cluster-ingress-operator: add conformance tests to upgrade presubmit

[redhat-chai-bot]

Summary

Add conformance tests to the e2e-aws-ovn-upgrade presubmit for cluster-ingress-operator on master, release-5.0, and release-4.23 branches.

Problem

The e2e-aws-ovn-upgrade presubmit uses the openshift-upgrade-aws workflow which sets TEST_TYPE: upgrade. This only performs the upgrade itself without running conformance tests afterward. This gap allowed a regression from PR #1456 (sail-operator library from OSSM 3.4) to slip through pre-submit testing — the GatewayAPIController test dropped from 99% to 20% pass rate, which was only caught by payload verification jobs after merge.

Fix

Override TEST_TYPE to upgrade-conformance in the ci-operator config for the e2e-aws-ovn-upgrade job. The openshift-e2e-test step already supports this mode — it performs the upgrade and then executes the full conformance suite.

Changes

• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml
• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml

All changes validated with make ci-operator-config and make jobs.

Context

Requested in #forum-ocp-release-oversight by the networking team and TRT.

---

@neisw requested in Slack thread

Summary by CodeRabbit

Updates the cluster-ingress-operator upgrade presubmit jobs on master, release-5.0, and release-4.23 to use TEST_TYPE: upgrade-conformance. These jobs now run the upgrade followed by the full conformance suite, closing the previous upgrade-only testing gap.

Validated with make ci-operator-config and make jobs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1ee5d6cf-7693-4664-9f31-a7a09a429b5e

📥 Commits

Reviewing files that changed from the base of the PR and between 98b5d56 and 4b2ee70.

📒 Files selected for processing (3)

• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml
• ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml

---

Walkthrough

Changes

Upgrade conformance configuration

Layer / File(s)	Summary
Configure upgrade conformance test type ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-{master,release-4.23,release-5.0}.yaml	The e2e-aws-ovn-upgrade job now sets TEST_TYPE to upgrade-conformance in all three configurations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: dlaw4608

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the change: adding conformance tests to the upgrade presubmit for cluster-ingress-operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes ci-operator YAML to set TEST_TYPE; no Ginkgo test titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes ci-operator YAML; no Ginkgo test code was modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only ci-operator YAML changed; no new Ginkgo e2e tests or test code were added, so MicroShift API compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only ci-operator YAML changed to set TEST_TYPE; no Ginkgo e2e test code was added or modified, so SNO review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI job TEST_TYPE changed; no manifests, replicas, affinity, nodeSelectors, or topology constraints were added.
Ote Binary Stdout Contract	✅ Passed	PR only changes ci-operator YAML to set TEST_TYPE=upgrade-conformance; no process-level code or stdout-writing binaries were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only ci-operator YAML was changed to set TEST_TYPE=upgrade-conformance; no new Ginkgo tests or network code were added.
No-Weak-Crypto	✅ Passed	Touched files only add TEST_TYPE: upgrade-conformance in ci-operator YAML; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto logic found.
Container-Privileges	✅ Passed	The PR only adds TEST_TYPE: upgrade-conformance to three ci-operator YAML jobs; no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings are present.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds TEST_TYPE: upgrade-conformance to three CI config jobs; no new logging or sensitive data exposure was introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign bentito for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/cluster-ingress-operator/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@redhat-chai-bot: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-cluster-ingress-operator-release-5.0-e2e-aws-ovn-upgrade	openshift/cluster-ingress-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-upgrade	openshift/cluster-ingress-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-ingress-operator-release-4.23-e2e-aws-ovn-upgrade	openshift/cluster-ingress-operator	presubmit	Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[gcs278]

/assign

[gcs278]

/pj-rehearse

[openshift-merge-bot]

@gcs278: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/cluster-ingress-operator/master/e2e-aws-ovn-upgrade	4b2ee70	link	unknown	/pj-rehearse pull-ci-openshift-cluster-ingress-operator-master-e2e-aws-ovn-upgrade
ci/rehearse/openshift/cluster-ingress-operator/release-5.0/e2e-aws-ovn-upgrade	4b2ee70	link	unknown	/pj-rehearse pull-ci-openshift-cluster-ingress-operator-release-5.0-e2e-aws-ovn-upgrade
ci/rehearse/openshift/cluster-ingress-operator/release-4.23/e2e-aws-ovn-upgrade	4b2ee70	link	unknown	/pj-rehearse pull-ci-openshift-cluster-ingress-operator-release-4.23-e2e-aws-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.