test(ci): add failing test assertion showing that operatorgroup

annotations on copied csvs will get overwritten to the wrong thing

Author: ecordell

test/e2e/operator_groups_e2e_test.go

@@ -884,7 +884,7 @@ func TestOperatorGroupIntersection(t *testing.T) {
 	// Generate operatorGroupD in namespaceD that selects namespace D and E
 	// Generate csvD in namespaceD
 	// Wait for csvD to be successful
-	// Wait for csvD to have a CSV with copied status in namespace D
+	// Wait for csvD to have a CSV with copied status in namespace E
 	// Wait for operatorGroupD to have providedAPI annotation with crdD's Kind.version.group
 	// Generate operatorGroupA in namespaceA that selects AllNamespaces
 	// Generate csvD in namespaceA
@@ -895,6 +895,8 @@ func TestOperatorGroupIntersection(t *testing.T) {
 	// Wait for csvA to be successful
 	// Ensure clusterroles created and aggregated for accessing provided APIs
 	// Wait for operatorGroupA to have providedAPI annotation with crdA's Kind.version.group in its providedAPIs annotation
+	// Wait for csvA to have a CSV with copied status in namespace D
+	// Ensure csvA retains the operatorgroup annotations for operatorgroupA
 	// Wait for csvA to have a CSV with copied status in namespace C
 	// Generate operatorGroupB in namespaceB that selects namespace C
 	// Generate csvB in namespaceB that owns crdA
@@ -1091,6 +1093,26 @@ func TestOperatorGroupIntersection(t *testing.T) {
 	}
 	require.NoError(t, awaitAnnotations(t, q, map[string]string{v1.OperatorGroupProvidedAPIsAnnotationKey: kvgA}))
 
