[WIP] CNTRLPLANE-2589: Migrate test/e2e-encryption-rotation to OpenShift Tests Extension framework

[ropatil010]

Hi Team,

Migrate encryption rotation tests to support both standard Go tests and Ginkgo/OTE framework.

Changes:

1. Add Ginkgo test wrapper for OTE compatibility (encryption_rotation.go)
2. Simplify e2e-encryption-rotation_test.go to call shared test function
3. Register new test suite in main.go
4. Use library.AuthTargetGRs and library.AssertTokens from vendor

The test now works in both modes:

• Standard Go: TestEncryptionRotation(t *testing.T)
• Ginkgo/OTE: g.It(..., func(ctx) { testEncryptionRotation(ctx, g.GinkgoTB()) })

Summary by CodeRabbit

• New Features

  • Added end-to-end coverage for encryption key rotation in the authentication/operator test suite.
  • Registered the new rotation suite to run in a dedicated serial configuration.

• Tests

  • Simplified the encryption-rotation test entrypoint to delegate execution to shared helper logic.
  • Implemented a rotation flow that creates token resources, triggers encryption config override on the operator, and verifies the subsequent rotation completes successfully.

[openshift-ci-robot]

@ropatil010: This pull request references CNTRLPLANE-2589 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Hi Team,

Migrate encryption rotation tests to support both standard Go tests and Ginkgo/OTE framework.

Changes:

1. Add Ginkgo test wrapper for OTE compatibility (encryption_rotation.go)
2. Simplify e2e-encryption-rotation_test.go to call shared test function
3. Register new test suite in main.go
4. Use library.AuthTargetGRs and library.AssertTokens from vendor

The test now works in both modes:

• Standard Go: TestEncryptionRotation(t *testing.T)
• Ginkgo/OTE: g.It(..., func(ctx) { testEncryptionRotation(ctx, g.GinkgoTB()) })

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 193d4eeb-f714-4855-a268-b3856c019b71

📥 Commits

Reviewing files that changed from the base of the PR and between d5764b8 and cb0f813.

📒 Files selected for processing (1)

• cmd/cluster-authentication-operator-tests-ext/main.go

---

Walkthrough

The encryption-rotation E2E test now uses a shared library-based scenario, and the operator test binary registers that scenario as a new serial suite filtered for encryption-rotation tests.

Changes

Encryption rotation E2E wiring

Layer / File(s)	Summary
Scenario wiring and helper test/e2e-encryption-rotation/encryption_rotation.go, test/e2e-encryption-rotation/e2e-encryption-rotation_test.go	Adds a Ginkgo-based encryption-rotation test that delegates to library.TestEncryptionRotation with token create/read callbacks, unsupported config override updates, and a wait hook; the old standalone test body is reduced to a wrapper.
Test binary registration cmd/cluster-authentication-operator-tests-ext/main.go	Adds the blank import for the new test package and registers an operator-encryption-rotation/serial suite with serial execution and disruptive cluster stability, filtered by encryption-rotation Ginkgo name fragments.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GinkgoTest as Ginkgo test
  participant Library as library.TestEncryptionRotation
  participant Operator as cluster-authentication-operator
  participant OAuthAPIServer as oauth apiserver

  GinkgoTest->>Library: run RotationScenario
  Library->>OAuthAPIServer: create and read token resources
  Library->>Operator: update unsupportedConfigOverrides
  Operator->>OAuthAPIServer: apply new encryption config
  Library->>OAuthAPIServer: wait for next key rotation

Loading

Possibly related PRs

• openshift/cluster-authentication-operator#926: Both PRs update cmd/cluster-authentication-operator-tests-ext/main.go to register new encryption-focused OTE suites with similar serial/disruptive setup and Ginkgo name filtering.
• openshift/cluster-authentication-operator#935: Both PRs change the encryption-rotation test wiring to use shared library.TestEncryptionRotation-style helpers.

Suggested reviewers: atiratree

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Microshift Test Compatibility	⚠️ Warning	The new Ginkgo test lacks any MicroShift skip/tag and uses config.openshift.io plus oauth.openshift.io APIs via the encryption library.	Add a [Skipped:MicroShift] label or runtime MicroShift guard; alternatively tag the test with the unavailable API group(s) so MicroShift CI skips it.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	FAIL: the new Ginkgo path calls encryption helpers that hardcode 127.0.0.1 for etcd port-forward endpoints, which is IPv4-only and lacks ::1 fallback.	Use IPv6-safe localhost handling (e.g. net.JoinHostPort/::1 fallback) and verify in periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-serial-ovn-ipv6.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: migrating the encryption rotation test to the OpenShift Tests Extension framework.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The only Ginkgo title in the new test is static ([Encryption][Serial] TestEncryptionRotation); no dynamic or changing values appear in test names.
Test Structure And Quality	✅ Passed	The new Ginkgo wrapper is a single-purpose rotation flow, uses explicit poll/context timeouts, and follows the repo’s existing encryption-test patterns.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The new Ginkgo test only exercises OAuth token encryption/rotation via APIServer config and library helpers; no node-count, scheduling, or HA assumptions found.
Topology-Aware Scheduling Compatibility	✅ Passed	Only test code and OTE registry entries changed; no node selectors, affinity, PDBs, replicas, or topology-dependent scheduling were added.
Ote Binary Stdout Contract	✅ Passed	PASS: main() redirects klog to stderr and the touched test files contain no fmt/log stdout writes or suite-level prints; only Ginkgo spec registration and test-body code.
No-Weak-Crypto	✅ Passed	Touched files only add test wiring and use library-go helpers; searches found no MD5/SHA1/DES/RC4/ECB or custom crypto/token comparisons added.
Container-Privileges	✅ Passed	PR only changes Go test/OTE registration code; no container/K8s manifests or privilege/securityContext fields were added.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging of secrets, tokens, PII, or hostnames was added in the PR diff; changed code only adjusts suite registration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🧹 Nitpick comments (1)

test/e2e-encryption-rotation/encryption_rotation.go (1)

34-34: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Drop unnecessary fmt.Sprintf.

fmt.Sprintf("encryption-config-openshift-oauth-apiserver") has no format directives — use the string literal directly.

♻️ Proposed fix

-			EncryptionConfigSecretName:      fmt.Sprintf("encryption-config-openshift-oauth-apiserver"),
+			EncryptionConfigSecretName:      "encryption-config-openshift-oauth-apiserver",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e-encryption-rotation/encryption_rotation.go` at line 34, The
EncryptionConfigSecretName assignment in encryption_rotation.go uses fmt.Sprintf
with a ثابت string and no format directives, so remove the unnecessary
formatting call and set the value directly as a string literal in the encryption
rotation test setup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e-encryption-rotation/encryption_rotation.go`:
- Line 34: The EncryptionConfigSecretName assignment in encryption_rotation.go
uses fmt.Sprintf with a ثابت string and no format directives, so remove the
unnecessary formatting call and set the value directly as a string literal in
the encryption rotation test setup.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 710b9106-e365-4389-abee-d1015241063d

📥 Commits

Reviewing files that changed from the base of the PR and between e35c554 and d5764b8.

📒 Files selected for processing (3)

• cmd/cluster-authentication-operator-tests-ext/main.go
• test/e2e-encryption-rotation/e2e-encryption-rotation_test.go
• test/e2e-encryption-rotation/encryption_rotation.go

[openshift-ci]

@ropatil010: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator-encryption	cb0f813	link	true	/test e2e-operator-encryption
ci/prow/e2e-aws-operator-encryption-rotation-serial-ote-1of2	cb0f813	link	false	/test e2e-aws-operator-encryption-rotation-serial-ote-1of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.