Skip to content

CONSOLE-5209: Fix IngressComponentRouteLabels e2e tests for HCP compatibility - #31483

Open
jhadvig wants to merge 1 commit into
openshift:mainfrom
jhadvig:CONSOLE-5209-hcp-fix
Open

CONSOLE-5209: Fix IngressComponentRouteLabels e2e tests for HCP compatibility#31483
jhadvig wants to merge 1 commit into
openshift:mainfrom
jhadvig:CONSOLE-5209-hcp-fix

Conversation

@jhadvig

@jhadvig jhadvig commented Aug 4, 2026

Copy link
Copy Markdown
Member

Summary

  • Fix 5 serial e2e tests in test/extended/console/label_propagation.go that fail on HyperShift (HCP) clusters
  • On HCP, a ValidatingAdmissionPolicy blocks direct modification of ingresses.config.openshift.io/cluster on the guest cluster
  • Branch the mutation helpers to modify the HostedCluster CR's spec.configuration.ingress.componentRoutes via the management cluster dynamic client on HCP, while keeping the existing typed client path on standalone OCP
  • Follows the established pattern from test/extended/tls/tls_observed_config.go which does the same for TLS security profiles

Details

On HCP clusters, cluster-scoped config resources on the guest cluster are managed by the hosting cluster. The tests now detect HCP via exutil.IsHypershift() and set up an hcpContext with the management cluster's dynamic client. All three mutation functions (addComponentRouteWithLabels, updateComponentRouteLabels, removeComponentRoute) and cleanupTestRoutes branch on HCP to use unstructured operations on the HostedCluster CR at spec.configuration.ingress.componentRoutes. Read-only operations (route polling, domain read) continue to hit the guest cluster directly.

Prow job showing the failures

https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/82800/rehearse-82800-periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview/2084549238955446272

Test plan

  • go build ./cmd/openshift-tests/ passes
  • go vet ./test/extended/console/... passes
  • Standalone OCP: tests behave identically (hcp is nil, original typed client path)
  • HCP: tests modify HostedCluster CR instead of guest Ingress, avoiding VAP rejection

Jira

https://redhat.atlassian.net/browse/CONSOLE-5209

Summary by CodeRabbit

  • Tests
    • Expanded console label propagation coverage across standard OpenShift and HyperShift environments.
    • Added HyperShift-compatible handling for component route creation, label updates, removal, and cleanup.
    • Improved reliability of configuration updates with conflict retries and clearer failure reporting.
    • Added configurable polling intervals and timeouts for more consistent and flexible test execution.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 4, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 4, 2026

Copy link
Copy Markdown

@jhadvig: This pull request references CONSOLE-5209 which is a valid jira issue.

Details

In response to this:

Summary

  • Fix 5 serial e2e tests in test/extended/console/label_propagation.go that fail on HyperShift (HCP) clusters
  • On HCP, a ValidatingAdmissionPolicy blocks direct modification of ingresses.config.openshift.io/cluster on the guest cluster
  • Branch the mutation helpers to modify the HostedCluster CR's spec.configuration.ingress.componentRoutes via the management cluster dynamic client on HCP, while keeping the existing typed client path on standalone OCP
  • Follows the established pattern from test/extended/tls/tls_observed_config.go which does the same for TLS security profiles

Details

On HCP clusters, cluster-scoped config resources on the guest cluster are managed by the hosting cluster. The tests now detect HCP via exutil.IsHypershift() and set up an hcpContext with the management cluster's dynamic client. All three mutation functions (addComponentRouteWithLabels, updateComponentRouteLabels, removeComponentRoute) and cleanupTestRoutes branch on HCP to use unstructured operations on the HostedCluster CR at spec.configuration.ingress.componentRoutes. Read-only operations (route polling, domain read) continue to hit the guest cluster directly.

Prow job showing the failures

https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/82800/rehearse-82800-periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview/2084549238955446272

Test plan

  • go build ./cmd/openshift-tests/ passes
  • go vet ./test/extended/console/... passes
  • Standalone OCP: tests behave identically (hcp is nil, original typed client path)
  • HCP: tests modify HostedCluster CR instead of guest Ingress, avoiding VAP rejection

Jira

https://redhat.atlassian.net/browse/CONSOLE-5209

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from deads2k and sjenning August 4, 2026 14:15
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

The console label propagation test now supports standard OpenShift and HyperShift environments. HyperShift route mutations use HostedCluster configuration with conflict retries. Standard clusters continue to use Ingress resources.

Changes

Label propagation route handling

Layer / File(s) Summary
Environment detection and test wiring
test/extended/console/label_propagation.go
Detects HyperShift, initializes management-cluster access, and passes environment-specific polling settings through the test.
HostedCluster and Ingress route mutations
test/extended/console/label_propagation.go
Uses HostedCluster configuration for HyperShift route creation, label updates, and removal. Retains Ingress operations for standard clusters. HostedCluster updates use conflict-retried read-modify-write operations.
Cleanup and route polling
test/extended/console/label_propagation.go
Uses configurable polling intervals and timeouts. Removes test routes from HostedCluster configuration or Ingress resources during cleanup.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: sjenning, deads2k

Sequence Diagram(s)

sequenceDiagram
  participant LabelPropagationTest
  participant RouteMutationHelpers
  participant HostedCluster
  participant Ingress
  LabelPropagationTest->>RouteMutationHelpers: request route mutation
  alt HyperShift
    RouteMutationHelpers->>HostedCluster: read and update component routes
    HostedCluster-->>RouteMutationHelpers: return persisted routes
  else Standard cluster
    RouteMutationHelpers->>Ingress: update component routes
    Ingress-->>RouteMutationHelpers: return persisted routes
  end
  RouteMutationHelpers-->>LabelPropagationTest: return mutation result
Loading

