[release-1.28] Improve scorecard test to avoid running on kind cluster inside OCP cl…

Makefile.core.mk

@@ -215,8 +215,8 @@ test.integration: envtest ## Run integration tests located in the tests/integrat
 	go run github.com/onsi/ginkgo/v2/ginkgo --tags=integration $(GINKGO_FLAGS) ./tests/integration/...
 
 .PHONY: test.scorecard
-test.scorecard: operator-sdk ## Run the operator scorecard test.
-	OPERATOR_SDK=$(OPERATOR_SDK) ${SOURCE_DIR}/tests/scorecard-test.sh
+test.scorecard: operator-sdk ## Run the operator scorecard test. Use OCP=true to run against an existing OCP cluster instead of Kind.
+	OCP=$${OCP:-false} OPERATOR_SDK=$(OPERATOR_SDK) SCORECARD_NAMESPACE="$${SCORECARD_NAMESPACE:-scorecard-test}" ${SOURCE_DIR}/tests/scorecard-test.sh
 
 .PHONY: test.e2e.ocp
 test.e2e.ocp: istioctl ## Run the end-to-end tests against an existing OCP cluster. While running on OCP in downstream you need to set ISTIOCTL_DOWNLOAD_URL to the URL where the istioctl productized binary.

tests/scorecard-test.sh

@@ -19,22 +19,55 @@ set -eux -o pipefail
 SCRIPTPATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 ROOT="$(dirname "${SCRIPTPATH}")"
 
-# shellcheck source=common/scripts/kind_provisioner.sh
-source "${ROOT}/common/scripts/kind_provisioner.sh"
+# OCP environment variable can be set to "true" to run tests against an existing OCP cluster instead of a Kind cluster
+OCP="${OCP:-false}"
 
-# Create a temporary kubeconfig
-KUBECONFIG="$(mktemp)"
-export KUBECONFIG
+if [[ "${OCP}" == "true" ]]; then
+    echo "Running scorecard tests against existing OCP cluster"
 
-# Create the kind cluster
-export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
-export DEFAULT_CLUSTER_YAML="${ROOT}/tests/e2e/setup/config/default.yaml"
-export ARTIFACTS="${ARTIFACTS:-$(mktemp -d)}"
-export IP_FAMILY="${IP_FAMILY:-ipv4}"
-setup_kind_cluster "${KIND_CLUSTER_NAME}" "" "" "true" "true"
+    # Check if KUBECONFIG is set
+    if [ -z "${KUBECONFIG:-}" ]; then
+        echo "KUBECONFIG is not set. oc will not be able to connect to the cluster. Exiting."
+        exit 1
+    fi
 
-kind export kubeconfig --name="${KIND_CLUSTER_NAME}"
+    # Verify we can connect to the cluster
+    if ! oc cluster-info > /dev/null 2>&1; then
+        echo "Cannot connect to OpenShift cluster. Check your KUBECONFIG and cluster access."
+        exit 1
+    fi
+
+    echo "Connected to cluster: $(oc config current-context)"
+
+else
+    echo "Running scorecard tests against Kind cluster"
+
+    # shellcheck source=common/scripts/kind_provisioner.sh
+    source "${ROOT}/common/scripts/kind_provisioner.sh"
+
+    # Create a temporary kubeconfig
+    KUBECONFIG="$(mktemp)"
+    export KUBECONFIG
+
+    # Create the kind cluster
+    export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
+    export DEFAULT_CLUSTER_YAML="${ROOT}/tests/e2e/setup/config/default.yaml"
+    export ARTIFACTS="${ARTIFACTS:-$(mktemp -d)}"
+    export IP_FAMILY="${IP_FAMILY:-ipv4}"
+    setup_kind_cluster "${KIND_CLUSTER_NAME}" "" "" "true" "true"
+
+    kind export kubeconfig --name="${KIND_CLUSTER_NAME}"
+fi
+
+# Determine namespace - use scorecard-test for OCP to avoid conflicts with any existing namespaces, and default for Kind since it's a fresh cluster
+NAMESPACE="${SCORECARD_NAMESPACE:-default}"
+if [[ "${OCP}" == "true" ]]; then
+    NAMESPACE="${SCORECARD_NAMESPACE:-scorecard-test}"
+    # Create namespace if it doesn't exist
+    oc create namespace "${NAMESPACE}" || true
+fi
 
 # Run the test
 OPERATOR_SDK="${OPERATOR_SDK:-operator-sdk}"
-${OPERATOR_SDK} scorecard --kubeconfig="${KUBECONFIG}" --namespace=default bundle
+echo "Running scorecard tests in namespace: ${NAMESPACE}"
+${OPERATOR_SDK} scorecard --kubeconfig="${KUBECONFIG}" --namespace="${NAMESPACE}" bundle