OCPBUGS-105606: Allow DualReplica stable-system CVO Available blips from NoExecuteTaintManager

[eggfoobar]

Serial NoExecuteTaintManager tests taint a control-plane node on DualReplica (masters are also workers), briefly driving csi-snapshot-controller and packageserver Available=False. Mirror the existing upgrade-path exceptions in the stable-system monitor so TNF serial jobs do not fail on these expected blips.

Summary by CodeRabbit

• Tests
  • Improved upgrade and disruption testing for dual-replica configurations.
  • Added a one-minute grace period to accommodate expected temporary availability conditions during recovery.
  • Scoped exceptions for transient snapshot-controller and package-server status changes to relevant recovery windows.
  • Continued to treat unrelated availability failures as test failures.
  • Added coverage for conditions occurring during, immediately after, and outside disruptive test intervals.

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-105606, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Serial NoExecuteTaintManager tests taint a control-plane node on DualReplica (masters are also workers), briefly driving csi-snapshot-controller and packageserver Available=False. Mirror the existing upgrade-path exceptions in the stable-system monitor so TNF serial jobs do not fail on these expected blips.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 06da34b7-6a83-499b-b94b-c167a6d97946

📥 Commits

Reviewing files that changed from the base of the PR and between 64bb99a and 638822f.

📒 Files selected for processing (2)

• pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators.go
• pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators_test.go

---

Walkthrough

The stable operator transition monitor detects DualReplica topology and scopes specific transient conditions to NoExecuteTaintManager test intervals plus a one-minute grace period.

Changes

DualReplica exception handling

Layer / File(s)	Summary
NoExecuteTaintManager interval scoping and tests pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators.go, pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators_test.go	Helpers identify NoExecuteTaintManager intervals and include a one-minute grace period. Table-driven tests cover overlapping, post-grace, and pre-test intervals.
Scoped operator-condition exceptions pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators.go	DualReplica handling passes condition intervals to exception evaluation. CSI snapshot controller Waiting for Deployment and package-server ClusterServiceVersionNotSucceeded conditions are excepted only during matching windows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 63882

The change is limited to allowing expected DualReplica availability blips during NoExecuteTaintManager tests; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• openshift/origin#31499: Both modify DualReplica exception handling in operators.go.
• openshift/origin#31511: Both modify operator-state exception logic in operators.go.

Suggested labels: approved, lgtm, verified

Suggested reviewers: p0lyn0mial, sjenning, hongkailiu

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality	❓ Inconclusive	The added test uses testify assertions without diagnostic messages, which may conflict with the assertion-message requirement; scope and repository convention need confirmation.	Confirm whether this check applies to non-Ginkgo Go unit tests and whether existing testify assertions without messages are accepted.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the DualReplica CVO availability exceptions added for NoExecuteTaintManager tests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff adds only static Go test and subtest names; no Ginkgo titles or dynamic pod, node, namespace, timestamp, IP, UUID, or generated values appear in titles.
Microshift Test Compatibility	✅ Passed	The PR adds a standard Go TestOverlapsNoExecuteTaintManagerTest, not a Ginkgo e2e test; it only constructs monitorapi intervals and references no MicroShift-incompatible API or feature.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds a standard Go unit test and interval helpers, not a new Ginkgo e2e test; it introduces no SNO multi-node assumption requiring review.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only legacy monitor interval filtering and tests; it adds no manifests, controllers, replicas, affinities, spread constraints, selectors, tolerations, or PDBs.
Ote Binary Stdout Contract	✅ Passed	The diff adds interval logic and unit-test assertions only; no main/init/suite setup or stdout-writing calls appear in the changed package.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The added test is a standard Go unit test, not a Ginkgo e2e test; it only builds monitorapi intervals and uses time arithmetic, with no IPv4 assumptions or network access.
No-Weak-Crypto	✅ Passed	The commit only adds interval filtering and tests; its added lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret-comparison code.
Container-Privileges	✅ Passed	The patch changes only two Go files and adds no container or Kubernetes manifest privilege settings such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds interval matching and test fixtures only; it adds no logging calls or sensitive literals, and the existing JUnit event serialization remains unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-105606, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Serial NoExecuteTaintManager tests taint a control-plane node on DualReplica (masters are also workers), briefly driving csi-snapshot-controller and packageserver Available=False. Mirror the existing upgrade-path exceptions in the stable-system monitor so TNF serial jobs do not fail on these expected blips.

Summary by CodeRabbit

• Tests
• Improved upgrade and disruption testing for dual-replica and highly available arbiter configurations.
• Test validation now accommodates expected temporary availability conditions while system components recover.
• Added coverage for transient snapshot-controller and package-server status changes during two-node operations.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators.go`:
- Around line 90-97: Update the csi-snapshot-controller exception comment and
returned message in the isTwoNode branch to describe both DualReplica and
HighlyAvailableArbiterMode, or use the generic “two-node topology” wording. Keep
the existing condition matching and exception behavior unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 716ea3a2-b3de-4880-8dad-975b9d716178

📥 Commits

Reviewing files that changed from the base of the PR and between 29be8bd and f4a867c.

📒 Files selected for processing (1)

• pkg/monitortests/clusterversionoperator/legacycvomonitortests/operators.go

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[eggfoobar]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial

[openshift-ci]

@eggfoobar: trigger 3 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-1of3
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-2of3
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-3of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b64786d0-9635-11f1-9dbe-1e0a0336105d-0

[fonta-rh]

/approve

[fonta-rh]

/lgtm

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[eggfoobar]

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial

[openshift-ci]

@eggfoobar: trigger 3 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-1of3
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-2of3
• periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ovn-two-node-fencing-serial-3of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d79dae40-9702-11f1-87f2-59784e8fad07-0

[eggfoobar]

/verified by CI

Serial lanes now pass with out the NoExecuteTaintManager error.

[openshift-ci-robot]

@eggfoobar: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Serial lanes now pass with out the NoExecuteTaintManager error.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[neisw]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eggfoobar, fonta-rh, neisw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [neisw]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[eggfoobar]

/retest-required

[openshift-ci]

@eggfoobar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi-ovn-ipv6	638822f	link	true	/test e2e-metal-ipi-ovn-ipv6

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 6e25f2a and 2 for PR HEAD 638822f in total