Skip to content

CNTRLPLANE-2589: Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework#926

Open
ropatil010 wants to merge 2 commits into
openshift:masterfrom
ropatil010:test-e2e
Open

CNTRLPLANE-2589: Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework#926
ropatil010 wants to merge 2 commits into
openshift:masterfrom
ropatil010:test-e2e

Conversation

@ropatil010

@ropatil010 ropatil010 commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Hi Team,

Splitting the original PR: #859 into smaller once to better debug and merge the PR's easily.

PR about:
This commit migrates the encryption performance tests to support both traditional go test and the OpenShift Tests Extension (OTE) framework, following the dual-mode pattern established in PR #859.

Changes:

  • Add encryption_perf.go with Ginkgo test registration
  • Refactor encryption_perf_test.go to call shared test function
  • Add test/library/encryption_wrappers.go for testing.TB compatibility
  • Add test/library/encryption/scenarios.go with core test implementations
  • Add test/library/encryption/perf_helpers.go for performance test utilities
  • Register encryption-perf suite in OTE main.go with ClusterStability: Disruptive

The tests now use testing.TB interface for framework compatibility and context.Background() instead of t.Context() to avoid Ginkgo panics.

Suite details:

  • Name: openshift/cluster-authentication-operator/operator-encryption-perf/serial
  • Parallelism: 1 (serial execution)
  • ClusterStability: Disruptive (triggers API server rollouts)

Test: [sig-auth] authentication operator [Encryption][Serial] TestPerfEncryptionTypeAESCBC

Summary by CodeRabbit

  • New Features
    • Added a new encryption performance test suite for end-to-end validation.
    • Expanded encryption test coverage to include multiple encryption modes and an enable/disable cycle.
    • Improved test helpers for waiting on encryption progress and preparing large-scale test data.

@coderabbitai

coderabbitai Bot commented Jun 19, 2026

Copy link
Copy Markdown

Walkthrough

Adds a serial encryption performance suite, shared helpers for database population and migration polling, and encryption-type scenario helpers for provider selection and on/off transitions.

Changes

Encryption performance tests

Layer / File(s) Summary
Suite registration and wrapper
cmd/cluster-authentication-operator-tests-ext/main.go, test/e2e-encryption-perf/encryption_perf_test.go
Registers the serial encryption perf suite with the blank import and OTE suite definition, and keeps the Go test entrypoint as a delegate.
AES-CBC perf workload
test/e2e-encryption-perf/encryption_perf.go, test/library/encryption/perf_helpers.go
Implements the AES-CBC perf test body, token creation and metric hooks, perf client setup, and concurrent database population helpers.
Migration timing flow
test/library/encryption/perf_helpers.go, test/library/encryption/scenarios.go
Adds polling for EncryptionMigrationControllerProgressing and the perf scenario wrapper that measures migration duration.
Encryption type helpers
test/library/encryption/scenarios.go
Adds library clientset creation, APIServer encryption-type updates, provider dispatch, per-mode wrappers, and the shared base flow for encryption-type tests.
Toggle scenario
test/library/encryption/scenarios.go
Adds the create, enable, verify, disable, and verify sequence that runs twice.

Sequence Diagram(s)

