From 629f931bfb152c72ac65c59f4d292d701e2a10d2 Mon Sep 17 00:00:00 2001
From: Drew Raines <drew@raines.me>
Date: Wed, 10 Jun 2026 02:13:10 +0000
Subject: [PATCH] fix(test): wait for CA Certificate Ready before reading its
 secret

The gateway-accepted chainsaw test creates a cert-manager Certificate
and immediately runs a script that reads the secret cert-manager is
supposed to produce. With no wait between the two, the script can run
before cert-manager has issued the secret, producing:

  Error from server (NotFound): secrets "..." not found
  error: no objects passed to apply

Asserting Certificate.status.conditions[Ready]=True between the
Certificate create and the secret-copy script gates everything that
depends on the issued secret, including the CA ClusterIssuer.

Example failure: https://github.com/datum-cloud/network-services-operator/actions/runs/27240379708/job/80442454016
(surfaced in PR #179)
---
 test/e2e/gateway/chainsaw-test.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/e2e/gateway/chainsaw-test.yaml b/test/e2e/gateway/chainsaw-test.yaml
index 56382ec7..8303c20c 100644
--- a/test/e2e/gateway/chainsaw-test.yaml
+++ b/test/e2e/gateway/chainsaw-test.yaml
@@ -45,6 +45,19 @@ spec:
                   kind: ClusterIssuer
                   group: cert-manager.io
 
+        - assert:
+            cluster: nso-infra
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
         - create:
             cluster: nso-infra
             resource: