OCPBUGS-83624: Embed credentials_request.yaml template in test binary

[jrangelramos]

Summary

• Fix conformance test failure where oc process can't find test/extend/testdata/credentials_request.yaml when the test binary runs outside the source tree in CI
• Use go:embed to compile the template into the test binary so it's available regardless of working directory
• Affects 4 tests (PolarionIDs: 64885, 45975, 69971, 75429)

Test plan

• Verify go build ./cmd/cloud-credential-tests-ext/ compiles cleanly
• Run the failing conformance test Critical-CCO-based flow for olm managed operators and AWS STS in CI
• Confirm the other 3 affected tests (45975, 69971, 75429) also pass

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Updated cloud credential test setup to apply embedded request templates through temporary files.
  • Removed unused template data from test request construction while preserving existing credential fields and test flows.
  • Added cleanup of temporary template files after use.

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-83624, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Fix conformance test failure where oc process can't find test/extend/testdata/credentials_request.yaml when the test binary runs outside the source tree in CI
• Use go:embed to compile the template into the test binary so it's available regardless of working directory
• Affects 4 tests (PolarionIDs: 64885, 45975, 69971, 75429)

Test plan

• Verify go build ./cmd/cloud-credential-tests-ext/ compiles cleanly
• Run the failing conformance test Critical-CCO-based flow for olm managed operators and AWS STS in CI
• Confirm the other 3 affected tests (45975, 69971, 75429) also pass

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jrangelramos
Once this PR has been reviewed and has the lgtm label, please assign jstuever for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The test utility now embeds the credentials request template and writes it to a temporary YAML file during resource creation. Tests no longer provide a file-based template path for the invalid request.

Changes

Credentials request template handling

Layer / File(s)	Summary
Temporary template application test/extend/cloudcredential_util.go, test/extend/cloudcredential.go	The utility embeds testdata/credentials_request.yaml, writes it to a temporary file, applies parameter substitution, and cleans up the file. The invalid CredentialsRequest no longer sets a template path.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes embedding the credentials request template in the test binary, which is the main change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes no Ginkgo declarations; all affected-file It and Describe titles are static string literals with no runtime values.
Test Structure And Quality	✅ Passed	The PR changes do not negatively affect test quality. Tests use proper setup/cleanup with defer statements, include timeouts on all cluster operations (Eventually/Consistently with WithTimeout), fo...
Microshift Test Compatibility	✅ Passed	The PR adds no Ginkgo tests. The four modified tests already run under a Describe JustBeforeEach that calls skipIfMicroShift and g.Skip; the changes only embed and apply the template.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. The changes only refactor how existing tests load a template file using go:embed instead of relative file paths. The four affected tests (PolarionIDs 6...
Topology-Aware Scheduling Compatibility	✅ Passed	The patch only changes cloud credential tests and embeds a CredentialsRequest template; it adds no deployment, controller, or topology scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR introduces no process-level code changes; embedded template and its use are confined to test-level methods invoked from It() blocks, which are exempt from OTE stdout contract requirements.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add new Ginkgo e2e tests. It refactors existing tests (PolarionIDs 64885, 45975, 69971, 75429) to use go:embed for the credentials_request.yaml template instead of relative file pa...
No-Weak-Crypto	✅ Passed	The PR adds only embedding and temporary-file handling; changed additions contain no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only Go test files and embeds a CredentialsRequest template; no container/Kubernetes manifest or prohibited privilege setting was added.
No-Sensitive-Data-In-Logs	✅ Passed	The patch adds no logging calls. The new code writes a static template and passes only names, namespace, and provider; it does not log template bytes or credential values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.21%. Comparing base (6191d55) to head (c148f3e).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1072   +/-   ##
=======================================
  Coverage   47.21%   47.21%           
=======================================
  Files          97       97           
  Lines       12650    12650           
=======================================
  Hits         5973     5973           
  Misses       6017     6017           
  Partials      660      660           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extend/cloudcredential_util.go`:
- Line 269: Update the deferred cleanup around tmpFile in the surrounding test
helper to capture the error returned by os.Remove and report unexpected failures
through the test’s existing error-reporting mechanism, while preserving cleanup
execution on all exit paths.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 99312581-2c23-4e22-bb06-61ec28dc2d94

📥 Commits

Reviewing files that changed from the base of the PR and between 6191d55 and c148f3e.

📒 Files selected for processing (2)

• test/extend/cloudcredential.go
• test/extend/cloudcredential_util.go

💤 Files with no reviewable changes (1)

• test/extend/cloudcredential.go

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-83624, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Summary

• Fix conformance test failure where oc process can't find test/extend/testdata/credentials_request.yaml when the test binary runs outside the source tree in CI
• Use go:embed to compile the template into the test binary so it's available regardless of working directory
• Affects 4 tests (PolarionIDs: 64885, 45975, 69971, 75429)

Test plan

• Verify go build ./cmd/cloud-credential-tests-ext/ compiles cleanly
• Run the failing conformance test Critical-CCO-based flow for olm managed operators and AWS STS in CI
• Confirm the other 3 affected tests (45975, 69971, 75429) also pass

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
• Updated cloud credential test setup to apply embedded request templates through temporary files.
• Removed unused template data from test request construction while preserving existing credential fields and test flows.
• Added cleanup of temporary template files after use.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@jrangelramos: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-hypershift	c148f3e	link	true	/test e2e-hypershift
ci/prow/security	c148f3e	link	true	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jrangelramos]

Hello @jstuever greetings! Would you mind reviewing this PR? Thanks!

[jrangelramos]

/cc @huangmingxia

[openshift-ci]

@jrangelramos: GitHub didn't allow me to request PR reviews from the following users: huangmingxia.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc @huangmingxia

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.