+	// Wait for csvA to have a CSV with copied status in namespace D
+	csvAinNsD, err := awaitCSV(t, crc, nsD, csvA.GetName(), csvCopiedChecker)
+	require.NoError(t, err)
+
+	// trigger a resync of operatorgropuD
+	fetchedGroupD, err := crc.OperatorsV1().OperatorGroups(nsD).Get(groupD.GetName(), metav1.GetOptions{})
+	require.NoError(t, err)
+
+	fetchedGroupD.Annotations["bump"] = "update"
+	_, err = crc.OperatorsV1().OperatorGroups(nsD).Update(fetchedGroupD)
+	require.NoError(t, err)
+
+	// Ensure csvA retains the operatorgroup annotations for operatorgroupA
+	csvAinNsD, err = awaitCSV(t, crc, nsD, csvA.GetName(), csvCopiedChecker)
+	require.NoError(t, err)
+
+	require.Equal(t, groupA.GetName(), csvAinNsD.Annotations[v1.OperatorGroupAnnotationKey])
+	require.Equal(t, nsA, csvAinNsD.Annotations[v1.OperatorGroupNamespaceAnnotationKey])
+	require.Equal(t, nsA, csvAinNsD.Labels[v1alpha1.CopiedLabelKey])
+
 	// Await csvA's copy in namespaceC
 	_, err = awaitCSV(t, crc, nsC, csvA.GetName(), csvCopiedChecker)
 	require.NoError(t, err)
@@ -1849,3 +1871,183 @@ func TestOperatorGroupInsufficientPermissionsResolveViaServiceAccountRemoval(t *
 	})
 	require.NoError(t, err)
 }
+
+func TestCleanupCsvsWithBadOwnerOperatorGroups(t *testing.T) {
+		// Create namespace with specific label
+		// Create CRD
+		// Create CSV in operator namespace
+		// Create operator group that watches namespace and uses specific label
+		// Verify operator group status contains correct status
+		// Verify csv in target namespace exists, has copied status, has annotations
+		// Verify deployments have correct namespace annotation
+		// (Verify that the operator can operate in the target namespace)
+		// Update CSV to support no InstallModes
+		// Verify the CSV transitions to FAILED
+		// Verify the copied CSV transitions to FAILED
+		// Delete CSV
+		// Verify copied CVS is deleted
+		defer cleaner.NotifyTestComplete(t, true)
+
+		log := func(s string) {
+			t.Logf("%s: %s", time.Now().Format("15:04:05.9999"), s)
+		}
+
+		c := newKubeClient(t)
+		crc := newCRClient(t)
+		csvName := genName("another-csv-") // must be lowercase for DNS-1123 validation
+
+		opGroupNamespace := genName(testNamespace + "-")
+		matchingLabel := map[string]string{"inGroup": opGroupNamespace}
+		otherNamespaceName := genName(opGroupNamespace + "-")
+		bothNamespaceNames := opGroupNamespace + "," + otherNamespaceName
+
+		_, err := c.KubernetesInterface().CoreV1().Namespaces().Create(&corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:   opGroupNamespace,
+				Labels: matchingLabel,
+			},
+		})
+		require.NoError(t, err)
+		defer func() {
+			err = c.KubernetesInterface().CoreV1().Namespaces().Delete(opGroupNamespace, &metav1.DeleteOptions{})
+			require.NoError(t, err)
+		}()
+
+		otherNamespace := corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:   otherNamespaceName,
+				Labels: matchingLabel,
+			},
+		}
+		createdOtherNamespace, err := c.KubernetesInterface().CoreV1().Namespaces().Create(&otherNamespace)
+		require.NoError(t, err)
+		defer func() {
+			err = c.KubernetesInterface().CoreV1().Namespaces().Delete(otherNamespaceName, &metav1.DeleteOptions{})
+			require.NoError(t, err)
+		}()
+
+		log("Creating CRD")
+		mainCRDPlural := genName("opgroup")
+		mainCRD := newCRD(mainCRDPlural)
+		cleanupCRD, err := createCRD(c, mainCRD)
+		require.NoError(t, err)
+		defer cleanupCRD()
+
+		log("Creating operator group")
+		operatorGroup := v1.OperatorGroup{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      genName("e2e-operator-group-"),
+				Namespace: opGroupNamespace,
+			},
+			Spec: v1.OperatorGroupSpec{
+				Selector: &metav1.LabelSelector{
+					MatchLabels: matchingLabel,
+				},
+			},
+		}
+		_, err = crc.OperatorsV1().OperatorGroups(opGroupNamespace).Create(&operatorGroup)
+		require.NoError(t, err)
+		expectedOperatorGroupStatus := v1.OperatorGroupStatus{
+			Namespaces: []string{opGroupNamespace, createdOtherNamespace.GetName()},
+		}
+
+		log("Waiting on operator group to have correct status")
+		err = wait.Poll(pollInterval, pollDuration, func() (bool, error) {
+			fetched, fetchErr := crc.OperatorsV1().OperatorGroups(opGroupNamespace).Get(operatorGroup.Name, metav1.GetOptions{})
+			if fetchErr != nil {
+				return false, fetchErr
+			}
+			if len(fetched.Status.Namespaces) > 0 {
+				require.ElementsMatch(t, expectedOperatorGroupStatus.Namespaces, fetched.Status.Namespaces, "have %#v", fetched.Status.Namespaces)
+				return true, nil
+			}
+			return false, nil
+		})
+		require.NoError(t, err)
+
+		log("Creating CSV")
+
+		// Generate permissions
+		serviceAccountName := genName("nginx-sa")
+		permissions := []v1alpha1.StrategyDeploymentPermissions{
+			{
+				ServiceAccountName: serviceAccountName,
+				Rules: []rbacv1.PolicyRule{
+					{
+						Verbs:     []string{rbacv1.VerbAll},
+						APIGroups: []string{mainCRD.Spec.Group},
+						Resources: []string{mainCRDPlural},
+					},
+				},
+			},
+		}
+
+		// Create a new NamedInstallStrategy
+		deploymentName := genName("operator-deployment")
+		namedStrategy := newNginxInstallStrategy(deploymentName, permissions, nil)
+
+		aCSV := newCSV(csvName, opGroupNamespace, "", semver.MustParse("0.0.0"), []apiextensions.CustomResourceDefinition{mainCRD}, nil, namedStrategy)
+		createdCSV, err := crc.OperatorsV1alpha1().ClusterServiceVersions(opGroupNamespace).Create(&aCSV)
+		require.NoError(t, err)
+
+		serviceAccount := &corev1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: opGroupNamespace,
+				Name:      serviceAccountName,
+			},
+		}
+		ownerutil.AddNonBlockingOwner(serviceAccount, createdCSV)
+		err = ownerutil.AddOwnerLabels(serviceAccount, createdCSV)
+		require.NoError(t, err)
+
+		role := &rbacv1.Role{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: opGroupNamespace,
+				Name:      serviceAccountName + "-role",
+			},
+			Rules: permissions[0].Rules,
+		}
+		ownerutil.AddNonBlockingOwner(role, createdCSV)
+		err = ownerutil.AddOwnerLabels(role, createdCSV)
+		require.NoError(t, err)
+
+		roleBinding := &rbacv1.RoleBinding{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: opGroupNamespace,
+				Name:      serviceAccountName + "-rb",
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      serviceAccountName,
+					Namespace: opGroupNamespace,
+				},
+			},
+			RoleRef: rbacv1.RoleRef{
+				Kind: "Role",
+				Name: role.GetName(),
+			},
+		}
+		ownerutil.AddNonBlockingOwner(roleBinding, createdCSV)
+		err = ownerutil.AddOwnerLabels(roleBinding, createdCSV)
+		require.NoError(t, err)
+
+		_, err = c.CreateServiceAccount(serviceAccount)
+		require.NoError(t, err)
+		_, err = c.CreateRole(role)
+		require.NoError(t, err)
+		_, err = c.CreateRoleBinding(roleBinding)
+		require.NoError(t, err)
+
+		log("wait for CSV to succeed")
+		err = wait.Poll(pollInterval, pollDuration, func() (bool, error) {
+			fetched, err := crc.OperatorsV1alpha1().ClusterServiceVersions(opGroupNamespace).Get(createdCSV.GetName(), metav1.GetOptions{})
+			if err != nil {
+				return false, err
+			}
+			log(fmt.Sprintf("%s (%s): %s", fetched.Status.Phase, fetched.Status.Reason, fetched.Status.Message))
+			return csvSucceededChecker(fetched), nil
+		})
+		require.NoError(t, err)
+	}
+}