[blocked] chore(e2e): Cloud SQL runtime E2E Auth Proxy (Helm + Operator) - #5143
Open
zdrapela wants to merge 34 commits into
Open
[blocked] chore(e2e): Cloud SQL runtime E2E Auth Proxy (Helm + Operator)#5143zdrapela wants to merge 34 commits into
zdrapela wants to merge 34 commits into
Conversation
Introduce an instance-readiness module so globalSetup distinguishes live instance URLs, auth router stubs, and runtime auto-deploy. Keep predicted runtime BASE_URL for Playwright config freeze, deploy before healthcheck when RUNTIME_AUTO_DEPLOY=true, drop localization smoke deps, restore e2e-tests lint-staged, and document /test job verification for agents. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Auth fixtures looked for yamls under rhdh-deployment/ after the folder split. Operator runtime was missing BACKEND_SECRET/auth.keys and the homepage plugin, leaving readiness at HTTP 503. Co-authored-by: Cursor <cursoragent@cursor.com>
prepareProvider updates ConfigMaps before createBackstageDeployment. Capturing reconcile baseline must tolerate a missing deployment. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
waitForRolloutStart treated a missing Deployment as a hard error, so auth prepareProvider failed immediately after applying the Backstage CR. Co-authored-by: Cursor <cursoragent@cursor.com>
Extract OperatorInstallProfile and DynamicPluginsProfile so auth and runtime stop drifting on flavours, includes, and BACKEND_SECRET. Stage auth deploy readiness as Available → HTTP → synced behind AuthInstanceDeployer. Co-authored-by: Cursor <cursoragent@cursor.com>
Stop dual BACKEND_SECRET injection, stage created→HTTP→synced so 503s surface before Available timeouts, always publish instance BASE_URL after runtime deploy, and align auth YAML fixtures with the install profile. Co-authored-by: Cursor <cursoragent@cursor.com>
Auth CI leaves BASE_URL empty so globalSetup no-ops, but rhdhContext ignored
describe-level baseURL and login goto("/") failed with invalid URL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Centralize helm/operator URL naming, scope RUNTIME_AUTO_DEPLOY so it cannot stomp later projects, wait for authenticated global-header after OAuth, and kill port-forward process groups cleanly. Co-authored-by: Cursor <cursoragent@cursor.com>
Fix catalog sync log races, assert cookieMaxAge for refresh tokens, stop Azure redirect churn, tolerate failed-login alerts, and re-order OIDC+GitHub secondary auth around reconcile. Co-authored-by: Cursor <cursoragent@cursor.com>
Force pod restart and Deployment Ready after ConfigMap updates so resolvers, sessionDuration, and autologout actually load; switch cookie tests to the correct Backstage key and harden post-reconcile navigation/IdP waits. Co-authored-by: Cursor <cursoragent@cursor.com>
Default reconcile waits HTTP-only after mounted-config proof, shares cookie and label helpers, returns authenticated|error from login, and moves GitHub provider sign-out into the Settings POM. Co-authored-by: Cursor <cursoragent@cursor.com>
Playwright TimeoutError from request.get aborted expect.poll after one attempt, so post-reconcile HTTP readiness never used its full budget. Co-authored-by: Cursor <cursoragent@cursor.com>
The catalog identity-error regex had a ';u' typo that broke expected-error cases; also reuse healthy auth namespaces on worker restart and harden IdP popup/login outcome locality so nightlies stop burning the 2h budget. Co-authored-by: Cursor <cursoragent@cursor.com>
Worker-restart reuse was dying on AlreadyExists when recreating secrets, and sessionDuration cases inherited broken resolvers from earlier login tests. Co-authored-by: Cursor <cursoragent@cursor.com>
…tions Requiring role=main before loader settle burned the readiness budget on stuck progressbar paints; also retry ERR_ABORTED and enrich secret k8s errors. Co-authored-by: Cursor <cursoragent@cursor.com>
…ap errors Make waitForAppReady observe the CI stuck-progressbar paint, reset the page before goto retries, and surface ConfigMap k8s failures with status detail. Co-authored-by: Cursor <cursoragent@cursor.com>
Pin autologout resolver/config, poll refresh-cookie absence after reload, and wrap config-liveness/wait API failures so CI no longer shows opaque HttpErrors. Co-authored-by: Cursor <cursoragent@cursor.com>
Operator nightlies CrashLoop when the default lightspeed flavour injects OCI pulls; pin flavours: [] on start CRs to match OperatorInstallProfile. Also fail closed until the customization-provider S2I build leaves a non-whitespace Deployment image. Co-authored-by: Cursor <cursoragent@cursor.com>
Restore redhat-developer#4791 lightspeed disabled overrides in showcase helm values so install-dynamic-plugins cannot fail on unresolved {{inherit}}. Raise catalog API timeouts and poll ingestion checks so OIDC entity sync can finish through Routes without cascading skips. Co-authored-by: Cursor <cursoragent@cursor.com>
Stop burning the 120s ingestion budget on HTTP/shape errors, drop nested expect.poll wrappers, and align CI lightspeed overrides with post-redhat-developer#5021 enabled:false so helm/auth nightlies fail for the right reason. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Skipping CI for Draft Pull Request. |
Contributor
|
The container image build workflow finished with status: |
Member
Author
|
/test e2e-ocp-helm-nightly |
|
@zdrapela: No presubmit jobs available for redhat-developer/rhdh@fix/e2e-readiness-and-localization-gates DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
zdrapela
changed the base branch from
fix/e2e-readiness-and-localization-gates
to
main
July 23, 2026 13:40
Member
Author
|
/test e2e-ocp-helm-nightly |
Wire DynamicHomePage into Helm runtime values (matching operator), move external-DB configure into beforeAll so Verify can retry without redeploying, and assert Welcome in the config-map canary.
includes: [] made install-dynamic-plugins finish before chart Postgres was ready, so helm --wait timed out on 503. Keep DynamicHomePage on / but restore dynamic-plugins.default.yaml for Helm only.
Operator nightly is broken; keep RHIDP-9140 Helm path only and skip operator installs until RHIDP-9141 can land.
zdrapela
force-pushed
the
feat/cloudsql-runtime-tests
branch
from
July 27, 2026 11:19
4ba9967 to
ba499e3
Compare
zdrapela
changed the title
Member
Author
|
/test e2e-ocp-helm-nightly |
zdrapela
marked this pull request as ready for review
July 27, 2026 11:22
Member
Author
|
/test e2e-ocp-helm-nightly |
Keep main's empty-BASE_URL runtime deploy wiring; retain route-identity helpers in runtime-deploy. Unblocks Prow/Helm nightly on redhat-developer#5143.
|
Code review by qodo was updated up to the latest commit ba499e3 |
Member
Author
|
/test e2e-ocp-helm-nightly |
Align public-host cleanup with the RDS/Azure certificatePath contract while keeping Auth Proxy (localhost + ssl disable) for the RHDH app path.
Member
Author
|
/test e2e-ocp-helm-nightly |
Member
Author
|
/test e2e-ocp-helm-nightly |
Own the Auth Proxy in the Backstage CR deployment.patch for Operator, lift the Helm-only gate, and verify public-IP clearDatabase against per-instance server CAs (skip hostname check for IP hosts).
Member
Author
|
/test e2e-ocp-helm-nightly |
zdrapela
changed the title
Contributor
|
Hey there and thank you for opening this pull request! 👋🏼 We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted. Details: |
|
|
@zdrapela: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
zdrapela
changed the title
zdrapela
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds Helm runtime E2E coverage for Google Cloud SQL via the Cloud SQL Auth Proxy (native sidecar), matching the approach already used for RDS/Azure external DB suites.
Closes RHIDP-9140.
Operator coverage (RHIDP-9141) is deferred while operator nightly is broken.
Why Auth Proxy (not direct
type: cloudsql)Backstage documents direct Cloud SQL via
@google-cloud/cloud-sql-connector, but that package is only an optional peer of@backstage/backend-defaultsand is not installed in shipped RHDH. Helm docs today cover host/port TLS for RDS/Azure-style Postgres, not Cloud SQL connector config.Product support for a direct Cloud SQL connection is tracked as RHDHPLAN-155. Until that lands, automating the verified Auth Proxy path is the feasible E2E approach.
What this PR does
verify-tls-config-with-external-cloudsql.spec.ts(Helm-only)RuntimeHarnessAPIs to inject the proxy sidecar (Helm values overlay without--wait+ Deployment JSON patch)CLOUDSQL_*+cloudsql-service-account.jsonfrom Vault in.ci/pipelines/env_variables.sh(no DB CA PEM)Stacked on #5083 (
fix/e2e-readiness-and-localization-gates).Which issue(s) does this PR fix
PR acceptance criteria
yarn test:unitine2e-tests)/test e2e-ocp-helm-nightly)docs/e2e-tests/CI-medic-guide.md)How to test changes / Special notes to the reviewer
Vault keys (populated in CI):
CLOUDSQL_USER,CLOUDSQL_PASSWORD,CLOUDSQL_INSTANCE_1..4(project:region:instance),CLOUDSQL_1_HOST..4,cloudsql-service-account.json. DB cleanup uses public host TLS withrejectUnauthorized: false— do not usecloudsql-db-certificates.pemfor now.Local checks:
yarn fmt,yarn lint,yarn test:unitundere2e-tests.