Skip to content

Conversation

@gangwgr
Copy link
Contributor

@gangwgr gangwgr commented Nov 28, 2025

Migrate TestTokenRequestAndReview to dual-compatible test framework

This commit migrates the TestTokenRequestAndReview test to support both
Ginkgo (OTE framework) and standard Go test execution using a
dual-compatibility approach.

Changes:

  • Created test/e2e/bound_sa_token.go with:

    • TestingT interface: minimal common interface that both testing.TB
      and ginkgo.GinkgoTInterface implement
    • testTokenRequestAndReview(t TestingT): shared test implementation
    • Ginkgo wrapper that calls testTokenRequestAndReview(g.GinkgoT())
  • Updated test/e2e/bound_sa_token_test.go:

    • Added TestTokenRequestAndReview(t *testing.T) that calls the
      shared testTokenRequestAndReview(t) function
  • Replaced Gomega assertions (o.Expect) with require package assertions
    (require.NoError, require.Empty, require.True) which work with the
    minimal TestingT interface

Benefits:

  • Single test implementation maintains consistency between frameworks
  • Can run via standard Go: go test -run TestTokenRequestAndReview
  • Can run via Ginkgo/OTE: ./...-tests-ext run-test "..."
  • No code duplication between test frameworks
  • Uses require for assertions which only needs Errorf, FailNow, and
    Helper methods (compatible with both testing.TB and GinkgoTInterface)
    Test run - 
    /cluster-kube-apiserver-operator-tests-ext run-suite openshift/cluster-kube-apiserver-operator/operator/serial -c 1
  Running Suite:  - /Users/rgangwar/Downloads/backupoffice/cluster-kube-apiserver-operator
  ========================================================================================
  Random Seed: 1764327116 - will randomize all specs

  Will run 1 of 1 specs
  ------------------------------
  [sig-api-machinery] kube-apiserver operator [Operator][Serial] TestTokenRequestAndReview
  github.com/openshift/cluster-kube-apiserver-operator/test/e2e/bound_sa_token.go:27
Found configuration for host https://xxxxx.
  • [3.707 seconds]
  ------------------------------

  Ran 1 of 1 Specs in 3.708 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-api-machinery] kube-apiserver operator [Operator][Serial] TestTokenRequestAndReview",
    "lifecycle": "blocking",
    "duration": 3707,
    "startTime": "2025-11-28 10:51:56.871582 UTC",
    "endTime": "2025-11-28 10:52:00.579330 UTC",
    "result": "passed",
    "output": ""
  }
]%                                                                                                                                                                                                                               rgangwar@rgangwar-mac cluster-kube-apiserver-operator % go test -v -mod=vendor ./test/e2e -run TestTokenRequestAndReview                                                    
=== RUN   TestTokenRequestAndReview
Found configuration for host https://xxxxxx.
--- PASS: TestTokenRequestAndReview (3.68s)
PASS
ok  	github.com/openshift/cluster-kube-apiserver-operator/test/e2e	4.441s
    
    

@coderabbitai
Copy link

coderabbitai bot commented Nov 28, 2025

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Refactors bound service account token tests by extracting shared test logic into a reusable testTokenRequestAndReview function and TestingT interface. Adds E2E test file with Ginkgo-based test suite. Updates main package to register E2E tests via blank import. Simplifies existing test file to delegate to shared logic.

Changes

Cohort / File(s) Summary
Test Infrastructure Setup
cmd/cluster-kube-apiserver-operator-tests-ext/main.go
Adds blank import of E2E test package to register tests for the test extension framework without importing identifiers.
Shared Test Logic
test/e2e/bound_sa_token.go
New file introducing TestingT interface and testTokenRequestAndReview function that validates bound service account token issuance via TokenRequest and TokenReview. Includes Ginkgo-based test suite with namespace, service account, and token creation flow.
Test File Refactoring
test/e2e/bound_sa_token_test.go
Simplifies TestTokenRequestAndReview by replacing setup code block with delegation to shared testTokenRequestAndReview function; removes unused imports (authenticationv1, v1, clientset).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

  • TestingT interface design: Verify that the interface correctly abstracts both \\*testing.T and Ginkgo's test context for interoperability between test frameworks.
  • Kubernetes API interactions in testTokenRequestAndReview: Check client creation, namespace lifecycle management, service account token issuance, and TokenReview submission for correctness and proper error handling.
  • Cleanup and defer logic: Ensure namespace deletion and error handling in deferred cleanup functions are robust and handle cleanup failures appropriately.
✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Comment @coderabbitai help to get the list of available commands and usage tips.

@gangwgr gangwgr changed the title Migrating TestTokenRequestAndReview to ginkgo [WIP]Migrating TestTokenRequestAndReview to ginkgo Nov 28, 2025
@openshift-ci openshift-ci bot requested review from deads2k and p0lyn0mial November 28, 2025 10:53
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 28, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 28, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gangwgr
Once this PR has been reviewed and has the lgtm label, please assign dgrisonnet for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between eecc8a9 and 2b98057.

📒 Files selected for processing (3)
  • cmd/cluster-kube-apiserver-operator-tests-ext/main.go (1 hunks)
  • test/e2e/bound_sa_token.go (1 hunks)
  • test/e2e/bound_sa_token_test.go (2 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

  • test/e2e/bound_sa_token_test.go
  • test/e2e/bound_sa_token.go
  • cmd/cluster-kube-apiserver-operator-tests-ext/main.go
🧬 Code graph analysis (1)
test/e2e/bound_sa_token.go (1)
test/library/client.go (1)
  • NewClientConfigForTest (12-20)
🔇 Additional comments (5)
cmd/cluster-kube-apiserver-operator-tests-ext/main.go (1)

22-23: LGTM!

The blank import with explanatory comment correctly registers the E2E tests with the test extension framework via side-effect initialization.

test/e2e/bound_sa_token.go (3)

17-24: LGTM!

The TestingT interface correctly captures the minimal common interface between testing.TB and ginkgo.GinkgoTInterface, enabling code reuse across both test frameworks.


26-30: LGTM!

The Ginkgo test registration with [Operator][Serial] tags correctly matches the suite qualifier defined in the test extension registry.


57-83: LGTM!

The test logic correctly exercises the TokenRequest and TokenReview APIs with appropriate assertions. The service account creation, token request with default audience, and authentication validation are all properly implemented.

test/e2e/bound_sa_token_test.go (1)

169-177: LGTM!

Clean delegation to the shared testTokenRequestAndReview function with a clear comment explaining the dual-use pattern. The *testing.T type satisfies the TestingT interface, enabling seamless reuse.

Comment on lines +51 to +54
defer func() {
err := corev1client.Namespaces().Delete(context.TODO(), ns.Name, metav1.DeleteOptions{})
require.NoError(t, err)
}()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Avoid require in defer for cleanup.

Using require.NoError (which calls FailNow()) inside a defer can cause issues—if the test already failed, it may produce confusing output, and FailNow() in a defer can behave unexpectedly in some contexts.

Consider logging the error instead or using assert.NoError which doesn't abort:

 	defer func() {
 		err := corev1client.Namespaces().Delete(context.TODO(), ns.Name, metav1.DeleteOptions{})
-		require.NoError(t, err)
+		if err != nil {
+			t.Errorf("failed to delete namespace %s: %v", ns.Name, err)
+		}
 	}()
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
defer func() {
err := corev1client.Namespaces().Delete(context.TODO(), ns.Name, metav1.DeleteOptions{})
require.NoError(t, err)
}()
defer func() {
err := corev1client.Namespaces().Delete(context.TODO(), ns.Name, metav1.DeleteOptions{})
if err != nil {
t.Errorf("failed to delete namespace %s: %v", ns.Name, err)
}
}()
🤖 Prompt for AI Agents
In test/e2e/bound_sa_token.go around lines 51 to 54, the deferred cleanup
currently calls require.NoError which invokes FailNow inside a defer—replace it
so deferred cleanup does not abort the test: capture the delete error and either
call assert.NoError(t, err) (non-fatal) or log it with t.Logf/t.Errorf if
non-nil; alternatively move the namespace deletion into t.Cleanup and use
require.NoError there (since t.Cleanup runs outside a defer), ensuring the
cleanup path never calls FailNow from within a defer.

@gangwgr gangwgr changed the title [WIP]Migrating TestTokenRequestAndReview to ginkgo [WIP]CNTRLPLANE-2072:Migrating TestTokenRequestAndReview to ginkgo Nov 28, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 28, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Nov 28, 2025

@gangwgr: This pull request references CNTRLPLANE-2072 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.21.0" version, but no target version was set.

In response to this:

Migrate TestTokenRequestAndReview to dual-compatible test framework

This commit migrates the TestTokenRequestAndReview test to support both
Ginkgo (OTE framework) and standard Go test execution using a
dual-compatibility approach.

Changes:

  • Created test/e2e/bound_sa_token.go with:

    • TestingT interface: minimal common interface that both testing.TB
      and ginkgo.GinkgoTInterface implement
    • testTokenRequestAndReview(t TestingT): shared test implementation
    • Ginkgo wrapper that calls testTokenRequestAndReview(g.GinkgoT())
  • Updated test/e2e/bound_sa_token_test.go:

    • Added TestTokenRequestAndReview(t *testing.T) that calls the
      shared testTokenRequestAndReview(t) function
  • Replaced Gomega assertions (o.Expect) with require package assertions
    (require.NoError, require.Empty, require.True) which work with the
    minimal TestingT interface

Benefits:

  • Single test implementation maintains consistency between frameworks
  • Can run via standard Go: go test -run TestTokenRequestAndReview
  • Can run via Ginkgo/OTE: ./...-tests-ext run-test "..."
  • No code duplication between test frameworks
  • Uses require for assertions which only needs Errorf, FailNow, and
    Helper methods (compatible with both testing.TB and GinkgoTInterface)
   Test run - 
   /cluster-kube-apiserver-operator-tests-ext run-suite openshift/cluster-kube-apiserver-operator/operator/serial -c 1
 Running Suite:  - /Users/rgangwar/Downloads/backupoffice/cluster-kube-apiserver-operator
 ========================================================================================
 Random Seed: 1764327116 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-api-machinery] kube-apiserver operator [Operator][Serial] TestTokenRequestAndReview
 github.com/openshift/cluster-kube-apiserver-operator/test/e2e/bound_sa_token.go:27
Found configuration for host https://xxxxx.
 • [3.707 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 3.708 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-api-machinery] kube-apiserver operator [Operator][Serial] TestTokenRequestAndReview",
   "lifecycle": "blocking",
   "duration": 3707,
   "startTime": "2025-11-28 10:51:56.871582 UTC",
   "endTime": "2025-11-28 10:52:00.579330 UTC",
   "result": "passed",
   "output": ""
 }
]%                                                                                                                                                                                                                               rgangwar@rgangwar-mac cluster-kube-apiserver-operator % go test -v -mod=vendor ./test/e2e -run TestTokenRequestAndReview                                                    
=== RUN   TestTokenRequestAndReview
Found configuration for host https://xxxxxx.
--- PASS: TestTokenRequestAndReview (3.68s)
PASS
ok  	github.com/openshift/cluster-kube-apiserver-operator/test/e2e	4.441s
   
   

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 28, 2025

@gangwgr: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants