docs: Add local testing guide for extended-priv tests

[pawanpinjarkar]

- What I did

Added comprehensive documentation for running test/extended-priv/ tests locally.

Created test/extended-priv/README.md with:

• Complete 5-step local testing workflow
• Documentation of the InitStandardFlags() conflict and required workaround
• Troubleshooting guide for common errors
• Best practices for contributing new extended-priv tests
• Examples of test structure and helper functions

- How to verify it

1. Read the new test/extended-priv/README.md file
2. Verify instructions are accurate by following the local testing workflow:

Comment out InitStandardFlags() in cmd/machine-config-tests-ext/main.go line 104

go build ./cmd/machine-config-tests-ext/
export KUBECONFIG=/path/to/kubeconfig
./machine-config-tests-ext run-suite openshift/machine-config-operator/iri

3. Confirm the documentation matches the actual behavior and resolves the "flag redefined: kubeconfig" panic

- Description for the changelog

Add local testing guide for extended-priv tests with InitStandardFlags workaround

---

Additional Context

Currently, there is no documentation on how to run machine-config-tests-ext tests locally. The openshift-tests-extension framework conflicts with standard e2e test flag registration, causing a panic: flag redefined: kubeconfig error when
developers attempt to run tests locally.

This documentation:

• Fills a critical gap - no existing docs cover machine-config-tests-ext or test/extended-priv/
• Documents the known InitStandardFlags() limitation (not a bug, but a framework limitation)
• Provides special guidance for IRI tests which require OVE clusters with NoRegistryClusterInstall feature gate
• Helps future contributors understand the test structure and requirements

Without this documentation, developers must either:

1. Discover the workaround through trial and error
2. Only run tests in CI (slower iteration cycle)
3. Ask maintainers for guidance

Related Issues: None (this is new documentation, not a bug fix)

Testing: Verified instructions work on an OVE compact IPv4 cluster with NoRegistryClusterInstall feature gate enabled

---

Assisted by: https://claude.ai/claude-code (Claude Sonnet 4.5)

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pawanpinjarkar
Once this PR has been reviewed and has the lgtm label, please assign pablintino for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@pawanpinjarkar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pablintino]

I've dropped a few comments.

[pablintino]

These tests are primarily designed to run in CI environments but can be run locally with some modifications.

That's not true. The main point of origin and the extensions framework is that you can run them locally, as I did when I introduced OTE into this repo.

[pawanpinjarkar]

Thank you for the review. I am going through https://github.com/openshift/machine-config-operator/blob/main/docs/HACKING.md for more details.

[pablintino]

Golang is not really required if you:

• Pick the extensions binary from an already built MCO image
• Use our make image target, that compiles everything inside a builder container with the proper Go version and libraries built-in. The OTE binary will be placed in /usr/bin/machine-config-tests-ext.gz (gzipped)

[pawanpinjarkar]

I was not up to date with using the extensions binary from an already built MCO image. I am exploring make image and the other steps mentioned in the https://github.com/openshift/machine-config-operator/blob/main/docs/HACKING.md#build-mco-image

[pablintino]

The machine-config-tests-ext binary uses the openshift-tests-extension framework which conflicts with the standard e2e test flag registration

No, have you written and verified that sentence or is it part of Claude's output?

I've just tested this and it works:

export MCO_IMAGE=$(oc adm release info <URL-OF-PAYLOAD-IMAGE> -o=jsonpath='{.references.spec.tags[?(@.name=="machine-config-operator")].from.name}')
podman run --rm --entrypoint cat $MCO_IMAGE /usr/bin/machine-config-tests-ext.gz > machine-config-tests-ext.gz
gzip -dk machine-config-tests-ext.gz
chmod +x ./machine-config-tests-ext

~ on ☁️  ❯ ./machine-config-tests-ext run-test "[sig-mco][Suite:openshift/machine-config-operator/disruptive][Serial][Disruptive] MCO ocb [PolarionID:83138][OTP] A MachineOSConfig fails to apply or degrades if invalid inputs are given"                                             13:03:19
  I0204 13:03:26.316579 383393 test_context.go:567] The --provider flag is not set. Continuing as if --provider=skeleton had been used.
  Running Suite:  - /home/pabrodri
  ================================
  Random Seed: 1770206606 - will randomize all specs

  Will run 1 of 1 specs
  ------------------------------
  [sig-mco][Suite:openshift/machine-config-operator/disruptive][Serial][Disruptive] MCO ocb [PolarionID:83138][OTP] A MachineOSConfig fails to apply or degrades if invalid inputs are given
  /go/src/github.com/openshift/machine-config-operator/test/extended-priv/mco_ocb.go:55
    STEP: Creating a kubernetes client @ 02/04/26 13:03:26.317
  I0204 13:03:28.365227 383393 client.go:164] configPath is now "/tmp/configfile2973532882"
  I0204 13:03:28.365258 383393 client.go:291] The user is now "e2e-test-mco-ocb-vs42k-user"
  I0204 13:03:28.365265 383393 client.go:293] Creating project "e2e-test-mco-ocb-vs42k"
  I0204 13:03:28.643296 383393 client.go:302] Waiting on permissions in project "e2e-test-mco-ocb-vs42k" ...
  I0204 13:03:29.593991 383393 client.go:363] Waiting for ServiceAccount "default" to be provisioned...
  I0204 13:03:29.898912 383393 client.go:363] Waiting for ServiceAccount "builder" to be provisioned...
  I0204 13:03:30.206383 383393 client.go:363] Waiting for ServiceAccount "deployer" to be provisioned...

[pawanpinjarkar]

The text verbiage is generated by Claude and can be fixed as necessary as part of the code review. I will give the commands a try on my local machine.

[pawanpinjarkar]

I've dropped a few comments.

Thanks for the review. After reading through https://github.com/openshift/machine-config-operator/blob/main/docs/HACKING.md and going through other review comments, I got more clarity how the test binary works.

This docs PR is created while I was working on a cluster created with NoRegistryClusterInstall feature (OVE). I was looking for a way to run the IRI tests from #5620 against the local OVE cluster. I see that the Hacking.md, has instructions for creating a custom OCP release payload with custom MCO image and then create a cluster using installer binary with custom release image, the case for OVE is little different.

For OVE, once custom release image with custom MCO image is created, the next steps are to create an OVE ISO ( via isobuilder and appliance under the hood along with installer) and then boot up the ISO to create a cluster. This is different than https://github.com/openshift/machine-config-operator/blob/main/docs/HACKING.md#install-a-cluster-with-a-custom-release-payload

I think this doc could be useful for running IRI e2e tests against OVE cluster with changes as necessary or the existing doc can be updated to cover OVE cluster use case.