sequenceDiagram
  participant TestPerfEncryption
  participant populateDatabase
  participant EncryptionMigrationControllerProgressing
  participant runTestEncryptionPerf
  TestPerfEncryption->>populateDatabase: populate access-token data
  TestPerfEncryption->>EncryptionMigrationControllerProgressing: start polling for migration start
  TestPerfEncryption->>runTestEncryptionPerf: run encryption scenario and capture assertion time
  runTestEncryptionPerf-->>TestPerfEncryption: assertion timestamp
  EncryptionMigrationControllerProgressing-->>TestPerfEncryption: migration start timestamp
  TestPerfEncryption->>TestPerfEncryption: compute migration duration
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 3 warnings)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error FAIL: the new perf test calls AssertTokens, whose failure paths log raw OAuth refresh tokens and etcd contents in assertion.go. Redact raw token values from those error messages and log only masked identifiers or hashes.
Docstring Coverage ⚠️ Warning Docstring coverage is 79.31% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning The perf test creates many cluster-scoped OAuthAccessTokens in createAccessTokenWrapper and never cleans them up; a few assertions are still bare (require.NoError, require.GreaterOrEqual). Add cleanup/teardown for created tokens (or isolate them in an ephemeral namespace) and give the remaining assertions explicit failure messages.
Microshift Test Compatibility ⚠️ Warning The new Ginkgo test is unguarded and uses unavailable OpenShift APIs (configv1/operatorv1/oauth) plus openshift-* resources, so it is not MicroShift-safe. Add a MicroShift skip or apigroup tag (e.g. [Skipped:MicroShift] or [apigroup:config.openshift.io]), or verify it under the MicroShift serial payload job.
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: migrating the encryption performance tests to the OpenShift Tests Extension framework.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The only new Ginkgo title is a static string ([Encryption][Serial] TestPerfEncryptionTypeAESCBC); no dynamic or generated values appear in test titles.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The new Ginkgo perf test only creates OAuth tokens and watches operator conditions; it has no node-count, pod-placement, or topology assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed PASS: The PR only adds test/OTE registration and encryption test helpers; no deployment manifests/controllers or node-affinity/spread/PDB logic were introduced.
Ote Binary Stdout Contract ✅ Passed New code only uses klog.LogToStderr in main and t.Logf in test helpers; no added fmt.Print/stdout in main/init/TestMain/RunSpecs/top-level init.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The new Ginkgo perf test and helpers only use cluster kubeconfig/Kubernetes/etcd APIs; no hardcoded IPv4 addresses, IP parsing, host interpolation, or external internet calls found.
No-Weak-Crypto ✅ Passed Modified files add AES-CBC test wiring only; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret/token constant-time issues appear in the patch.
Container-Privileges ✅ Passed Touched files contain no privileged/root security fields; searches found no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings in the PR changes.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-encryption-perf/encryption_perf.go`:
- Around line 56-67: The AssertDBPopulatedFunc closure is not validating the
errorStore parameter, allowing the test to pass even when DB loader workers
report failures. Add an assertion early in the AssertDBPopulatedFunc that checks
if errorStore contains any entries, and if it does, fail the test using
require.Fail or similar with a message that includes the collected errors so
loader failures are caught instead of silently ignored.

In `@test/library/encryption/scenarios.go`:
- Around line 46-57: The hardcoded 30 second timeout in the time.After() call
within the select statement can cause premature failures on slow clusters even
when the system is functioning correctly. Replace the fixed duration of 30 *
time.Second with a reference to the migration watcher's configured timeout value
to ensure the channel wait window is properly aligned with the watcher's actual
timeout configuration instead of using an arbitrary fixed duration.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1bbedebe-122c-4fce-a0aa-369d62586ef2

📥 Commits

Reviewing files that changed from the base of the PR and between 28632f2 and 9f643f2.

📒 Files selected for processing (6)
  • cmd/cluster-authentication-operator-tests-ext/main.go
  • test/e2e-encryption-perf/encryption_perf.go
  • test/e2e-encryption-perf/encryption_perf_test.go
  • test/library/encryption/perf_helpers.go
  • test/library/encryption/scenarios.go
  • test/library/encryption_wrappers.go

Comment thread test/e2e-encryption-perf/encryption_perf.go
Comment thread test/library/encryption/scenarios.go
@coderabbitai

coderabbitai Bot commented Jun 19, 2026

Copy link
Copy Markdown
✅ Action performed

Full review finished.

This commit migrates the encryption performance tests to support both
traditional go test and the OpenShift Tests Extension (OTE) framework,
following the dual-mode pattern established in PR openshift#859.

Changes:
- Add encryption_perf.go with Ginkgo test registration
- Refactor encryption_perf_test.go to call shared test function
- Add test/library/encryption_wrappers.go for testing.TB compatibility
- Add test/library/encryption/scenarios.go with core test implementations
- Add test/library/encryption/perf_helpers.go for performance test utilities
- Register encryption-perf suite in OTE main.go with ClusterStability: Disruptive

The tests now use testing.TB interface for framework compatibility and
context.Background() instead of t.Context() to avoid Ginkgo panics.

