OCPBUGS-86611: Wait for namespace initialization before creating pod

[bfournie]

Fix timing issue by waiting for the openshift.io/sa.scc.uid-range annotation to be set by the namespace controller before creating the pod.

Summary by CodeRabbit

• Tests
  • Enhanced test infrastructure for namespace operations to ensure proper configuration state during testing.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@bfournie: This pull request references Jira Issue OCPBUGS-86611, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Fix timing issue by waiting for the 'openshift.io/sa.scc.uid-range' annotation to be set by the namespace controller before creating the pod.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a54beb34-f616-4713-8d7a-1250d673d4d6

📥 Commits

Reviewing files that changed from the base of the PR and between 0f44179 and a3dc894.

📒 Files selected for processing (1)

• test/extended/internalreleaseimage/helper.go

---

Walkthrough

The PR adds a polling mechanism to the CreateSimpleNamespace() test helper in test/extended/internalreleaseimage/helper.go. After creating a namespace, the helper now waits for the Kubernetes namespace controller to set the openshift.io/sa.scc.uid-range annotation before returning, with a 30-second timeout and 500ms polling interval.

Changes

Namespace SCC Annotation Polling

Layer / File(s)	Summary
Namespace annotation polling with wait logic test/extended/internalreleaseimage/helper.go	time and wait utilities are imported; CreateSimpleNamespace() docstring is updated to note annotation waiting behavior; a polling loop repeatedly reads the namespace and checks for the openshift.io/sa.scc.uid-range annotation, failing the test if not observed within 30 seconds.

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: waiting for namespace initialization (specifically the annotation) before creating a pod, which aligns with the actual code changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR modifies only helper.go, which contains no Ginkgo test definitions. Test titles in internalreleaseimage.go use stable, static strings without dynamic values.
Test Structure And Quality	✅ Passed	CreateSimpleNamespace() meets all criteria: single responsibility, proper cleanup via defer, explicit 30-second timeout, meaningful error messages, consistent with codebase patterns.
Microshift Test Compatibility	✅ Passed	PR does not add new Ginkgo e2e tests; it only modifies helper function CreateSimpleNamespace() to add namespace initialization polling. Custom check applies only when new tests are added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds Ginkgo test suites for InternalReleaseImage feature which test cluster-level resources and APIs. Tests make no multi-node assumptions and are fully compatible with SNO.
Topology-Aware Scheduling Compatibility	✅ Passed	Test helper change adds namespace annotation polling; introduces no scheduling constraints, affinity rules, replica logic, or topology assumptions.
Ote Binary Stdout Contract	✅ Passed	CreateSimpleNamespace() is called within Ginkgo test blocks (g.It), not process-level code. Ginkgo intercepts test block stdout, preventing OTE stdout contract violations.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	New tests contain no IPv4 hardcoded IPs or assumptions. Tests designed for disconnected clusters with internal IDMS mirroring, compatible with IPv6-only environments.
No-Weak-Crypto	✅ Passed	The PR contains no weak cryptography usages, custom crypto implementations, or non-constant-time comparisons of secrets. It only modifies namespace initialization logic.
Container-Privileges	✅ Passed	PR modifies test helper code only, adding namespace initialization wait logic. No container manifests with privileged, hostPID, hostNetwork, or allowPrivilegeEscalation settings found.
No-Sensitive-Data-In-Logs	✅ Passed	CreateSimpleNamespace function only logs auto-generated test namespace names and test pod identifiers; no passwords, tokens, API keys, PII, or sensitive data exposed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@bfournie: This pull request references Jira Issue OCPBUGS-86611, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Fix timing issue by waiting for the openshift.io/sa.scc.uid-range annotation to be set by the namespace controller before creating the pod.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bfournie]

/test ?

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[pawanpinjarkar]

/lgtm

[bfournie]

/verified later @bfournie

[openshift-ci-robot]

@bfournie: This PR has been marked to be verified later by @bfournie.

Details

In response to this:

/verified later @bfournie

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bfournie, pawanpinjarkar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/extended/internalreleaseimage/OWNERS [bfournie,pawanpinjarkar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@bfournie: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@bfournie: Jira Issue OCPBUGS-86611: All pull requests linked via external trackers have merged:

• openshift/origin#31225

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-86611 has been moved to the MODIFIED state.

Details

In response to this:

Fix timing issue by waiting for the openshift.io/sa.scc.uid-range annotation to be set by the namespace controller before creating the pod.

Summary by CodeRabbit

• Tests
• Enhanced test infrastructure for namespace operations to ensure proper configuration state during testing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.