NO-ISSUE: UPSTREAM: <carry>: fix cases 81696 and 74618 for product code changes

[kuiwang02]

fix OLM v1 test cases 81696 and 74618 for product code changes

Why / Problem Statement

Two OLM v1 test cases (81696 and 74618) were failing due to misalignment between test expectations and updated product code behavior:

1. Test Case 81696 - Preflight permission check on single namespace mode was failing with:

   error: the path "/var/folders/.../ce-81696-role-ns-81696-watch.yaml" does not exist
   

   The test assumed that RBAC role files would always be generated for both install and watch namespaces, but the GenerateRBACFromMissingRules function correctly only generates role files when there are actual permissions needed for that namespace.

2. Test Case 74618 - Bundle validation test was failing with error message mismatch:

   • Expected: "do not support targeting all namespaces"
   • Actual: "bundle does not support AllNamespaces install mode"

   The operator-controller implementation had updated its error message format to be more clear and accurate, but the test was still checking for the old message.

What / Solution

Updated two test cases in the OLM v1 ClusterExtension test suite to align with current product code behavior.

Changes Made

File: test/qe/specs/olmv1_ce.go

1. Lines 789-798 (Test Case 81696 - PolarionID:81696):

   • Added file existence check before applying watch namespace role file
   • When GenerateRBACFromMissingRules doesn't create a role file for the watch namespace (because no permissions are needed), the test now gracefully handles this instead of failing
   • Added descriptive log message when file doesn't exist

   // Before: Assumed file always exists
   defer func() { _ = oc.AsAdmin().WithoutNamespace().Run("delete").Args("-f", roleNsWatchFile).Execute() }()
   err = oc.AsAdmin().WithoutNamespace().Run("apply").Args("-f", roleNsWatchFile).Execute()
   o.Expect(err).NotTo(o.HaveOccurred())
   
   // After: Check if file exists first
   if _, err := os.Stat(roleNsWatchFile); err == nil {
       defer func() { _ = oc.AsAdmin().WithoutNamespace().Run("delete").Args("-f", roleNsWatchFile).Execute() }()
       err = oc.AsAdmin().WithoutNamespace().Run("apply").Args("-f", roleNsWatchFile).Execute()
       o.Expect(err).NotTo(o.HaveOccurred())
   } else {
       e2e.Logf("Watch namespace role file %s does not exist, skipping creation", roleNsWatchFile)
   }

2. Line 927 (Test Case 74618 - PolarionID:74618):

   • Updated expected error message to match new operator-controller error format
   • Changed from: "do not support targeting all namespaces"
   • Changed to: "bundle does not support AllNamespaces install mode"

Testing

INFO[0194] Found 0 must-gather tests                    
started: 0/1/2 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:81696-[Skipped:Disconnected]preflight check on permission on single ns mode"

started: 0/2/2 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:74618-[Skipped:Disconnected]ClusterExtension supports simple registry vzero bundles only"


passed: (2m20s) 2025-10-17T05:36:36 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:81696-[Skipped:Disconnected]preflight check on permission on single ns mode"


passed: (2m50s) 2025-10-17T05:37:06 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:74618-[Skipped:Disconnected]ClusterExtension supports simple registry vzero bundles only"

Shutting down the monitor
Collecting data.
INFO[0374] Starting CollectData for all monitor tests   
INFO[0374]   Starting CollectData for [Monitor:watch-namespaces][Jira:"Test Framework"] monitor test watch-namespaces collection 
INFO[0374]   Finished CollectData for [Monitor:watch-namespaces][Jira:"Test Framework"] monitor test watch-namespaces collection 
INFO[0374] Finished CollectData for all monitor tests   
Computing intervals.
Evaluating tests.
Cleaning up.
INFO[0374] beginning cleanup                             monitorTest=watch-namespaces
Serializing results.
Writing to storage.
  m.startTime = 2025-10-17 13:34:06.685598 +0800 CST m=+194.316295085
  m.stopTime  = 2025-10-17 13:37:06.741521 +0800 CST m=+374.371371126
Processing monitorTest: watch-namespaces
  finalIntervals size = 4
  first interval time: From = 2025-10-17 13:34:06.691954 +0800 CST m=+194.322651168; To = 2025-10-17 13:34:06.691954 +0800 CST m=+194.322651168
  last interval time: From = 2025-10-17 13:37:06.740306 +0800 CST m=+374.370156001; To = 2025-10-17 13:37:06.740306 +0800 CST m=+374.370156001
Writing junits.
Writing JUnit report to e2e-monitor-tests__20251017-053105.xml
2 pass, 0 flaky, 0 skip (6m2s)

Assisted-by: Claude Code

[openshift-ci-robot]

@kuiwang02: This pull request explicitly references no jira issue.

In response to this:

UPSTREAM: : fix OLM v1 test cases 81696 and 74618 for product code changes

Why / Problem Statement

Two OLM v1 test cases (81696 and 74618) were failing due to misalignment between test expectations and updated product code behavior:

1. Test Case 81696 - Preflight permission check on single namespace mode was failing with:

error: the path "/var/folders/.../ce-81696-role-ns-81696-watch.yaml" does not exist

The test assumed that RBAC role files would always be generated for both install and watch namespaces, but the GenerateRBACFromMissingRules function correctly only generates role files when there are actual permissions needed for that namespace.

2. Test Case 74618 - Bundle validation test was failing with error message mismatch:

• Expected: "do not support targeting all namespaces"
• Actual: "bundle does not support AllNamespaces install mode"

The operator-controller implementation had updated its error message format to be more clear and accurate, but the test was still checking for the old message.

What / Solution

Updated two test cases in the OLM v1 ClusterExtension test suite to align with current product code behavior.

Changes Made

File: test/qe/specs/olmv1_ce.go

1. Lines 789-798 (Test Case 81696 - PolarionID:81696):

• Added file existence check before applying watch namespace role file
• When GenerateRBACFromMissingRules doesn't create a role file for the watch namespace (because no permissions are needed), the test now gracefully handles this instead of failing
• Added descriptive log message when file doesn't exist

// Before: Assumed file always exists
defer func() { _ = oc.AsAdmin().WithoutNamespace().Run("delete").Args("-f", roleNsWatchFile).Execute() }()
err = oc.AsAdmin().WithoutNamespace().Run("apply").Args("-f", roleNsWatchFile).Execute()
o.Expect(err).NotTo(o.HaveOccurred())

// After: Check if file exists first
if _, err := os.Stat(roleNsWatchFile); err == nil {
    defer func() { _ = oc.AsAdmin().WithoutNamespace().Run("delete").Args("-f", roleNsWatchFile).Execute() }()
    err = oc.AsAdmin().WithoutNamespace().Run("apply").Args("-f", roleNsWatchFile).Execute()
    o.Expect(err).NotTo(o.HaveOccurred())
} else {
    e2e.Logf("Watch namespace role file %s does not exist, skipping creation", roleNsWatchFile)
}

2. Line 927 (Test Case 74618 - PolarionID:74618):

• Updated expected error message to match new operator-controller error format
• Changed from: "do not support targeting all namespaces"
• Changed to: "bundle does not support AllNamespaces install mode"

Testing

INFO[0194] Found 0 must-gather tests                    
started: 0/1/2 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:81696-[Skipped:Disconnected]preflight check on permission on single ns mode"

started: 0/2/2 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:74618-[Skipped:Disconnected]ClusterExtension supports simple registry vzero bundles only"


passed: (2m20s) 2025-10-17T05:36:36 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:81696-[Skipped:Disconnected]preflight check on permission on single ns mode"


passed: (2m50s) 2025-10-17T05:37:06 "[sig-olmv1][Jira:OLM] clusterextension PolarionID:74618-[Skipped:Disconnected]ClusterExtension supports simple registry vzero bundles only"

Shutting down the monitor
Collecting data.
INFO[0374] Starting CollectData for all monitor tests   
INFO[0374]   Starting CollectData for [Monitor:watch-namespaces][Jira:"Test Framework"] monitor test watch-namespaces collection 
INFO[0374]   Finished CollectData for [Monitor:watch-namespaces][Jira:"Test Framework"] monitor test watch-namespaces collection 
INFO[0374] Finished CollectData for all monitor tests   
Computing intervals.
Evaluating tests.
Cleaning up.
INFO[0374] beginning cleanup                             monitorTest=watch-namespaces
Serializing results.
Writing to storage.
 m.startTime = 2025-10-17 13:34:06.685598 +0800 CST m=+194.316295085
 m.stopTime  = 2025-10-17 13:37:06.741521 +0800 CST m=+374.371371126
Processing monitorTest: watch-namespaces
 finalIntervals size = 4
 first interval time: From = 2025-10-17 13:34:06.691954 +0800 CST m=+194.322651168; To = 2025-10-17 13:34:06.691954 +0800 CST m=+194.322651168
 last interval time: From = 2025-10-17 13:37:06.740306 +0800 CST m=+374.370156001; To = 2025-10-17 13:37:06.740306 +0800 CST m=+374.370156001
Writing junits.
Writing JUnit report to e2e-monitor-tests__20251017-053105.xml
2 pass, 0 flaky, 0 skip (6m2s)

Assisted-by: Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[camilamacedo86]

It is no longer a valid scenario since now we support single/own namespace as well.
And we are promoting in this sprint those feature flags to GA
Should we not review those checks accordingly?

[kuiwang02]

but now it is valid case. after it is GA, I will change it again.

if we do not enhance it, the case is always failing.

[camilamacedo86]

For tech-preview clusters, that is not valid.
Will it not fail in Component Readiness or block us from moving forward with GA right?

[kuiwang02]

It does not impact TP cluster because it do not run into this logic if it is TP cluster.

Firstly it will not impact the GA because the case pass now. (actually if we do not fix it, it is failing)
secondly, even it is failing, it will not impact GA because it is informing and not in component readiness now.

so, do not worry about it.

[camilamacedo86]

Are the changes made on those tested in the pre-merge/ci?

[kuiwang02]

About pre-merge:
if the qe case is labeled with ReleaseGate, it will be in pre-merged job.
if the qe case is not labeled with ReleaseGate, it will not be in pre-merged job. we ever talked with @chengzhang1016 @jianzhangbjz ,the conclusion is that we do not use it currently, and will consider it from qe's view.

the two cases are not labeled with ReleaseGate. but as the PR description, and we required, we run them and post the case execution log in PR.

About CI:
The QE case which is not labeled with ReleaseGate only run in the qe custom prow job. and we do not put them into readiness (it ever is shown in readiness, but it is fixed now). about Not Shown in readiness, it is conclusion by QE.

by the way, as I said before, the QE migrated cases are informing if it is not labeled with ReleaseGate. so, it does not impact readiness and block your GA. When we design QE migrated, we ever consider this point, so make such design.

[kuiwang02]

/retest-required

[jianzhangbjz]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jianzhangbjz, kuiwang02

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [jianzhangbjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kuiwang02]

/verified by @kuiwang02

[openshift-ci-robot]

@kuiwang02: This PR has been marked as verified by @kuiwang02.

In response to this:

/verified by @kuiwang02

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD e77207b and 2 for PR HEAD ba55462 in total

[openshift-ci]

@kuiwang02: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	ba55462	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.