Code review fixes:
- Add errorStore assertion to fail test when DB loader workers report errors
- Use waitPollTimeout instead of hardcoded 30s for migration start wait
  to align with the watcher timeout and prevent premature failures

Suite details:
- Name: openshift/cluster-authentication-operator/operator-encryption-perf/serial
- Parallelism: 1 (serial execution)
- ClusterStability: Disruptive (triggers API server rollouts)

Test: [sig-auth] authentication operator [Encryption][Serial] TestPerfEncryptionTypeAESCBC

Co-Authored-By: Rohit Patil <ropatil@redhat.com>
@ropatil010

Copy link
Copy Markdown
Contributor Author

/test e2e-agnostic-upgrade

@ropatil010 ropatil010 changed the title Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework CNTRLPLANE-2589: Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework Jun 19, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 19, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

@ropatil010: This pull request references CNTRLPLANE-2589 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Hi Team,

Splitting the original PR: #859 into smaller once to better debug and merge the PR's easily.

PR about:
This commit migrates the encryption performance tests to support both traditional go test and the OpenShift Tests Extension (OTE) framework, following the dual-mode pattern established in PR #859.

Changes:

  • Add encryption_perf.go with Ginkgo test registration
  • Refactor encryption_perf_test.go to call shared test function
  • Add test/library/encryption_wrappers.go for testing.TB compatibility
  • Add test/library/encryption/scenarios.go with core test implementations
  • Add test/library/encryption/perf_helpers.go for performance test utilities
  • Register encryption-perf suite in OTE main.go with ClusterStability: Disruptive

The tests now use testing.TB interface for framework compatibility and context.Background() instead of t.Context() to avoid Ginkgo panics.

Suite details:

  • Name: openshift/cluster-authentication-operator/operator-encryption-perf/serial
  • Parallelism: 1 (serial execution)
  • ClusterStability: Disruptive (triggers API server rollouts)

Test: [sig-auth] authentication operator [Encryption][Serial] TestPerfEncryptionTypeAESCBC

Summary by CodeRabbit

Release Notes

  • Tests
  • Added a new end-to-end encryption performance test suite (AES-CBC) covering encryption configuration behavior and migration-time measurement.
  • Introduced reusable encryption scenario helpers, including enable → verify encrypted → disable → verify unencrypted cycles and encryption-type mode coverage.
  • Improved performance test infrastructure with parallel database population, migration progress watching, and token creation/count reporting.
  • Updated performance test entrypoint and added wrapper functions to standardize execution under Ginkgo-compatible testing.TB.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ropatil010

ropatil010 commented Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

/assign @liouk
/retest
Failure CI profiles:

  1. e2e-agnostic the failures are not related to my PR.
  2. e2e-agnostic-upgrade the failure case is consistent across other builds as well nd is not related to my PR.
    How ever i'm retriggering to double confirm.

PASS logs for migrated case

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-authentication-operator/926/pull-ci-openshift-cluster-authentication-operator-master-e2e-aws-operator-encryption-perf-serial-ote-1of2/2067937008877047808/artifacts/e2e-aws-operator-encryption-perf-serial-ote/openshift-e2e-test/artifacts/e2e.log

passed: (14m23s) 2026-06-19T13:01:08 "[sig-auth] authentication operator [Encryption][Serial] TestPerfEncryptionTypeAESCBC"

@ropatil010

Copy link
Copy Markdown
Contributor Author

/retest

@liouk liouk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, it looks like we're copying and adapting quite a lot of functions from library-go mainly because we're changing *testing.T to testing.TB. Is there a plan to eventually update these funcs in library-go as well, so that we don't have to copy code over for this change? If we're doing a global OTE migration, this should definitely be part of it (I'd even argue that we should have started there). This way we can reduce code duplication just for plumbing needs.

Comment thread test/library/encryption/perf_helpers.go
Comment thread test/library/encryption/scenarios.go Outdated
Comment thread test/e2e-encryption-perf/encryption_perf.go Outdated
Comment thread test/library/encryption_wrappers.go Outdated
Comment thread test/e2e-encryption-perf/encryption_perf.go Outdated
@openshift-ci

openshift-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from liouk. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

This commit addresses all reviewer suggestions for PR openshift#926:

1. Context Injection and Propagation:
   - Add context.Context parameter to Ginkgo tests
   - Use parent context instead of context.Background()
   - Ginkgo now injects context: g.It(..., func(ctx context.Context))
   - Standard tests use tt.Context()
   - Context flows properly: Ginkgo -> test -> library functions

2. Migration Watcher Check:
   - Remove overly-restrictive cond.Reason == "Migrating" check
   - Now matches library-go behavior (only checks Status)
   - Prevents false failures if controller uses different reason strings

3. Remove Unnecessary Wrapper File:
   - Delete test/library/encryption_wrappers.go (39 lines)
   - Update caller to use local implementation directly
   - No functionality lost - wrappers were just pass-throughs

4. Improved Assertion Pattern:
   - Replace error creation + require.NoError() with direct assertions
   - Use require.True() and require.GreaterOrEqual()
   - More readable and follows Go testing best practices
   - Remove unused errors import

5. Dual-Mode Support:
   - Both standard Go test and Ginkgo modes work correctly
   - Standard: TestPerfEncryptionTypeAESCBC(tt.Context(), tt)
   - Ginkgo: g.It(..., func(ctx context.Context))
   - Shared implementation uses testing.TB interface

Changes:
- Modified: 4 files
- Deleted: 1 file
- Net: -47 lines (simplified code)

All changes verified:
- Compiles in both test modes
- No go vet issues
- Proper context propagation
- Consistent application of patterns

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
test/library/encryption/perf_helpers.go (1)

43-47: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Use the test-process clock for the value sent on migrationStartedCh.

Line 47 sends the operator condition timestamp, but scenarios.go subtracts it from a locally captured end timestamp. If the operator/test clocks differ, the perf duration can be negative or inflated. Send a local observation timestamp here, or compute both endpoints from the same clock source.

Suggested direction
 			if cond.Type == "EncryptionMigrationControllerProgressing" &&
 				cond.Status == operatorv1.ConditionTrue &&
 				cond.LastTransitionTime.Time.After(testStartTime) {
-				t.Logf("EncryptionMigrationControllerProgressing condition observed at %v with reason %q", cond.LastTransitionTime, cond.Reason)
-				migrationStartedCh <- cond.LastTransitionTime.Time
+				observedAt := time.Now()
+				t.Logf("EncryptionMigrationControllerProgressing condition observed at %v with reason %q; local observation time %v", cond.LastTransitionTime, cond.Reason, observedAt)
+				migrationStartedCh <- observedAt
 				return true, nil
 			}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/library/encryption/perf_helpers.go` around lines 43 - 47, The timestamp
sent on migrationStartedCh in the condition-watching helper should come from the
test-process clock, not from cond.LastTransitionTime, because scenarios.go later
compares it to a locally captured end time. Update the logic around the
EncryptionMigrationControllerProgressing check so it logs the operator timestamp
for diagnostics if needed, but sends a local observation time from the test
clock on migrationStartedCh to keep both endpoints on the same clock source.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@test/library/encryption/perf_helpers.go`:
- Around line 43-47: The timestamp sent on migrationStartedCh in the
condition-watching helper should come from the test-process clock, not from
cond.LastTransitionTime, because scenarios.go later compares it to a locally
captured end time. Update the logic around the
EncryptionMigrationControllerProgressing check so it logs the operator timestamp
for diagnostics if needed, but sends a local observation time from the test
clock on migrationStartedCh to keep both endpoints on the same clock source.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e3e9b695-94e4-499f-9a3b-dacbd0879ece

📥 Commits

Reviewing files that changed from the base of the PR and between 0832d50 and ab2109a.

📒 Files selected for processing (4)
  • test/e2e-encryption-perf/encryption_perf.go
  • test/e2e-encryption-perf/encryption_perf_test.go
  • test/library/encryption/perf_helpers.go
  • test/library/encryption/scenarios.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • test/e2e-encryption-perf/encryption_perf.go
  • test/e2e-encryption-perf/encryption_perf_test.go

@ropatil010

Copy link
Copy Markdown
Contributor Author

Overall, it looks like we're copying and adapting quite a lot of functions from library-go mainly because we're changing *testing.T to testing.TB. Is there a plan to eventually update these funcs in library-go as well, so that we don't have to copy code over for this change? If we're doing a global OTE migration, this should definitely be part of it (I'd even argue that we should have started there). This way we can reduce code duplication just for plumbing needs.

Thanks for the feedback, how ever i have copied the same contents of PR: #859 in this PR without any modifications.

Initiated discussion here: https://redhat-internal.slack.com/archives/C07RDCVEYJG/p1782475409270789

@openshift-ci

openshift-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

@ropatil010: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-agnostic ab2109a link true /test e2e-agnostic

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants