CNTRLPLANE-2196: reg ote bin for cluster auth operator #30735

ropatil010 · 2026-01-28T05:20:04Z

Hi Team,

PTAL, Register the OTE binary for cluster-authentication operator.

openshift-ci-robot · 2026-01-28T05:20:06Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-01-28T05:20:08Z

@ropatil010: This pull request references CNTRLPLANE-2196 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Hi Team,

PTAL, Register the OTE binary for cluster-authentication operator.

/assign @wangke19 @gangwgr @sandeepknd

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ropatil010 · 2026-01-28T05:20:43Z

/pipeline required

openshift-ci-robot · 2026-01-28T05:20:47Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

ropatil010 · 2026-01-28T09:59:52Z

/retest
just to double confirm the failures are not related to the changes from this PR

jsafrane · 2026-01-28T13:03:14Z

Please ignore this test, I am just mis-using your PR to capture the test logs on an innocent change.
/test e2e-gcp-ovn-techpreview

ropatil010 · 2026-01-28T13:29:55Z

/test e2e-gcp-ovn

openshift-ci · 2026-01-28T16:27:50Z

@ropatil010: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-ovn-techpreview	`21e8410`	link	false	`/test e2e-gcp-ovn-techpreview`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

gangwgr · 2026-01-29T04:53:44Z

/lgtm

ropatil010 · 2026-01-29T04:55:55Z

/verified by CI runs
1 failure profile is not related to this PR changes.

openshift-ci-robot · 2026-01-29T04:56:06Z

@ropatil010: This PR has been marked as verified by CI runs.

Details

In response to this:

/verified by CI runs
1 failure profile is not related to this PR changes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

p0lyn0mial · 2026-01-29T13:08:06Z

pkg/test/extensions/binary.go

 		binaryPath: "/usr/bin/oc-tests-ext.gz",
 	},
+	{
+		imageTag:   "cluster-authentication-operator",


are you sure that existing e2e tests for cluster-authentication-operator are executed in serial ?

xref: https://github.com/openshift/cluster-authentication-operator/blob/master/cmd/cluster-authentication-operator-tests-ext/main.go#L65

(^ not strictly related to the changes introduced in this PR :) )

Hi @p0lyn0mial
Tried checking the logs, understanding the framework. This is what i got.

Tests run serially by default in Go. You only need to explicitly opt-in to parallel execution

So currently we are executing cases from test/e2e directory by using Ginkgo framework to run the tests in serial way.

As per our OTE implementation we have assigned names like

[sig-auth] authentication operator [Operator][Certs][Serial] TestRouterCerts [sig-auth] authentication operator [Operator][Routes][Serial] TestCustomRouterCerts [sig-auth] authentication operator [OIDC][Serial] TestGitLabAsOIDCPasswordGrantCheck [sig-auth] authentication operator [OIDC][Serial] TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync [sig-auth] authentication operator [Templates][Serial] TestTemplatesConfig [sig-auth] authentication operator [Tokens][Serial] TestTokenInactivityTimeout

OTE suite configuration with parallelism: 1, Tests run sequentially (serially), not concurrently

Dedicated serial CI job in OpenShift's test infrastructure in PR: https://github.com/openshift/release/pull/73999/changes

The tests in test/e2e/ modify cluster-wide global state (OAuth config, routes, templates, etc.). If they ran in parallel the test will fail.

Execution logs not from my PR

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-authentication-operator/829/pull-ci-openshift-cluster-authentic ation-operator-master-e2e-operator/2016110000199438336/artifacts/e2e-operator/test/artifacts/junit_report.xml

ANALYZING ACTUAL JUNIT XML FROM PR #829
========================================
TEST DURATIONS FROM junit_report.xml:
- TestCustomRouterCerts: 42.83s
- TestGitLabAsOIDCPasswordGrantCheck: 291.25s
- TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync: 186.63s
- TestRouterCerts: 2.21s
- TestTemplatesConfig: 70.34s
- TestTokenInactivityTimeout: 2202.64s
└─ unset-inactivity-timeout-client-timeout: 610.57s
└─ with-client-timeout: 430.72s
└─ with-inactivity-timeout: 730.90s
└─ without-inactivity-timeout: 430.43s

