OCPBUGS-97603: Use framework-managed namespace for workload test

[andfasano]

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Summary by CodeRabbit

• Tests
  • Updated internal release image test setup to use a non-namespace-specific CLI and the framework-managed namespace during cluster install checks.
  • Simplified test workflow by removing custom namespace creation, polling for SCC annotation readiness, and namespace deletion/cleanup behavior.
  • Adjusted test logging to reflect the new namespace handling and streamlined helper usage.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@andfasano: This pull request references Jira Issue OCPBUGS-97603, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[andfasano]

cc @bfournie

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andfasano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/extended/internalreleaseimage/OWNERS [andfasano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[andfasano]

/test ?

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1cb093f7-48b1-418f-9ec2-489bc36fe959

📥 Commits

Reviewing files that changed from the base of the PR and between 8a824c0 and 3f61d95.

📒 Files selected for processing (2)

• test/extended/internalreleaseimage/helper.go
• test/extended/internalreleaseimage/internalreleaseimage.go

🚧 Files skipped from review as they are similar to previous changes (2)

• test/extended/internalreleaseimage/helper.go
• test/extended/internalreleaseimage/internalreleaseimage.go

---

Walkthrough

Removes the internal release image namespace helper methods and unused imports, and updates the test to use the CLI-managed framework namespace instead of creating and deleting a separate namespace.

Changes

Internal release image namespace handling

Layer / File(s)	Summary
Helper removal and imports test/extended/internalreleaseimage/helper.go	Removes CreateSimpleNamespace and DeleteNamespace, along with the now-unused time and wait imports.
CLI namespace use in the test test/extended/internalreleaseimage/internalreleaseimage.go	Switches CLI setup to exutil.NewCLI("no-registry") and uses oc.Namespace() for pod setup instead of creating a separate namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching the workload test to use the framework-managed namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The changed Ginkgo titles are static string literals; no fmt.Sprintf, concatenation, timestamps, UUIDs, or runtime-derived names appear in test titles.
Test Structure And Quality	✅ Passed	PASS: Each It is focused, setup uses BeforeEach, pod cleanup is deferred and namespace cleanup is framework-managed, waits are bounded, and assertions include messages.
Microshift Test Compatibility	✅ Passed	The modified e2e tests are tagged [apigroup:machineconfiguration.openshift.io], so MicroShift CI skips them; the namespace change removes extra setup rather than adding unsupported APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The modified IRI test only creates one pod in the framework namespace and adds no node-count, anti-affinity, drain, or topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only test helper/namespace setup changed; no manifests, controllers, node selectors, or affinity/spread constraints were added.
Ote Binary Stdout Contract	✅ Passed	No main/init/TestMain or top-level stdout writes were added; the new exutil.NewCLI("no-registry") initializer only registers setup and does not print.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No IPv4 literals, IP parsing, or public-host connectivity found; the new pod uses the framework namespace and an IDMS-verified mirrored release image.
No-Weak-Crypto	✅ Passed	Touched files only adjust test namespace handling; searches found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret-comparison code.
Container-Privileges	✅ Passed	Diff only touches two Go tests; no privileged/host* settings or insecure manifests were added, and the new pod uses restricted security contexts.
No-Sensitive-Data-In-Logs	✅ Passed	The patch removes namespace creation/deletion logs and adds only a generic By message; no new passwords, tokens, or hostnames are logged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@andfasano: This pull request references Jira Issue OCPBUGS-97603, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

This patch covers the occasional issue related to the test namespace creation.

Assisted-by: Claude

Summary by CodeRabbit

• Tests
• Updated internal release image test setup to use the framework-managed namespace during cluster install checks.
• Simplified test helper usage by removing custom namespace creation and cleanup steps.
• Adjusted test logging to match the new namespace handling.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[andfasano]

/test verify

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[openshift-ci]

@andfasano: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bfournie]

Testing this in an installed ISO_NO_REGISTRY cluster, I see a timeout waiting for the default SA

[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io]
  github.com/openshift/origin/test/extended/internalreleaseimage/internalreleaseimage.go:163
    STEP: Creating a kubernetes client @ 07/06/26 19:25:30.932
  I0706 19:25:30.933802   12058 discovery.go:214] Invalidating discovery information
  I0706 19:25:31.017313 12058 client.go:293] configPath is now "/tmp/configfile3685918507"
  I0706 19:25:31.017345 12058 client.go:368] The user is now "e2e-test-no-registry-fshvs-user"
  I0706 19:25:31.017355 12058 client.go:370] Creating project "e2e-test-no-registry-fshvs"
  I0706 19:25:31.106030 12058 client.go:378] Waiting on permissions in project "e2e-test-no-registry-fshvs" ...
  I0706 19:25:31.134728 12058 client.go:407] DeploymentConfig capability is enabled, adding 'deployer' SA to the list of default SAs
  I0706 19:25:31.140852 12058 client.go:422] Waiting for ServiceAccount "default" to be provisioned...
  I0706 19:25:31.249367 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...
  I0706 19:25:31.350374 12058 framework.go:1201] Waiting for service account "default" secrets () to include dockercfg ...

I tested a fix to test/extended/util/client.go to skip the default SA in test/extended/util/client.go

--- a/test/extended/util/client.go
+++ b/test/extended/util/client.go
@@ -409,10 +409,20 @@ func (c *CLI) setupProject() string {
                defaultRoleBindings = append(defaultRoleBindings, "system:deployers")
        }
 
-       // If image registry is not enabled set default service account and default role bindings to empty slice,
-       // the SA will not contain the docker secret and the role binding is not expected to be present.
-       imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
-       o.Expect(err).NotTo(o.HaveOccurred())
+        // If image registry is not enabled or its management state is Removed, set default service account
+        // and default role bindings to empty slice, as the SA will not contain the docker secret and the
+        // role binding is not expected to be present.
+        imageRegistryEnabled, err := IsCapabilityEnabled(c, configv1.ClusterVersionCapabilityImageRegistry)
+        o.Expect(err).NotTo(o.HaveOccurred())
+        if imageRegistryEnabled {
+                out, err := c.AsAdmin().Run("get").Args("configs.imageregistry.operator.openshift.io", "cluster", "-o", "jsonpath={.spec.managementState}").Output()
+                if err != nil {
+                        framework.Logf("Error checking image registry management state: %v", err)
+                } else if out == "Removed" {
+                        framework.Logf("Image registry management state is Removed, skipping dockercfg secret and role binding checks")
+                        imageRegistryEnabled = false
+                }
+        }

This worked...

  Ran 1 of 1 Specs in 6.906 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-installer][Feature:NoRegistryClusterInstall] Cluster operates without external registry using managed OCP release bundle images when a workload based on the maintained OCP release bundle images is created should run successfully [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/parallel]",
    "lifecycle": "blocking",
    "duration": 6906,
    "startTime": "2026-07-06 18:03:58.022129 UTC",
    "endTime": "2026-07-06 18:04:04.928305 UTC",
    "result": "passed",