OCPBUGS-114052: Restore login scenario to test-prow-e2e.sh

[ShazaAldawamneh]

Analysis / Root cause:
Commit 8cb612eea9 (OCPBUGS-112462, Aug 20th) removed the login scenario from test-prow-e2e.sh when cleaning up the empty Cypress integration-tests package. However, the e2e-console-login CI job in openshift-release still passes login as the scenario argument, causing a hard failure: error: unknown scenario 'login' (use: e2e, release, or smoke). This has been perma-failing since August 20th and is blocking PRs in openshift/cluster-authentication-operator.

Solution description:
Re-add the login scenario to test-prow-e2e.sh, now routing to the Playwright equivalent (e2e/tests/console/app/auth-multiuser-login.spec.ts) instead of the old Cypress path. The htpasswd environment variables (BRIDGE_HTPASSWD_IDP, BRIDGE_HTPASSWD_USERNAME, BRIDGE_HTPASSWD_PASSWORD) are exported so the Playwright test can authenticate as the test user.

Screenshots / screen recording:
N/A — CI script change only.

Test setup:
Trigger the e2e-console-login CI job on a cluster-authentication-operator PR.

Test cases:

e2e-console-login CI job passes instead of failing with "unknown scenario"
The Playwright auth-multiuser-login spec runs and validates both htpasswd and kubeadmin login
Browser conformance:
N/A — CI script change only.

Additional info:
Fixes the perma-failing ci/prow/e2e-console-login job that has been blocking openshift/cluster-authentication-operator merges since Aug 20th.

Reviewers and assignees:
/assign @logonoff

Summary by CodeRabbit

• New Features
  • Added a documented end-to-end login test scenario.
  • The scenario now configures default test credentials and runs the multi-user login checks.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-114052, which is invalid:

• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Verified instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause:
Commit 8cb612eea9 (OCPBUGS-112462, Aug 20th) removed the login scenario from test-prow-e2e.sh when cleaning up the empty Cypress integration-tests package. However, the e2e-console-login CI job in openshift-release still passes login as the scenario argument, causing a hard failure: error: unknown scenario 'login' (use: e2e, release, or smoke). This has been perma-failing since August 20th and is blocking PRs in openshift/cluster-authentication-operator.

Solution description:
Re-add the login scenario to test-prow-e2e.sh, now routing to the Playwright equivalent (e2e/tests/console/app/auth-multiuser-login.spec.ts) instead of the old Cypress path. The htpasswd environment variables (BRIDGE_HTPASSWD_IDP, BRIDGE_HTPASSWD_USERNAME, BRIDGE_HTPASSWD_PASSWORD) are exported so the Playwright test can authenticate as the test user.

Screenshots / screen recording:
N/A — CI script change only.

Test setup:
Trigger the e2e-console-login CI job on a cluster-authentication-operator PR.

Test cases:

e2e-console-login CI job passes instead of failing with "unknown scenario"
The Playwright auth-multiuser-login spec runs and validates both htpasswd and kubeadmin login
Browser conformance:
N/A — CI script change only.

Additional info:
Fixes the perma-failing ci/prow/e2e-console-login job that has been blocking openshift/cluster-authentication-operator merges since Aug 20th.

Reviewers and assignees:
/assign @logonoff

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ShazaAldawamneh
Once this PR has been reviewed and has the lgtm label, please assign therealjon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 32a48dbf-794b-4da0-8e23-8d69a7f90f71

📥 Commits

Reviewing files that changed from the base of the PR and between ef4699c and 5672a28.

📒 Files selected for processing (1)

• test-prow-e2e.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The E2E test script adds a documented login scenario. The scenario sets default htpasswd credentials and runs the console authentication multiuser Playwright spec.

Changes

Login E2E scenario

Layer / File(s)	Summary
Login scenario execution test-prow-e2e.sh	The script documents the login scenario, sets default test htpasswd credentials, and invokes the targeted Playwright spec with the console project.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 5672a

This localized CI script change restores the login scenario and routes it to the Playwright authentication test; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: logonoff

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The added login branch exports BRIDGE_HTPASSWD_PASSWORD while test-prow-e2e.sh has set -x enabled from line 42. Bash xtrace prints expanded export arguments, so a supplied password can appea…	Disable xtrace before the three BRIDGE_HTPASSWD_* exports and re-enable it afterward, or otherwise mask the values. For example, add set +x before the exports and set -x after them. Verify that the login scenario trace contains no pas…

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Jira issue and the main change: restoring the login scenario in test-prow-e2e.sh.
Description check	✅ Passed	The description covers the root cause, solution, test setup, test cases, browser conformance rationale, additional information, and reviewer assignment. It is complete for a CI script change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh. It adds a static scenario comment, environment defaults, and a Playwright command. It does not add or modify any Ginkgo It, Describe, `Conte…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh; it adds scenario routing and environment exports. It does not add or modify Ginkgo test code. The referenced auth-multiuser-login.spec.ts is a…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh. It adds a login shell scenario and invokes an existing Playwright spec. No new Ginkgo e2e test (It, Describe, Context, or When) was ad…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh. It adds a login shell-script branch that invokes the existing Playwright auth-multiuser-login.spec.ts file and sets htpasswd credentials. It…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh. It adds a documented login shell scenario and Playwright invocation. It does not add or modify deployment manifests, operator code, controller…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh (+6 lines) and introduces no OTE binary or Go process-level code. The added lines export test credentials and invoke the Playwright login spec; t…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request changes only test-prow-e2e.sh. It adds a shell path that invokes the existing Playwright auth-multiuser-login.spec.ts; it does not add or change any Ginkgo e2e test (It, …
No-Weak-Crypto	✅ Passed	PASS. The pull request changes only test-prow-e2e.sh. The added lines document and launch the login test and set test htpasswd variables. They introduce no MD5, SHA1, DES, RC4, 3DES, Blowfish, or EC…
Container-Privileges	✅ Passed	PASS: The pull request changes only test-prow-e2e.sh. The added lines document login, set authentication environment variables, and invoke the existing Playwright login spec. No container or Kuber…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only test-prow-e2e.sh. It adds a static scenario comment, environment defaults, and a Playwright command. It does not add or modify any Ginkgo It, Describe, Context, or When test title. The referenced Playwright spec is unchanged and its existing titles are static.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only test-prow-e2e.sh; it adds scenario routing and environment exports. It does not add or modify Ginkgo test code. The referenced auth-multiuser-login.spec.ts is a pre-existing Playwright test, so the stated Ginkgo-specific requirements do not apply.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only test-prow-e2e.sh. It adds a login shell scenario and invokes an existing Playwright spec. No new Ginkgo e2e test (It, Describe, Context, or When) was added, so the MicroShift API compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only test-prow-e2e.sh. It adds a login shell-script branch that invokes the existing Playwright auth-multiuser-login.spec.ts file and sets htpasswd credentials. It adds no Ginkgo e2e test (It(), Describe(), Context(), or When()), so the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only test-prow-e2e.sh. It adds a documented login shell scenario and Playwright invocation. It does not add or modify deployment manifests, operator code, controllers, replicas, affinity, topology spread, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only test-prow-e2e.sh (+6 lines) and introduces no OTE binary or Go process-level code. The added lines export test credentials and invoke the Playwright login spec; they do not add stdout writes in main(), suite setup, or other OTE process-level code. The stdout JSON contract check is therefore inapplicable.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS — The pull request changes only test-prow-e2e.sh. It adds a shell path that invokes the existing Playwright auth-multiuser-login.spec.ts; it does not add or change any Ginkgo e2e test (It, Describe, Context, or When). The referenced Playwright spec was not changed by this pull request. Therefore, this custom check is not applicable, and it introduces no stated IPv4 or external-connectivity failure condition.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes only test-prow-e2e.sh. The added lines document and launch the login test and set test htpasswd variables. They introduce no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, custom cryptography, or secret/token comparisons. The reached performLogin helper is pre-existing and only fills the login form.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only test-prow-e2e.sh. The added lines document login, set authentication environment variables, and invoke the existing Playwright login spec. No container or Kubernetes manifest changed, and no added line sets privileged, host namespaces, SYS_ADMIN, allowPrivilegeEscalation, or root execution. The selected login spec contains no listed privilege settings.

Full details: No-Sensitive-Data-In-Logs

Explanation

The added login branch exports BRIDGE_HTPASSWD_PASSWORD while test-prow-e2e.sh has set -x enabled from line 42. Bash xtrace prints expanded export arguments, so a supplied password can appear in CI logs. The isolated Bash trace reproduced the password value in the log. The parent-to-HEAD diff confirms these exports are introduced by this pull request.

Resolution

Disable xtrace before the three BRIDGE_HTPASSWD_* exports and re-enable it afterward, or otherwise mask the values. For example, add set +x before the exports and set -x after them. Verify that the login scenario trace contains no password, token, or other credential value.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@ShazaAldawamneh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[redhat-chai-bot]

Nice fix — this unblocks the e2e-console-login jobs in cluster-authentication-operator. Two small suggestions:

1. Wrap credential exports in set +x / set -x

The script enables set -exuo pipefail at the top, so xtrace will echo the expanded export BRIDGE_HTPASSWD_PASSWORD=... into CI logs. The script already guards against this for the kubeadmin password (lines 38–40). The login branch should follow the same pattern:

elif [ "$SCENARIO" == "login" ]; then
  set +x
  export BRIDGE_HTPASSWD_IDP="${BRIDGE_HTPASSWD_IDP:-test}"
  export BRIDGE_HTPASSWD_USERNAME="${BRIDGE_HTPASSWD_USERNAME:-test}"
  export BRIDGE_HTPASSWD_PASSWORD="${BRIDGE_HTPASSWD_PASSWORD:-test}"
  set -x
  ./integration-tests/test-playwright.sh -- --project=console e2e/tests/console/app/auth-multiuser-login.spec.ts "$@"

2. Update the error message

The else fallback still says (use: e2e, release, or smoke) — should now include login:

echo "error: unknown scenario '$SCENARIO' (use: e2e, release, login, or smoke)" >&2

---

Also, the e2e-playwright-techpreview failure on this PR is a GCP cluster bootstrap flake (API server never came up, installer exit code 5) — unrelated to this change.

---

AI-generated. Review for accuracy.