EP #1914: Add trust-manager E2E tests#434
EP #1914: Add trust-manager E2E tests#434openshift-app-platform-shift[bot] wants to merge 3 commits into
Conversation
…tion Add the TrustManager CRD (trustmanagers.operator.openshift.io/v1alpha1) as specified in EP #1914 to enable cert-manager-operator to deploy and manage the trust-manager operand. New types include: - TrustManager: cluster-scoped singleton CR (name must be "cluster") - TrustManagerSpec/TrustManagerConfig: operand configuration including logLevel, logFormat, trustNamespace, secretTargets, defaultCAPackage, filterExpiredCertificates, and scheduling options - SecretTargetsConfig: CEL-validated union of policy + authorizedSecrets - DefaultCAPackageConfig: enable/disable OpenShift trusted CA bundle - FilterExpiredCertificatesPolicy, SecretTargetsPolicy, DefaultCAPackagePolicy: enum types for policy configuration - TrustManagerStatus: observed state with conditions and policy status Also adds: - TrustManager feature gate (Default: false, PreRelease: Alpha) - Generated deepcopy, CRD manifest, client, informer, lister code - Integration tests validating CRD schema, singleton, immutability, and cross-field validation rules - YAML test suite covering create/update validation scenarios Ref: openshift/enhancements#1914 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implement the trust-manager controller following the established istiocsr controller patterns. The controller manages the lifecycle of trust-manager operand deployment in the cert-manager namespace. Key implementation details: - Controller package at pkg/controller/trustmanager/ with full reconciliation logic for Deployment, ServiceAccount, RBAC, and Service resources - Static manifest templates in bindata/trust-manager/ for all managed resources - Feature gate integration: controller only registers when TrustManager feature gate is enabled (Alpha, disabled by default) - Combined cache builder in setup_manager.go ensures label-filtered resources from both istiocsr and trustmanager controllers are properly cached - SecretTargets RBAC: dynamically creates/removes ClusterRole and ClusterRoleBinding based on SecretTargets policy (Custom vs Disabled) - DefaultCAPackage support: creates ConfigMap with OpenShift trusted CA bundle injection annotation when enabled - Cleanup logic: removes cluster-scoped resources (ClusterRoles, ClusterRoleBindings) on TrustManager CR deletion - Updates features test to include TrustManager in the disabled-by-default feature list and fixes ordering comparison Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add end-to-end tests for the trust-manager controller covering: - Basic lifecycle: resource creation, Ready condition, cleanup on deletion - Deployment reconciliation: drift detection, log level/format configuration - Secret targets policy: RBAC creation when Custom, absence when Disabled - Default CA package: ConfigMap with injection annotation, deployment args - Filter expired certificates: deployment arg verification for both policies Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-app-platform-shift[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @openshift-app-platform-shift[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/close |
|
@swghosh: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Summary
istio_csr_test.gousing Ginkgo/Gomega, dynamic resource loader, and Go template-based CR manifestsTest Coverage
--filter-expired-certs=true/falsedeployment arg verificationNew Files
test/e2e/trust_manager_test.go— 11 E2E test cases with helper functionstest/e2e/testdata/trust_manager/trust_manager_template.yaml— Go template for TrustManager CRTest plan
go vet -tags e2e ./test/e2e/...passesFeature:TrustManagerlabel on a cluster with TrustManager feature gate enabledDependencies
🤖 Generated with Claude Code