NO-ISSUE: Synchronize From Upstream Repositories

Makefile

@@ -254,26 +254,20 @@ $(eval $(call install-sh,standard,operator-controller-standard.yaml))
 .PHONY: test
 test: manifests generate fmt lint test-unit test-e2e test-regression #HELP Run all tests.
 
-E2E_TIMEOUT ?= 10m
+E2E_TIMEOUT ?= 15m
+GODOG_ARGS ?=
 .PHONY: e2e
 e2e: #EXHELP Run the e2e tests.
-	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(E2E_TIMEOUT)
+	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(E2E_TIMEOUT) $(if $(GODOG_ARGS),-args $(GODOG_ARGS))
 
-E2E_REGISTRY_NAME := docker-registry
-E2E_REGISTRY_NAMESPACE := operator-controller-e2e
-
-export REG_PKG_NAME := registry-operator
-export CLUSTER_REGISTRY_HOST := $(E2E_REGISTRY_NAME).$(E2E_REGISTRY_NAMESPACE).svc:5000
-export LOCAL_REGISTRY_HOST := localhost:30000
-export E2E_TEST_CATALOG_V1 := e2e/test-catalog:v1
-export E2E_TEST_CATALOG_V2 := e2e/test-catalog:v2
-export CATALOG_IMG := $(CLUSTER_REGISTRY_HOST)/$(E2E_TEST_CATALOG_V1)
+export CLUSTER_REGISTRY_HOST := docker-registry.operator-controller-e2e.svc:5000
 .PHONY: extension-developer-e2e
-extension-developer-e2e: $(OPERATOR_SDK) $(KUSTOMIZE) #EXHELP Run extension create, upgrade and delete tests.
-	test/extension-developer-e2e/setup.sh $(OPERATOR_SDK) $(CONTAINER_RUNTIME) $(KUSTOMIZE) ${LOCAL_REGISTRY_HOST} ${CLUSTER_REGISTRY_HOST}
+extension-developer-e2e: export OPERATOR_SDK := $(OPERATOR_SDK)
+extension-developer-e2e: export CONTAINER_RUNTIME := $(CONTAINER_RUNTIME)
+extension-developer-e2e: $(OPERATOR_SDK) #EXHELP Run extension create, upgrade and delete tests.
 	go test -count=1 -v ./test/extension-developer-e2e/...
 
-UNIT_TEST_DIRS := $(shell go list ./... | grep -vE "/test/|/testutils")
+UNIT_TEST_DIRS := $(shell go list ./... | grep -vE "/test/|/testutils") $(shell go list ./test/internal/...)
 COVERAGE_UNIT_DIR := $(ROOT_DIR)/coverage/unit
 
 .PHONY: envtest-k8s-bins #HELP Uses setup-envtest to download and install the binaries required to run ENVTEST-test based locally at the project/bin directory.
@@ -298,18 +292,6 @@ test-regression: #HELP Run regression test
 	rm -rf $(COVERAGE_REGRESSION_DIR) && mkdir -p $(COVERAGE_REGRESSION_DIR)
 	go test -count=1 -v ./test/regression/... -cover -coverprofile ${ROOT_DIR}/coverage/regression.out -test.gocoverdir=$(COVERAGE_REGRESSION_DIR)
 
-.PHONY: image-registry
-E2E_REGISTRY_IMAGE=localhost/e2e-test-registry:devel
-image-registry: export GOOS=linux
-image-registry: export GOARCH=amd64
-image-registry: ## Build the testdata catalog used for e2e tests and push it to the image registry
-	# Use double quotes (not single quotes) for build flags like -ldflags, -tags, etc.
-	# Single quotes are passed literally and not stripped by `go build`, which can cause errors
-	# or inject unintended characters into the binary (e.g., version metadata).
-	go build $(GO_BUILD_FLAGS) $(GO_BUILD_EXTRA_FLAGS) -tags '$(GO_BUILD_TAGS)' -ldflags "$(GO_BUILD_LDFLAGS)" -gcflags '$(GO_BUILD_GCFLAGS)' -asmflags '$(GO_BUILD_ASMFLAGS)' -o ./testdata/push/bin/push         ./testdata/push/push.go
-	$(CONTAINER_RUNTIME) build -f ./testdata/Dockerfile -t $(E2E_REGISTRY_IMAGE) ./testdata
-	$(KIND) load docker-image $(E2E_REGISTRY_IMAGE) --name $(KIND_CLUSTER_NAME)
-	./testdata/build-test-registry.sh $(E2E_REGISTRY_NAMESPACE) $(E2E_REGISTRY_NAME) $(E2E_REGISTRY_IMAGE)
 
 # When running the e2e suite, you can set the ARTIFACT_PATH variable to the absolute path
 # of the directory for the operator-controller e2e tests to store the artifacts, which
@@ -323,7 +305,7 @@ test-e2e: GO_BUILD_EXTRA_FLAGS := -cover
 test-e2e: COVERAGE_NAME := e2e
 test-e2e: export MANIFEST := $(STANDARD_RELEASE_MANIFEST)
 test-e2e: export INSTALL_DEFAULT_CATALOGS := false
-test-e2e: run-internal image-registry prometheus e2e e2e-coverage kind-clean #HELP Run e2e test suite on local kind cluster
+test-e2e: run-internal prometheus e2e e2e-coverage kind-clean #HELP Run e2e test suite on local kind cluster
 
 .PHONY: test-experimental-e2e
 test-experimental-e2e: SOURCE_MANIFEST := $(EXPERIMENTAL_E2E_MANIFEST)
@@ -334,8 +316,8 @@ test-experimental-e2e: COVERAGE_NAME := experimental-e2e
 test-experimental-e2e: export MANIFEST := $(EXPERIMENTAL_RELEASE_MANIFEST)
 test-experimental-e2e: export INSTALL_DEFAULT_CATALOGS := false
 test-experimental-e2e: PROMETHEUS_VALUES := helm/prom_experimental.yaml
-test-experimental-e2e: E2E_TIMEOUT := 15m
-test-experimental-e2e: run-internal image-registry prometheus e2e e2e-coverage kind-clean #HELP Run experimental e2e test suite on local kind cluster
+test-experimental-e2e: E2E_TIMEOUT := 20m
+test-experimental-e2e: run-internal prometheus e2e e2e-coverage kind-clean #HELP Run experimental e2e test suite on local kind cluster
 
 .PHONY: prometheus
 prometheus: PROMETHEUS_NAMESPACE := olmv1-system
@@ -352,7 +334,7 @@ test-extension-developer-e2e: SOURCE_MANIFEST := $(STANDARD_E2E_MANIFEST)
 test-extension-developer-e2e: KIND_CLUSTER_NAME := operator-controller-ext-dev-e2e
 test-extension-developer-e2e: export INSTALL_DEFAULT_CATALOGS := false
 test-extension-developer-e2e: export MANIFEST := $(STANDARD_RELEASE_MANIFEST)
-test-extension-developer-e2e: run-internal image-registry extension-developer-e2e kind-clean #HELP Run extension-developer e2e on local kind cluster
+test-extension-developer-e2e: run-internal extension-developer-e2e kind-clean #HELP Run extension-developer e2e on local kind cluster
 
 .PHONY: run-latest-release
 run-latest-release:

docs/designs/testing/2026-04-13-e2e-isolation/design.md

@@ -0,0 +1,118 @@
+# E2E Test Isolation: Per-Scenario Catalogs via Dynamic OCI Image Building
+
+## Problem
+
+E2E test scenarios previously shared cluster-scoped resources (ClusterCatalogs, CRDs, packages),
+causing cascading failures when one scenario left state behind. Parallelism was impossible because
+scenarios conflicted on shared resource names.
+
+## Solution
+
+Each scenario dynamically builds and pushes its own bundle and catalog OCI images at test time,
+parameterized by scenario ID. All cluster-scoped resource names include the scenario ID, making
+conflicts structurally impossible.
+
+```
+Scenario starts
+  -> Generate parameterized bundle manifests (CRD names, deployments, etc. include scenario ID)
+  -> Build + push bundle OCI images to e2e registry via go-containerregistry
+  -> Generate FBC catalog config referencing those bundle image refs
+  -> Build + push catalog OCI image to e2e registry
+  -> Create ClusterCatalog pointing at the catalog image
+  -> Run scenario steps
+  -> Cleanup all resources (including catalog)
+```
+
+### Key Properties
+
+- Every cluster-scoped resource name includes the scenario ID -- no conflicts by construction.
+- Failed scenario state is preserved for debugging without affecting other scenarios.
+- Parallelism (`Concurrency > 1`) is safe without further changes.
+- Adding new scenarios requires zero coordination with existing ones.
+
+## Builder API (`test/internal/catalog/`)
+
+Bundles are defined as components of a catalog. A single `Build()` call builds and pushes
+all bundle images, generates the FBC, and pushes the catalog image:
+
+```go
+cat := catalog.NewCatalog("test", scenarioID,
+    catalog.WithPackage("test",
+        catalog.Bundle("1.0.0", catalog.WithCRD(), catalog.WithDeployment(), catalog.WithConfigMap()),
+        catalog.Bundle("1.2.0", catalog.WithCRD(), catalog.WithDeployment()),
+        catalog.Channel("beta", catalog.Entry("1.0.0"), catalog.Entry("1.2.0")),
+    ),
+)
+result, err := cat.Build(ctx, "v1", localRegistry, clusterRegistry)
+// result.CatalogName     = "test-catalog-{scenarioID}"
+// result.CatalogImageRef = "{clusterRegistry}/e2e/test-catalog-{scenarioID}:v1"
+// result.PackageNames    = {"test": "test-{scenarioID}"}
+```
+
+### Bundle Options
+
+- `WithCRD()` -- CRD with group `e2e-{id}.e2e.operatorframework.io`
+- `WithDeployment()` -- Deployment named `test-operator-{id}` (includes CSV, script ConfigMap, NetworkPolicy)
+- `WithConfigMap()` -- additional test ConfigMap
+- `WithInstallMode(modes...)` -- sets supported install modes on the CSV
+- `WithLargeCRD(fieldCount)` -- CRD with many fields for large bundle testing
+- `WithClusterRegistry(host)` -- overrides the cluster-side registry host (for mirror testing)
+- `StaticBundleDir(dir)` -- reads pre-built bundle manifests without parameterization (e.g. webhook-operator)
+- `BadImage()` -- uses an invalid container image to trigger ImagePullBackOff
+- `WithBundleProperty(type, value)` -- adds a property to bundle metadata
+
+## Feature File Conventions
+
+Feature files define catalogs inline via data tables:
+
+```gherkin
+Background:
+  Given OLM is available
+  And an image registry is available
+  And a catalog "test" with packages:
+    | package | version | channel | replaces | contents                   |
+    | test    | 1.0.0   | alpha   |          | CRD, Deployment, ConfigMap |
+    | test    | 1.0.1   | alpha   | 1.0.0    | CRD, Deployment, ConfigMap |
+    | test    | 1.2.0   | beta    |          | CRD, Deployment            |
+```
+
+### Variable Substitution
+
+Templates in feature file YAML use these variables:
+
+| Variable | Expansion | Example |
+|----------|-----------|---------|
+| `${NAME}` | ClusterExtension name | `ce-abc123` |
+| `${TEST_NAMESPACE}` | Scenario namespace | `ns-abc123` |
+| `${SCENARIO_ID}` | Unique scenario identifier | `abc123` |
+| `${PACKAGE:<name>}` | Parameterized package name | `test-abc123` |
+| `${CATALOG:<name>}` | ClusterCatalog resource name | `test-catalog-abc123` |
+| `${COS_NAME}` | ClusterObjectSet name | `cos-abc123` |
+
+### Naming Conventions
+
+| Resource | Pattern |
+|----------|---------|
+| CRD group | `e2e-{id}.e2e.operatorframework.io` |
+| Deployment | `test-operator-{id}` |
+| Package name (FBC) | `{package}-{id}` |
+| Bundle image | `{registry}/bundles/{package}-{id}:v{version}` |
+| Catalog image | `{registry}/e2e/{name}-catalog-{id}:{tag}` |
+| ClusterCatalog | `{name}-catalog-{id}` |
+| Namespace | `ns-{id}` |
+| ClusterExtension | `ce-{id}` |
+
+## Registry Access
+
+An in-cluster OCI registry (`test/internal/registry/`) stores bundle and catalog images.
+The registry runs as a ClusterIP Service; there is no NodePort or kind `extraPortMappings`.
+
+The test runner reaches the registry via **Kubernetes port-forward** (SPDY through the API
+server), which works regardless of the cluster's network topology. A `sync.OnceValues` in the
+step definitions starts the port-forward once and returns the dynamically assigned
+`localhost:<port>` address used for all `crane.Push` / `crane.Tag` calls.
+
+In-cluster components (e.g. the catalog unpacker) pull images using the Service DNS name
+(`docker-registry.operator-controller-e2e.svc.cluster.local:5000`), resolved by CoreDNS.
+Containerd on the node is never involved because the registry only holds OCI artifacts
+consumed by Go code, not container images for pods.

go.mod

@@ -31,9 +31,9 @@ require (
 	github.com/stretchr/testify v1.11.1
 	go.podman.io/image/v5 v5.39.2
 	golang.org/x/exp v0.0.0-20260209203927-2842357ff358
-	golang.org/x/mod v0.34.0
+	golang.org/x/mod v0.35.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/tools v0.43.0
+	golang.org/x/tools v0.44.0
 	helm.sh/helm/v3 v3.20.2
 	k8s.io/api v0.35.3
 	k8s.io/apiextensions-apiserver v0.35.3
@@ -90,6 +90,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.2.1 // indirect
+	github.com/creack/pty v1.1.24 // indirect
 	github.com/cucumber/gherkin/go/v26 v26.2.0 // indirect
 	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
@@ -141,6 +142,7 @@ require (
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
@@ -172,6 +174,7 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
@@ -182,6 +185,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
 	github.com/onsi/gomega v1.39.1 // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
@@ -226,12 +230,12 @@ require (
 	go.podman.io/storage v1.62.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/genproto v0.0.0-20260209200024-4cfbd4190f57 // indirect