Skip to content

test(e2e): add orchestrator RBAC e2e tests #4009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
chadcrum wants to merge 3 commits into
base: main
Choose a base branch
from
Open

test(e2e): add orchestrator RBAC e2e tests #4009

chadcrum wants to merge 3 commits into from
+1,618 −9

Conversation

@chadcrum
Copy link
Contributor

@chadcrum chadcrum commented Jan 15, 2026 •
edited
Loading

Summary

Add comprehensive RBAC end-to-end tests for the orchestrator plugin, cherry-picked and adapted from release-1.7 branch (commit a6af1b0).

Changes

New file: orchestrator-rbac.spec.ts (+1,557 lines)

  • 7 test suites covering orchestrator RBAC scenarios:
    • Global workflow access (read/write, read-only, denied)
    • Individual workflow access controls
    • Workflow instance initiator isolation
    • Admin override capabilities for cross-user instance access

Modified: rbac.spec.ts (+61/-9 lines)

  • Re-enabled RBAC API validation test (previously test.fixme)
  • Added filtering logic to exclude dynamically created workflow roles/policies
  • Prevents test interference when orchestrator RBAC tests run in parallel

Test Coverage

Test Suite Permissions Expected Behavior
Global Read/Write orchestrator.workflow read + update Full access to all workflows
Global Read-Only orchestrator.workflow read, update denied View workflows, Run button disabled
Global Denied All denied No workflows visible
Individual Denied Specific workflow denied That workflow hidden
Individual Read/Write Specific workflow allowed Only that workflow accessible
Individual Read-Only Specific workflow read-only View only, cannot run
Instance Isolation User + Admin roles Users see only own instances; admins see all

Technical Notes

  • Tests use test.describe.serial for proper sequencing of role creation → verification → UI testing → cleanup
  • Each test suite has proper afterAll cleanup to remove created roles/policies
  • Filtering logic uses regex /^role:default\/workflow/i to exclude test-created roles from RBAC API validation

Test Plan

  • CI passes on showcase-rbac and showcase-operator-rbac projects
  • Orchestrator RBAC tests execute without interfering with existing RBAC tests

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

@chadcrum @claude
test: add e2e orchestrator rbac tests (noop)
76e549b 
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@chadcrum
Copy link
Contributor Author

chadcrum commented Jan 15, 2026

/ok-to-test

@chadcrum
Copy link
Contributor Author

chadcrum commented Jan 15, 2026

/test e2e-ocp-helm

@github-actions
Copy link
Contributor

github-actions bot commented Jan 15, 2026

The image is available at:

/test e2e-ocp-helm

chadcrum and others added 2 commits January 15, 2026 18:05
@chadcrum @claude
test(e2e): add orchestrator RBAC e2e test suite
57ee9d4 
Add comprehensive RBAC end-to-end tests for the orchestrator plugin
with role-based access control validation including:

- Global workflow access (read/write, read-only, denied)
- Individual workflow access controls
- Workflow instance initiator isolation
- Admin override capabilities for cross-user instance access

Cherry-picked from commit a6af1b0 (release-1.7 branch).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@chadcrum @claude
fix(e2e): enable RBAC API test with workflow role filtering
aee3607 
Re-enable the RBAC API validation test (previously test.fixme) with
filtering logic to prevent test interference during parallel execution.

Changes:
- Add Role import from rbac-api-structures
- Filter out dynamically created workflow roles/policies matching
  /^role:default\/workflow/i pattern before validation
- Change validation from exact match to "expected roles exist" check

This allows the RBAC API test to run alongside orchestrator RBAC tests
which dynamically create workflowUser/workflowAdmin roles.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@chadcrum
Copy link
Contributor Author

chadcrum commented Jan 15, 2026

/test e2e-ocp-operator-nightly

@openshift-ci
Copy link

openshift-ci bot commented Jan 15, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign gustavolira for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@chadcrum chadcrum changed the title test: add e2e orchestrator rbac tests test(e2e): add orchestrator RBAC e2e tests Jan 15, 2026
@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 15, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@chadcrum
Copy link
Contributor Author

chadcrum commented Jan 15, 2026

/test e2e-ocp-operator-nightly

@chadcrum
Copy link
Contributor Author

chadcrum commented Jan 16, 2026

/retest-required

@github-actions
Copy link
Contributor

github-actions bot commented Jan 16, 2026

The image is available at:

/test e2e-ocp-helm

@openshift-ci
Copy link

openshift-ci bot commented Jan 16, 2026

@chadcrum: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-ocp-operator-nightly aee3607 link false /test e2e-ocp-operator-nightly
ci/prow/e2e-ocp-helm aee3607 link true /test e2e-ocp-helm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chadcrum