Skip to content

CM-830: Add trust-manager e2e tests - #486

Open
openshift-app-platform-shift[bot] wants to merge 3 commits into
cert-manager-1.18from
feature/e2e-tests-1914-v2
Open

CM-830: Add trust-manager e2e tests#486
openshift-app-platform-shift[bot] wants to merge 3 commits into
cert-manager-1.18from
feature/e2e-tests-1914-v2

Conversation

@openshift-app-platform-shift

@openshift-app-platform-shift openshift-app-platform-shift Bot commented Aug 27, 2026

Copy link
Copy Markdown

Summary

  • Adds comprehensive e2e tests for the trust-manager operand lifecycle
  • Tests cover deployment, configuration options, RBAC, status reporting, and resource labels
  • Follows the same patterns as the existing IstioCSR e2e tests
  • Uses Ginkgo v2 with Ordered test suites and Feature:TrustManager label

Test Scenarios

Basic Deployment Lifecycle

  • Deploy trust-manager with minimal configuration and verify all managed resources
  • Verify operator reconciles deployment when manually modified (scale-down recovery)
  • Verify clean deletion of TrustManager CR

Deployment Configuration

  • Custom log level and format verification
  • Filter expired certificates feature flag
  • Default CA package with OpenShift CA bundle injection

Secret Targets Configuration

  • RBAC rules when secret targets policy is Custom (authorized secrets in resourceNames)
  • No secret write RBAC rules when policy is Disabled

Status Reporting

  • Verify all status fields populated after successful deployment
  • Verify Ready/Degraded conditions

Resource Labels

  • Verify managed resources have correct labels (app, app.kubernetes.io/*)
  • Verify controllerConfig custom labels are applied

New Files

  • test/e2e/trust_manager_test.go - E2E test suite (10 test cases, ~530 lines)
  • test/e2e/testdata/trust_manager/trust_manager_minimal_template.yaml - Minimal CR template
  • test/e2e/testdata/trust_manager/trust_manager_template.yaml - Configurable CR template

Dependencies

Test plan

  • go build -tags e2e ./test/e2e/... compiles cleanly
  • go vet -tags e2e ./test/e2e/... passes
  • Tests run on cluster with TrustManager feature gate enabled
  • Tests labeled with Feature:TrustManager can be filtered in CI

🤖 Generated with Claude Code

openshift-app-platform-shift Bot and others added 3 commits August 27, 2026 10:00
@openshift-app-platform-shift @claude
CM-830: Add TrustManager API type definitions for trust-manager operand
02d35d3 
Introduces the TrustManager CRD (trustmanagers.operator.openshift.io/v1alpha1)
to support deploying and managing the trust-manager operand via cert-manager-operator.

This adds:
- TrustManager API types with spec/status fields for configuring trust-manager
  operand behavior (log level/format, trust namespace, secret targets,
  default CA package, filtering expired certificates, scheduling)
- TrustManager FeatureGate (Alpha/TechPreview, default disabled)
- Singleton enforcement via XValidation (name must be "cluster")
- Immutability on trustNamespace via XValidation
- Cross-field CEL validation on SecretTargetsConfig
- Integration test suite (.testsuite.yaml) covering create and update scenarios
- Generated deepcopy, CRD manifest, clientset, informers, listers, and
  apply configurations

Ref: openshift/enhancements#1914

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-app-platform-shift @claude
CM-830: Add trust-manager controller implementation
4ba0499 
Implements the trust-manager controller for cert-manager-operator following
the IstioCSR controller patterns. The controller reconciles TrustManager CRs
to deploy and manage the trust-manager operand in the cert-manager namespace.

This adds:
- Controller package (pkg/controller/trustmanager/) with full reconciliation
  logic for ServiceAccount, RBAC, Certificate/Issuer, Deployment, Services,
  and ValidatingWebhookConfiguration resources
- Dynamic Deployment args based on TrustManager CR spec (log level/format,
  trust namespace, secret targets, default CA package, expired cert filtering)
- Dynamic ClusterRole rules based on secretTargets.policy configuration
- DefaultCAPackage support using OpenShift trusted CA bundle injection
- Static YAML manifests in bindata/trust-manager/ for all managed resources
- Controller registration in setup_manager.go with composite cache builder
- Feature gate check in starter.go (TrustManager gate, Alpha/TechPreview)
- Updated RBAC role manifest for trust-manager controller permissions

Ref: openshift/enhancements#1914

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-app-platform-shift @claude
CM-830: Add trust-manager e2e tests
3089999 
Adds comprehensive end-to-end tests for the trust-manager operand
lifecycle, verifying deployment, configuration, RBAC, status reporting,
and resource label management.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 27, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 27, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@openshift-app-platform-shift[bot]: This pull request references CM-830 which is a valid jira issue.

Details

In response to this:

Summary

  • Adds comprehensive e2e tests for the trust-manager operand lifecycle
  • Tests cover deployment, configuration options, RBAC, status reporting, and resource labels
  • Follows the same patterns as the existing IstioCSR e2e tests
  • Uses Ginkgo v2 with Ordered test suites and Feature:TrustManager label

Test Scenarios

Basic Deployment Lifecycle

  • Deploy trust-manager with minimal configuration and verify all managed resources
  • Verify operator reconciles deployment when manually modified (scale-down recovery)
  • Verify clean deletion of TrustManager CR

Deployment Configuration

  • Custom log level and format verification
  • Filter expired certificates feature flag
  • Default CA package with OpenShift CA bundle injection

Secret Targets Configuration

  • RBAC rules when secret targets policy is Custom (authorized secrets in resourceNames)
  • No secret write RBAC rules when policy is Disabled

Status Reporting

  • Verify all status fields populated after successful deployment
  • Verify Ready/Degraded conditions

Resource Labels

  • Verify managed resources have correct labels (app, app.kubernetes.io/*)
  • Verify controllerConfig custom labels are applied

New Files

  • test/e2e/trust_manager_test.go - E2E test suite (10 test cases, ~530 lines)
  • test/e2e/testdata/trust_manager/trust_manager_minimal_template.yaml - Minimal CR template
  • test/e2e/testdata/trust_manager/trust_manager_template.yaml - Configurable CR template

Dependencies

Test plan

  • go build -tags e2e ./test/e2e/... compiles cleanly
  • go vet -tags e2e ./test/e2e/... passes
  • Tests run on cluster with TrustManager feature gate enabled
  • Tests labeled with Feature:TrustManager can be filtered in CI

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-app-platform-shift[bot]
Once this PR has been reviewed and has the lgtm label, please assign swghosh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 27, 2026
@openshift-ci

openshift-ci Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Hi @openshift-app-platform-shift[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PillaiManish PillaiManish Awaiting requested review from PillaiManish
@TrilokGeer TrilokGeer Awaiting requested review from TrilokGeer

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@openshift-ci-robot