CALCULATION: ----------- Sum of individual test times: 42.83 + 291.25 + 186.63 + 2.21 + 70.34 + 2202.64 = 2795.90s Total suite time reported in XML: 2796.978s Difference: 2796.978 - 2795.90 = 1.078s (just overhead) ANALYSIS: --------- If PARALLEL: Total would be ≈ longest test (2202.64s) If SERIAL: Total would be ≈ sum of all tests (2795.90s) Actual total: 2796.978s ≈ Sum of all tests ✓ CONCLUSION: Tests ran SERIALLY (one after another)

mathematical proof from the actual CI logs that tests ran serially, not in parallel!

Hi @p0lyn0mial Summary related to the tests under path test/e2e:

Test Name: TestRouterCerts Implementation File:Line: certs.go:31 Test Wrapper File: certs_test.go:7 Current Label: [Operator][Certs][Serial] Analysis: 🚫 Serial - Modifies global IngressController, changes cluster config ──────────────────────────────────────── Test Name: TestCustomRouterCerts Implementation File:Line: custom_route.go:33 Test Wrapper File: custom_route_test.go:7 Current Label: [Operator][Routes][Serial] Analysis: 🚫 Serial - Modifies cluster Ingresses config, updates component routes ──────────────────────────────────────── Test Name: TestGitLabAsOIDCPasswordGrantCheck Implementation File:Line: gitlab.go:15 Test Wrapper File: gitlab_test.go:7 Current Label: [OIDC][Serial] Analysis: 🚫 Serial - Adds GitLab IDP, modifies cluster OAuth config ──────────────────────────────────────── Test Name: TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync Implementation File:Line: keycloak.go:27 Test Wrapper File: keycloak_test.go:7 Current Label: [OIDC][Serial] Analysis: 🚫 Serial - Adds Keycloak IDP, creates global users/groups, triggers operator rollout ──────────────────────────────────────── Test Name: TestTemplatesConfig Implementation File:Line: templates.go:28 Test Wrapper File: templates_test.go:7 Current Label: [Templates][Serial] Analysis: 🚫 Serial - Modifies OAuth templates, triggers operator rollout, waits for progressing ──────────────────────────────────────── Test Name: TestTokenInactivityTimeout Implementation File:Line: tokentimeout.go:36 Test Wrapper File: tokentimeout_test.go:7 Current Label: [Tokens][Serial] Analysis: 🚫 Serial - Modifies OAuth token config, creates global resources, triggers operator rollout

Can you PTAL and do let me know about your opinion.

Please check how tests are executed by the CI job. I think the CI job uses.

Then compare this with how tests are executed for kas-o.

I think the difference is the use of the -p=1 flag.

Hi @p0lyn0mial

Sure, Thanks. TBH i have taken reference from working service-ca-operator repo

OTA binary registration: https://github.com/openshift/origin/blob/main/pkg/test/extensions/binary.go#L219 Makefile: https://github.com/openshift/service-ca-operator/blob/main/Makefile#L53 Add serial job: https://github.com/openshift/release/pull/72396/changes suite name: https://github.com/openshift/service-ca-operator/blob/main/cmd/service-ca-operator-tests-ext/main.go#L76

✅ In your test binary (cluster-authentication-operator-tests-ext/main.go):
Parallelism: 1 // Already there!
https://github.com/openshift/cluster-authentication-operator/blob/master/cmd/cluster-authentication-operator-tests-ext/main.go#L66

✅ In Makefile (keep current):
test-e2e: GO_TEST_FLAGS += -count 1 # Prevents caching and use count 1
https://github.com/openshift/cluster-authentication-operator/blob/master/Makefile#L49

✅ In CI job config (PR #73999):
env:
TEST_SUITE: openshift/cluster-authentication-operator/operator/serial

When you run tests via the OTE binary:
./cluster-authentication-operator-tests-ext run-suite openshift/cluster-authentication-operator/operator/serial

The binary's Parallelism: 1 setting controls execution, NOT go test flags.
The Makefile's -p 1 is only relevant for:

Running go test ./test/e2e/... directly (without OTE binary)

That's why encryption tests use -p 1 (they run via go test directly)

ok, so, it looks like we will update the auth operator to execute the tests in parallel (xref: openshift/cluster-authentication-operator#833)

yeah agree, as per your suggestions here openshift/cluster-authentication-operator#833 (comment) i have updated to parallel. Will monitor the CI job once it gets merged.

p0lyn0mial · 2026-02-03T10:35:55Z

this PR registers the ote binary for the auth operator which is ok

/lgtm

ropatil010 · 2026-02-03T10:47:19Z

/assign @stbenjam
Could you PTAL.

ropatil010 · 2026-02-04T06:24:01Z

/assign @bertinatto
plz help to merge this PR. Thanks

bertinatto

/approve

bertinatto

/approve

openshift-ci · 2026-02-04T16:07:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, gangwgr, p0lyn0mial, ropatil010

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bertinatto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-02-04T16:33:34Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

openshift-ci-robot · 2026-02-04T17:50:44Z

/retest-required

Remaining retests: 0 against base HEAD 8917d7a and 2 for PR HEAD 21e8410 in total

openshift-ci-robot · 2026-02-04T19:50:52Z

/retest-required

Remaining retests: 0 against base HEAD fcd2b4e and 1 for PR HEAD 21e8410 in total

reg ote bin for cluster auth operator

21e8410

openshift-ci bot assigned gangwgr and sandeepknd Jan 28, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 28, 2026

openshift-ci bot assigned wangke19 Jan 28, 2026

openshift-ci bot requested review from p0lyn0mial and sjenning January 28, 2026 05:20

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jan 29, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 29, 2026

p0lyn0mial reviewed Jan 29, 2026

View reviewed changes

This was referenced Feb 2, 2026

CNTRLPLANE-2589: update cases to execute as parallel openshift/cluster-authentication-operator#833

Open

CNTRLPLANE-2589: Add parallel OTE CI job for cluster-authentication-operator openshift/release#73999

Merged

openshift-ci bot assigned p0lyn0mial Feb 3, 2026

openshift-ci bot assigned stbenjam Feb 3, 2026

openshift-ci bot assigned bertinatto Feb 4, 2026

bertinatto reviewed Feb 4, 2026

View reviewed changes

bertinatto approved these changes Feb 4, 2026

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 4, 2026

openshift-merge-bot bot merged commit 03700fa into openshift:main Feb 4, 2026
20 of 21 checks passed

CNTRLPLANE-2196: reg ote bin for cluster auth operator #30735

CNTRLPLANE-2196: reg ote bin for cluster auth operator #30735

Uh oh!

Conversation

ropatil010 commented Jan 28, 2026

Uh oh!

openshift-ci-robot commented Jan 28, 2026

Uh oh!

openshift-ci-robot commented Jan 28, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ropatil010 commented Jan 28, 2026

Uh oh!

openshift-ci-robot commented Jan 28, 2026

Uh oh!

ropatil010 commented Jan 28, 2026

Uh oh!

jsafrane commented Jan 28, 2026

Uh oh!

ropatil010 commented Jan 28, 2026

Uh oh!

openshift-ci bot commented Jan 28, 2026

Uh oh!

gangwgr commented Jan 29, 2026

Uh oh!

ropatil010 commented Jan 29, 2026

Uh oh!

openshift-ci-robot commented Jan 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p0lyn0mial commented Feb 3, 2026

Uh oh!

ropatil010 commented Feb 3, 2026

Uh oh!

ropatil010 commented Feb 4, 2026

Uh oh!

bertinatto left a comment

Choose a reason for hiding this comment

Uh oh!

bertinatto left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

openshift-ci-robot commented Jan 28, 2026 •

edited by openshift-ci bot

Loading