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error, 1 warning)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error The new e2e.Logf prints the HostedCluster name and management namespace, exposing internal cluster/customer identifiers in test logs. Remove the dynamic HC/HCP identifiers from logs, or replace them with a fixed status message or safely redacted values.
Test Structure And Quality ⚠️ Warning The test has bare assertions in BeforeEach (lines 68, 71, 74, 77, 81) and label checks (108-109, 176-177), so failures lack meaningful diagnostic messages. Add context-specific messages to every bare Expect assertion. Keep the existing BeforeEach/AfterEach cleanup and bounded polling timeouts.
✅ Passed checks (13 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: fixing IngressComponentRouteLabels end-to-end tests for HyperShift compatibility.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed All five It() titles and the Describe() title are literal static strings; generated names, hostnames, domains, and other runtime values remain in test bodies.
Microshift Test Compatibility ✅ Passed All five added It() tests are inside a Describe tagged [apigroup:config.openshift.io], so MicroShift CI automatically skips this unavailable API group.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The five [Serial] tests only mutate component-route labels and poll console Route objects; the code has no node, affinity, scheduling, failover, scaling, or multi-endpoint assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The only changed path is a console e2e test; it adds HyperShift HostedCluster route mutations and polling, with no manifests, controllers, replicas, affinity, topology spread, selectors, toleration...
Ote Binary Stdout Contract ✅ Passed label_propagation.go has no process-level stdout writes; fmt calls only format strings/errors, and e2e.Logf writes to GinkgoWriter from BeforeEach/AfterEach paths.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR adds no IPv4 literals, IP parsing, URL construction, or public-network access; it uses guest and HyperShift management Kubernetes APIs and DNS hostnames.
No-Weak-Crypto ✅ Passed The PR changes only label_propagation.go; its added code uses Kubernetes clients, retries, and route-label handling, with no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comp...
Container-Privileges ✅ Passed The PR changes only one Go test file. Added-line and package scans found no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or securityContext settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jhadvig
Once this PR has been reviewed and has the lgtm label, please assign bertinatto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extended/console/label_propagation.go`:
- Around line 74-80: The isHypershift check in this test setup block masks
Infrastructure read errors by returning false, nil when retrieval fails, causing
the code to incorrectly skip HCP context setup if the detection itself fails.
Update the exutil.IsHypershift function to propagate the Infrastructure read
error instead of suppressing it, so that actual detection failures are caught by
the existing o.Expect(err) assertion and prevent silent false-negatives when hcp
initialization should occur on HCP clusters.
- Around line 443-447: Handle the error returned by unstructured.NestedSlice in
the componentRoutes update flow before invoking modify. Return a wrapped error
when extraction fails, and only pass successfully retrieved routes to modify and
unstructured.SetNestedSlice.
- Around line 436-450: Update hcpModifyComponentRoutes to create one
context.WithTimeout using pollTimeout before the RetryOnConflict callback, defer
its cancellation, and pass that context to both the dynamic-client Get and
Update calls instead of context.TODO(). Preserve the existing retry and mutation
behavior while ensuring the entire HostedCluster operation has a deadline.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 48140adb-84dd-4c45-85dc-22b91e85fb68

📥 Commits

Reviewing files that changed from the base of the PR and between 36d8167 and 5d2b311.

📒 Files selected for processing (1)
  • test/extended/console/label_propagation.go

Comment thread test/extended/console/label_propagation.go
Comment thread test/extended/console/label_propagation.go
Comment thread test/extended/console/label_propagation.go Outdated
@jhadvig

jhadvig commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

@jhadvig: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/8dbf49c0-9016-11f1-9f96-dcd34189c0a0-0

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@Leo6Leo

Leo6Leo commented Aug 4, 2026

Copy link
Copy Markdown

/retest

@jhadvig

jhadvig commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

Added a third commit to bump poll timeouts on HCP clusters. The multi-hop reconciliation chain (HostedCluster CR → HostedControlPlane → HCCO → guest Ingress → console-operator → Route) was timing out at 2 minutes. Bumped to 5m timeout / 10s interval on HCP, matching the timeouts used by HyperShift's own ingress e2e test. Standalone OCP keeps the original 2m/2s.

@jhadvig

jhadvig commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

@jhadvig: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a1e96640-904f-11f1-8d9b-d2d082f26c8e-0

@jhadvig

jhadvig commented Aug 5, 2026

Copy link
Copy Markdown
Member Author

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@jhadvig: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/3edd8a80-9091-11f1-9d0c-af83526a642e-0

@jhadvig

jhadvig commented Aug 5, 2026

Copy link
Copy Markdown
Member Author

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@jhadvig: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance-serial-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ea2c3000-9094-11f1-8306-7c3768c59d11-0

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@jhadvig
jhadvig force-pushed the CONSOLE-5209-hcp-fix branch from f7e1811 to 0cfe5fa Compare August 5, 2026 13:33
…2e tests

On HyperShift clusters a ValidatingAdmissionPolicy blocks direct
modification of ingresses.config.openshift.io/cluster on the guest
cluster. Branch the mutation helpers to modify the HostedCluster CR's
spec.configuration.ingress.componentRoutes via the management cluster
dynamic client on HCP, while keeping the existing typed client path
on standalone OCP. Use 25m/10s poll timeout/interval on HCP to account
for the multi-hop reconciliation chain.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@jhadvig
jhadvig force-pushed the CONSOLE-5209-hcp-fix branch from 0cfe5fa to 22c0e70 Compare August 5, 2026 14:06
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@jhadvig: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants