NE-2788: exempt ingress Upgradeable=False for deprecated HAProxy versions

[gcs278]

Summary

Add an exemption in the [sig-arch][Early] start all core operators test to allow the ingress ClusterOperator to report Upgradeable=False when caused by a deprecated HAProxy version.

Why

The ingress operator sets Upgradeable=False when any IngressController has effectiveHAProxyVersion set to a deprecated version (e.g. HAProxy 2.8 on OCP 5.0). CI jobs that test non-default HAProxy versions intentionally trigger this condition via the ingress-conf-haproxy-version CI step, which annotates ingresses.config.openshift.io/cluster to override the default HAProxy version cluster-wide.

Without this exemption, every haproxy28 CI job fails on the "start all core operators" test because the ingress ClusterOperator reports Upgradeable=False — even though the cluster is fully functional and the condition is expected.

Unblocks openshift/release#83065 (presubmits) and openshift/release#83066 (nightly periodics).

Pattern

This follows the existing exemption pattern for:

• kube-apiserver / config-operator — TechPreviewNoUpgrade feature gates
• cloud-controller-manager — AlibabaCloud platform
• network — Kuryr / OpenShiftSDN deprecation

Test plan

• Verify haproxy28 conformance job no longer fails on "start all core operators"
• Verify non-haproxy28 jobs still catch unexpected ingress Upgradeable=False conditions

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Updated operator readiness checks to ignore known ingress conditions caused by deprecated HAProxy versions.
  • Improved test matching to recognize these conditions based on their status, type, reason, and message details.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@gcs278: This pull request references NE-2788 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Add an exemption in the [sig-arch][Early] start all core operators test to allow the ingress ClusterOperator to report Upgradeable=False when caused by a deprecated HAProxy version.

Why

The ingress operator sets Upgradeable=False when any IngressController has effectiveHAProxyVersion set to a deprecated version (e.g. HAProxy 2.8 on OCP 5.0). CI jobs that test non-default HAProxy versions intentionally trigger this condition via the ingress-conf-haproxy-version CI step, which annotates ingresses.config.openshift.io/cluster to override the default HAProxy version cluster-wide.

Without this exemption, every haproxy28 CI job fails on the "start all core operators" test because the ingress ClusterOperator reports Upgradeable=False — even though the cluster is fully functional and the condition is expected.

Pattern

This follows the existing exemption pattern for:

• kube-apiserver / config-operator — TechPreviewNoUpgrade feature gates
• cloud-controller-manager — AlibabaCloud platform
• network — Kuryr / OpenShiftSDN deprecation

Test plan

• Verify haproxy28 conformance job no longer fails on "start all core operators"
• Verify non-haproxy28 jobs still catch unexpected ingress Upgradeable=False conditions

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a895d09c-6222-4d05-94c4-42dba12a76e1

📥 Commits

Reviewing files that changed from the base of the PR and between e5154f0 and 0764339.

📒 Files selected for processing (1)

• test/extended/operators/operators.go

🚧 Files skipped from review as they are similar to previous changes (1)

• test/extended/operators/operators.go

---

Walkthrough

The operator readiness test now ignores ingress Upgradeable=False conditions caused by deprecated HAProxy versions. A helper matches the condition reason, status, type, and spec.haproxyVersion in the message.

Changes

Operator readiness

Layer / File(s)	Summary
Filter deprecated HAProxy conditions test/extended/operators/operators.go	The readiness check identifies matching IngressControllersNotUpgradeable conditions and excludes them from the unready operator list.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: deads2k, sdodson

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the exemption for ingress Upgradeable=False conditions caused by deprecated HAProxy versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch adds only exemption logic and a helper. Existing Ginkgo titles remain static: "start all core operators" and "have operators on the cluster version".
Test Structure And Quality	✅ Passed	The change adds only a focused ingress-condition predicate and skip to the existing single-purpose It block; it creates no resources, adds no waits, and passes diff checks.
Microshift Test Compatibility	✅ Passed	The change adds an exemption to an existing test, not a new Ginkgo test; its enclosing Describe has [apigroup:config.openshift.io], so MicroShift CI skips it.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds no new Ginkgo test. The diff only updates the existing operator test and adds a non-Ginkgo HAProxy condition helper, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only a ClusterOperator readiness-test exemption in test/extended/operators/operators.go; it adds no deployments, controllers, replicas, affinities, selectors, tolerations, or other s...
Ote Binary Stdout Contract	✅ Passed	The PR adds only condition-matching logic and a test-body exemption; it adds no stdout writes, logging setup, or process-level initialization code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit only changes an existing operator test's condition exemption and adds a helper; it adds no Ginkgo test declarations, IPv4 assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	The 19-line PR change only adds HAProxy condition matching and an ingress exemption; it adds no weak crypto, custom crypto, or secret comparison code.
Container-Privileges	✅ Passed	The PR changes only a Go test file. Added lines contain no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The 19 added lines only add a condition check and comments; they do not log or print passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jcmoraisjr]

/lgtm

[jcmoraisjr]

/lgtm

[gcs278]

/hold for CI signal via testwith on openshift/router#832

[smg247]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gcs278, jcmoraisjr, smg247

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/extended/operators/OWNERS [smg247]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gcs278]

/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[gcs278]

unrelated
/retest

[gcs278]

testwith openshift/router#832 signal showing start all core operators is no longer failing.
/unhold

CI Signal is not failing for other pre-submits either.
/verified by CI

[openshift-ci-robot]

@gcs278: This PR has been marked as verified by CI.

Details

In response to this:

testwith openshift/router#832 signal showing start all core operators is no longer failing.
/unhold

CI Signal is not failing for other pre-submits either.
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 3d514be and 2 for PR HEAD 0764339 in total