2026-07-07T23:33:08Z

@bfournie: This PR has been marked as verified by @bfournie.

Details

In response to this:

/verified by @bfournie

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 3, 2026

openshift-ci Bot requested review from bfournie and zaneb July 3, 2026 17:06

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2026

andfasano force-pushed the fix-iri-setup branch from 8a824c0 to 3f61d95 Compare July 6, 2026 14:01

coderabbitai Bot approved these changes Jul 6, 2026

View reviewed changes

openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 6, 2026

use framework-managed namespace for workload test

5a94570

andfasano force-pushed the fix-iri-setup branch from 3f61d95 to 5a94570 Compare July 7, 2026 11:30

openshift-ci Bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 7, 2026

coderabbitai Bot requested changes Jul 7, 2026

View reviewed changes

Comment thread test/extended/util/client.go

bfournie reviewed Jul 7, 2026

View reviewed changes

Comment thread test/extended/util/client.go Outdated

Update test/extended/util/client.go

c140a0b

Co-authored-by: Bob Fournier <bfournie@redhat.com>

coderabbitai Bot approved these changes Jul 7, 2026

View reviewed changes

openshift-ci Bot assigned bfournie Jul 7, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 7, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 7, 2026

Uh oh!

Conversation

andfasano commented Jul 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 3, 2026

Uh oh!

openshift-ci-robot commented Jul 3, 2026

Uh oh!

andfasano commented Jul 3, 2026

Uh oh!

andfasano commented Jul 3, 2026

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci-robot commented Jul 3, 2026

Summary by CodeRabbit

Uh oh!

andfasano commented Jul 6, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 6, 2026

Uh oh!

bfournie commented Jul 6, 2026

Uh oh!

andfasano commented Jul 7, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Jul 7, 2026

Uh oh!

andfasano commented Jul 7, 2026

Uh oh!

Uh oh!

bfournie commented Jul 7, 2026

Uh oh!

openshift-ci Bot commented Jul 7, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 7, 2026

Uh oh!

openshift-ci Bot commented Jul 7, 2026

Uh oh!

bfournie commented Jul 7, 2026

Uh oh!

openshift-ci-robot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andfasano commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading