Skip to content

NO-JIRA: test(e2e/v2): add upsert desired-state-hash E2E tests - #9257

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
mgencur:feat-cpov2-last-applied-annotation_e2e_reduced
Sep 1, 2026
Merged

NO-JIRA: test(e2e/v2): add upsert desired-state-hash E2E tests#9257
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
mgencur:feat-cpov2-last-applied-annotation_e2e_reduced

Conversation

@mgencur

@mgencur mgencur commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Add E2E v2 test covering the desired-state-hash annotation introduced in support/upsert.ApplyManifest (PR #7713):

  • DesiredStateHashAnnotationTest: asserts every managed Deployment in the control plane namespace carries a valid 64-char hex desired-state-hash annotation

Picking one test from #9236 which was used to verify the feature.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Summary by CodeRabbit

  • Tests
    • Added end-to-end validation for deployment desired-state hash annotations.
    • Deployments managed by the control-plane operator must include a valid 64-character lowercase hexadecimal hash.
    • Unmanaged deployments and deployments without the annotation are skipped.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@mgencur mgencur changed the title test(e2e/v2): add upsert desired-state-hash E2E tests NO-JIRA: test(e2e/v2): add upsert desired-state-hash E2E tests Aug 7, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 7, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@mgencur: This pull request explicitly references no jira issue.

Details

In response to this:

What this PR does / why we need it:

Add E2E v2 test covering the desired-state-hash annotation introduced in support/upsert.ApplyManifest (PR #7713):

  • DesiredStateHashAnnotationTest: asserts every managed Deployment in the control plane namespace carries a valid 64-char hex desired-state-hash annotation

Picking one test from #9236 which was used to verify the feature.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added area/testing Indicates the PR includes changes for e2e testing and removed do-not-merge/needs-area labels Aug 7, 2026
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e7bf7cf0-bf92-4a90-b9ec-afa991c141ef

📥 Commits

Reviewing files that changed from the base of the PR and between a7f22d5 and 78a6475.

📒 Files selected for processing (1)
  • test/e2e/v2/tests/control_plane_workloads_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/e2e/v2/tests/control_plane_workloads_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.


📝 Walkthrough

Walkthrough

Added DesiredStateHashAnnotationTest to the control-plane workload test suite. The test skips missing or unmanaged Deployments. It requires the desired-state-hash annotation on managed Deployments and validates exactly 64 lowercase hexadecimal characters.

Suggested reviewers: ironcladlou, devguyio

Merge Risk: ⚪ Minimal · up to 78a64

This change adds localized end-to-end coverage for the desired-state-hash annotation, with no actionable merge-blocking risk remaining beyond normal checks and review.


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Stable And Deterministic Test Names ❌ Error The new test adds Context(workload.Name, ...) at test/e2e/v2/tests/control_plane_workloads_test.go:1101. This value becomes part of each Ginkgo test title. The workload registry supplies resource-… Use static Ginkgo titles for this test. Move the loop over workloads into the test body, and include workload.Name only in assertions, skip messages, or other body diagnostics. Do not pass workload.Name to Context, Describe, `When…
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the addition of E2E tests for the upsert-generated desired-state-hash annotation. It matches the main change.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Test Structure And Quality ✅ Passed PASS. The added It block checks one behavior: the presence and format of the desired-state-hash annotation on a managed Deployment. It creates no resources, so cleanup is not required. It contains n…
Topology-Aware Scheduling Compatibility ✅ Passed PASS — The diff changes only test/e2e/v2/tests/control_plane_workloads_test.go. It adds an E2E assertion for the desired-state-hash annotation and registers the test. It does not add or modify dep…
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS — The added Ginkgo test only reads Deployments through the existing management-cluster client and validates a local annotation with a regular expression. The pull request adds no IPv4 literals, I…
No-Weak-Crypto ✅ Passed The pull request adds only a regular-expression validation for the desired-state-hash annotation and reads the annotation from Deployments. It adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custo…
Container-Privileges ✅ Passed PASS: The pull request changes only test/e2e/v2/tests/control_plane_workloads_test.go. The added code checks Deployment annotations and registers an E2E test. It adds no Kubernetes manifest and no `…
No-Sensitive-Data-In-Logs ✅ Passed The pull request adds only E2E assertion diagnostics. The new messages print deployment names, namespaces, the annotation key, and an invalid annotation value. The annotation is a SHA-256 desired-stat…
Full details: Stable And Deterministic Test Names

Explanation

The new test adds Context(workload.Name, ...) at test/e2e/v2/tests/control_plane_workloads_test.go:1101. This value becomes part of each Ginkgo test title. The workload registry supplies resource-specific names, so the title changes when a workload is renamed or the registry changes. The new It text is static, but the surrounding test title is not a descriptive static string. Existing uses of this pattern are unchanged; this new use is introduced by the pull request.

Resolution

Use static Ginkgo titles for this test. Move the loop over workloads into the test body, and include workload.Name only in assertions, skip messages, or other body diagnostics. Do not pass workload.Name to Context, Describe, When, or It.

Full details: Test Structure And Quality

Explanation

PASS. The added It block checks one behavior: the presence and format of the desired-state-hash annotation on a managed Deployment. It creates no resources, so cleanup is not required. It contains no Eventually or Consistently wait. The Deployment read uses the test context and the repository management client has a five-minute request timeout. The new assertions include diagnostic Deployment names and annotation values. The test follows existing control-plane workload patterns for context access, missing-resource skips, and per-workload contexts.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The diff changes only test/e2e/v2/tests/control_plane_workloads_test.go. It adds an E2E assertion for the desired-state-hash annotation and registers the test. It does not add or modify deployment manifests, operator/controller scheduling logic, replica counts, affinity, topology spread, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not triggered.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS — The added Ginkgo test only reads Deployments through the existing management-cluster client and validates a local annotation with a regular expression. The pull request adds no IPv4 literals, IP parsing, URL construction, DNS lookup, public endpoint, image pull, or external service access. The diff changes only test/e2e/v2/tests/control_plane_workloads_test.go.

Full details: No-Weak-Crypto

Explanation

The pull request adds only a regular-expression validation for the desired-state-hash annotation and reads the annotation from Deployments. It adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparison. The SHA-256 computation in support/upsert/apply.go exists in both the parent and current revisions and is not changed by this pull request.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only test/e2e/v2/tests/control_plane_workloads_test.go. The added code checks Deployment annotations and registers an E2E test. It adds no Kubernetes manifest and no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation setting.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request adds only E2E assertion diagnostics. The new messages print deployment names, namespaces, the annotation key, and an invalid annotation value. The annotation is a SHA-256 desired-state hash, not a password, token, API key, session ID, PII, hostname, or customer data. The diff contains no logging of secrets or sensitive object contents.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "hypershiftlinter": hack/tools/bin/hypershiftlinter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "hypershiftlinter": hack/tools/bin/hypershiftlinter.so, plugin: not implemented


Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from devguyio and ironcladlou August 7, 2026 13:11

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
test/e2e/v2/tests/control_plane_workloads_test.go (1)

1055-1055: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Document the exported test registrar.

DesiredStateHashAnnotationTest is exported but has no Go doc comment. Describe that it registers per-workload checks, skips missing or unmanaged Deployments, and validates the desired-state-hash annotation. Document any panic conditions if registration can panic.

As per path instructions, comments on exported functions must describe actual behavior, including panic conditions.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/v2/tests/control_plane_workloads_test.go` at line 1055, Add a Go doc
comment immediately before DesiredStateHashAnnotationTest describing that it
registers per-workload checks, skips missing or unmanaged Deployments, and
validates the desired-state-hash annotation. Include any actual panic conditions
that can occur during registration, without asserting unsupported behavior.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/v2/tests/control_plane_workloads_test.go`:
- Around line 1057-1058: Add a non-empty assertion for the slice returned by
internal.GetControlPlaneWorkloads() before the loop that registers It blocks,
failing fast when workloads is empty. Keep the existing per-workload assertions
unchanged.

---

Nitpick comments:
In `@test/e2e/v2/tests/control_plane_workloads_test.go`:
- Line 1055: Add a Go doc comment immediately before
DesiredStateHashAnnotationTest describing that it registers per-workload checks,
skips missing or unmanaged Deployments, and validates the desired-state-hash
annotation. Include any actual panic conditions that can occur during
registration, without asserting unsupported behavior.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bedf559e-c7ab-4f93-b84f-79220c159c0c

📥 Commits

Reviewing files that changed from the base of the PR and between 8ddee28 and ec8c287.

📒 Files selected for processing (1)
  • test/e2e/v2/tests/control_plane_workloads_test.go

Comment thread test/e2e/v2/tests/control_plane_workloads_test.go
@codecov

codecov Bot commented Aug 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.17%. Comparing base (a7f22d5) to head (78a6475).
⚠️ Report is 76 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #9257   +/-   ##
=======================================
  Coverage   46.17%   46.17%           
=======================================
  Files         783      783           
  Lines       98406    98406           
=======================================
  Hits        45442    45442           
  Misses      49888    49888           
  Partials     3076     3076           
Flag Coverage Δ
cmd-support 39.76% <ø> (ø)
cpo-hostedcontrolplane 48.31% <ø> (ø)
cpo-other 46.11% <ø> (ø)
hypershift-operator 57.14% <ø> (ø)
other 34.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@muraee

muraee commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

/approve

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 7, 2026

@muraee muraee left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good — clean, well-structured test that follows the existing patterns in the file.

One minor nit: the managed-by label check hardcodes "hypershift.openshift.io/managed-by" and "control-plane-operator" as raw strings. If there's a constant for that label, it'd be safer to import it so the test doesn't silently skip everything if the label key/value ever changes.

Otherwise, LGTM.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 7, 2026
@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mgencur, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mgencur

mgencur commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-5-0
/test e2e-aws-5-0
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

@mgencur

mgencur commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

/retest

  Add E2E v2 test covering the desired-state-hash annotation
  introduced in support/upsert.ApplyManifest (PR openshift#7713):

  - DesiredStateHashAnnotationTest: asserts every managed
    Deployment in the control plane namespace carries a valid 64-char
    hex desired-state-hash annotation
@mgencur
mgencur force-pushed the feat-cpov2-last-applied-annotation_e2e_reduced branch from ec8c287 to 78a6475 Compare August 25, 2026 05:44
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 25, 2026
@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@muraee

muraee commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 25, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-5-0
/test e2e-aws-5-0
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

@mgencur

mgencur commented Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mgencur

mgencur commented Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

/retest

3 similar comments
@mgencur

mgencur commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mgencur

mgencur commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mgencur

mgencur commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mgencur

mgencur commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

/verified by E2E

This PR add one E2E test and it passed.

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 1, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@mgencur: This PR has been marked as verified by E2E.

Details

In response to this:

/verified by E2E

This PR add one E2E test and it passed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

@mgencur: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 7dab63e into openshift:main Sep 1, 2026
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/testing Indicates the PR includes changes for e2e testing jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants