Reintroduce aggregated features test

[Miquel Simon (miquelsi)]

https://redhat.atlassian.net/browse/ARO-22744

What

This new E2E test aggregates the following features in one cluster+nodepools scenario:

• External OIDC provider via ExternalAuth
• Cilium CNI with kube-proxy replacement
• ETCD data encryption with customer-managed keys
• ETCD disk-level encryption with platform-managed keys
• Internal image registry disabled
• API IP address access control (authorized CIDRs)
• KeyVaultVisibility set to Private

Why

Without this kind of testing, we can’t assume that the complex features work well together.

Testing

Testing is required for feature completion and tests should be part of the pull
request along with the feature changes.

Describe the testing provided. If you did not add tests, provide a clear
justification.

• Unit tests
• Integration tests
• E2E tests

Special notes for your reviewer

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Screenshots included (if graph/UI/metrics changes)
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide)
• Draft PR used for WIP (if applicable)
• Commit history is clean (rebased/squashed)
• Tricky code blocks are commented
• Specific reviewers tagged
• All comment threads resolved before merge

If E2E tests are included:

• E2E tests follow Principles of Good E2E Test Case Design
• If new E2E use case is covered (via a new test or new check/verifier),
  demonstrate that the test is able to detect a defect/error and fail with
  proper error message and logs which communicates nature of the problem.

[Copilot]

Pull request overview

This PR reintroduces an end-to-end “feature aggregation” test that provisions a single HCP cluster and node pools with multiple advanced features enabled together, to catch feature-interaction regressions that aren’t covered by isolated tests.

Changes:

• Adds a new E2E test that exercises aggregated advanced features (authorized CIDRs, private KeyVault visibility, disabled image registry, Cilium with kube-proxy replacement, etcd encryption, and external OIDC auth) in one scenario.
• Updates the Cilium connectivity-check verifier to avoid name collisions across repeated invocations by randomizing the namespace and rewriting the cluster-scoped SCC.
• Adds small framework/verifier helpers and refreshes suite listing fixtures.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/util/verifiers/helper.go	Extends arbitrary-resource creation helper to accept mutators before create.
test/util/verifiers/cilium.go	Randomizes connectivity-check namespace and rewrites SCC names/service-account references to avoid collisions.
test/util/framework/vm_helper.go	Skips VM console log download when no artifact output directory is configured.
test/util/framework/hcp_helper.go	Adds helper to resolve the test runner public IP for authorized CIDR configuration.
test/e2e/cluster_create_feature_aggregation.go	New aggregated-features E2E test covering multiple advanced features in one cluster + node pools scenario.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_stage_parallelstage_parallel.txt	Updates generated suite listing to include the new test.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_rp_api_compat_all_parallelrp_api_compat_all_parallel.txt	Updates generated suite listing to include the new test.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_rp_api_compat_all_parallel_01rp_api_compat_all_parallel_development.txt	Updates generated suite listing to include the new test.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_prod_parallelprod_parallel.txt	Updates generated suite listing to include the new test.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_integration_parallelintegration_parallel.txt	Updates generated suite listing to include the new test.
test/testdata/zz_fixture_TestMainListSuitesForEachSuite_dev_cd_check_paralleldev_cd_check_parallel.txt	Updates generated suite listing to include the new test.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (3)

test/util/framework/hcp_helper.go:364

• GetTestRunnerPublicIP uses http.DefaultClient without a timeout and doesn't check the HTTP status code. In CI this can hang indefinitely on network issues, or treat a non-200 response body as an IP and fail with a misleading parse error. Add an explicit timeout, validate StatusCode, and limit the bytes read.

func GetTestRunnerPublicIP(ctx context.Context) (string, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://checkip.amazonaws.com", nil)
	if err != nil {
		return "", fmt.Errorf("failed to build public IP echo request: %w", err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", fmt.Errorf("failed to query public IP echo service: %w", err)
	}
	defer resp.Body.Close()
	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("failed to read public IP echo response: %w", err)
	}
	ip := strings.TrimSpace(string(body))
	if net.ParseIP(ip) == nil {
		return "", fmt.Errorf("public IP echo service returned invalid IP %q", ip)
	}
	return ip, nil

test/e2e/cluster_create_feature_aggregation.go:384

• The Graph AddPassword call uses time.Now() for the start time. Other E2E tests in this repo shift the start time into the past to avoid flakiness from clock skew between the test runner and Microsoft Graph. Align with that pattern here to reduce intermittent failures.

			graphClient, err := tc.GetGraphClient(ctx)
			Expect(err).NotTo(HaveOccurred(), "failed to get Microsoft Graph client for external OIDC configuration")
			pass, err := graphClient.AddPassword(ctx, app.ID, "agg-ext-auth-pass", time.Now(), time.Now().Add(24*time.Hour))
			Expect(err).NotTo(HaveOccurred(), "failed to add client secret to app registration for external OIDC configuration")

test/util/verifiers/helper.go:43

• The mutator hook is variadic, but if a caller accidentally passes a nil mutator (e.g., from a conditional append), this will panic when invoked. Skipping nil entries makes this helper more defensive without changing behavior for valid mutators.

	// Apply any caller-provided mutations (e.g. rewriting cluster-scoped
	// resource names or references) before the resource is created.
	for _, mutate := range mutators {
		if err := mutate(desiredObj); err != nil {
			return nil, err
		}
	}

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

test/util/framework/hcp_helper.go:350

• GetTestRunnerPublicIP uses http.DefaultClient with no timeout and doesn’t validate the HTTP status code. If the echo service is slow/unreachable, this can hang/flap E2E runs, and non-200 responses (HTML/error pages) may be parsed as an “IP” and produce a confusing parse error.

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://checkip.amazonaws.com", nil)
	if err != nil {
		return "", fmt.Errorf("failed to build public IP echo request: %w", err)
	}
	resp, err := http.DefaultClient.Do(req)

[Miquel Simon (miquelsi)]

/test images

[Miquel Simon (miquelsi)]

/test images

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

test/util/framework/hcp_helper.go:363

• GetTestRunnerPublicIP uses http.DefaultClient without an explicit timeout and doesn’t check for non-200 responses. If the caller forgets to set a context deadline or the service returns an error page, this can hang or return a confusing "invalid IP" error. Add a bounded timeout and validate resp.StatusCode, including the response body in the error for easier debugging.

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://checkip.amazonaws.com", nil)
	if err != nil {
		return "", fmt.Errorf("failed to build public IP echo request: %w", err)
	}
	resp, err := http.DefaultClient.Do(req)

[Martin Bukatovic (mbukatov)]

Fix from #6438 as well as increase of kube client hrottling limits is included.

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mbukatov, miquelsi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/OWNERS [miquelsi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment