CNTRLPLANE-3428: tls fix HyperShift guest-side CO wait and Custom profile handling

[gangwgr]

Fix two issues found in HyperShift CI:

1. waitForGuestOperatorsAfterTLSChange was iterating over all clusterOperatorNames (including etcd, kube-apiserver, etc.) which run on the management cluster. On HyperShift these COs may not stabilize on the guest side after a TLS change, causing a 25m timeout. Use a new guestSideClusterOperatorNames list that only includes guest-side COs (image-registry, openshift-samples).

2. getExpectedMinTLSVersionWithType crashed with "Unknown TLS profile type: Custom" because configv1.TLSProfiles only contains predefined profiles. If a Custom profile is active (e.g. from a failed cleanup), read minTLSVersion directly from the Custom spec instead.

Summary by CodeRabbit

• Bug Fixes
  • Ensure custom TLS profiles correctly determine the minimum TLS version by using explicit custom settings when present.
  • Restrict post-TLS-change stability checks and rollout waiting to guest-side components in HyperShift scenarios.
  • Improve ConfigMap verification after TLS profile switches by polling targets (up to several minutes) until the TLS-injection marker and expected TLS version appear.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 94e302ae-9d37-498d-a7f8-d931ab4a1793

📥 Commits

Reviewing files that changed from the base of the PR and between e3c5d71 and 0a0131e.

📒 Files selected for processing (1)

• test/extended/tls/tls_observed_config.go

---

Walkthrough

Narrow TLS test waits to HyperShift guest-side deployments and operators, poll ConfigMaps until inject-TLS and expected TLS appear, and derive Custom TLSProfile min version from Config.Spec.TLSSecurityProfile.Custom.MinTLSVersion.

Changes

TLS Profile Testing Enhancements

Layer / File(s)	Summary
Rollout target control-plane flag and guest-side selection test/extended/tls/tls_observed_config.go	Adds controlPlane to deploymentRolloutTarget, marks certain targets as control-plane, and implements guestSideDeploymentRolloutTargets to return only non-control-plane targets; introduces guestSideClusterOperatorNames.
Guest-side ClusterOperator polling test/extended/tls/tls_observed_config.go	Updates waitForGuestOperatorsAfterTLSChange to iterate over guestSideClusterOperatorNames instead of clusterOperatorNames when running on the guest.
ConfigMap verification polling test/extended/tls/tls_observed_config.go	verifyConfigMapsForTargets now polls up to 5 minutes for each target ConfigMap to have the inject-TLS annotation and the expected TLS version in data, replacing single-read assertions.
TLSProfile Custom min-version derivation test/extended/tls/tls_observed_config.go	getExpectedMinTLSVersionWithType requires .Custom non-nil for TLSProfileCustomType and reads minTLSVersion from Custom.MinTLSVersion; other profiles continue to use configv1.TLSProfiles mapping.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• openshift/origin#31160: Both PRs modify test/extended/tls/tls_observed_config.go to implement HyperShift guest-side filtering by introducing/using guest-side target/operator subsets and updating wait logic.

Suggested reviewers

• kaleemsiddiqu

🚥 Pre-merge checks | ✅ 10 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	Line 1424 hardcodes 127.0.0.1 for port-forward readiness check, causing IPv6-only environments to fail when port is bound to [::1].	Test both 127.0.0.1 and [::1] with fallback like checkTLSConnection(), or use localhost with dynamic address resolution.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: HyperShift guest-side ClusterOperator wait fix and Custom TLS profile handling improvements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All test names use static values from hardcoded target arrays. No dynamic pod names, timestamps, UUIDs, node names, or IP addresses appear in any test titles.
Test Structure And Quality	✅ Passed	Test code meets all quality requirements: single responsibility per test, proper setup/cleanup patterns, explicit timeouts on waits, meaningful assertion messages, and consistent codebase patterns.
Microshift Test Compatibility	✅ Passed	Both Describe blocks contain BeforeEach blocks that call exutil.IsMicroShiftCluster() with g.Skip(), properly protecting all nested tests from running on MicroShift.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Tests verify TLS configuration without multi-node assumptions. They read config, check ConfigMaps, and use port-forwarding—all SNO-compatible. SNO includes all tested operators.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only test code (test/extended/tls/tls_observed_config.go). No deployment manifests, operators, or controllers are added/modified. No scheduling constraints introduced.
Ote Binary Stdout Contract	✅ Passed	File contains no process-level stdout writes. All logging uses e2e.Logf() within test blocks only; no fmt.Print variants, os.Stdout writes, or uncontrolled klog output found.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gangwgr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/extended/tls/OWNERS [gangwgr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gangwgr]

/test pull-ci-openshift-origin-main-tls-observed-config-hypershift

[gangwgr]

/test pull-ci-openshift-origin-main-tls-observed-config

[gangwgr]

/test tls-observed-config-hypershift
/test tls-observed-config

[gangwgr]

/test tls-observed-config-hypershift
/test tls-observed-config

[openshift-ci-robot]

@gangwgr: This pull request references CNTRLPLANE-3428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Fix two issues found in HyperShift CI:

1. waitForGuestOperatorsAfterTLSChange was iterating over all clusterOperatorNames (including etcd, kube-apiserver, etc.) which run on the management cluster. On HyperShift these COs may not stabilize on the guest side after a TLS change, causing a 25m timeout. Use a new guestSideClusterOperatorNames list that only includes guest-side COs (image-registry, openshift-samples).

2. getExpectedMinTLSVersionWithType crashed with "Unknown TLS profile type: Custom" because configv1.TLSProfiles only contains predefined profiles. If a Custom profile is active (e.g. from a failed cleanup), read minTLSVersion directly from the Custom spec instead.

Summary by CodeRabbit

• Bug Fixes
• Ensure custom TLS profiles correctly determine the minimum TLS version.
• Restrict post-TLS-change stability checks and rollout waiting to guest-side components in HyperShift scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[openshift-ci]

@gangwgr: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/tls-observed-config-hypershift	e3c5d71	link	false	/test tls-observed-config-hypershift
ci/prow/tls-observed-config	e3c5d71	link	false	/test tls-observed-config

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gangwgr]

/test tls-observed-config-hypershift
/test tls-observed-config

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi