Skip to content

fix: fix dex e2e test failures #1165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jun 5, 2026
Merged

fix: fix dex e2e test failures #1165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {
} else {
// when running against RC/ released version of gitops
expected_dexVersion = "v2.45.0"
expected_redisVersion = "7.2.11"
expected_redisVersion = "8.2.3"
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jun 4, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify actual Redis version and output format in openshift-gitops namespace

# Wait for Redis pod to be ready
echo "Waiting for Redis pod..."
redis_pod=$(oc get pods -n openshift-gitops -l app.kubernetes.io/name=redis -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)

if [ -z "$redis_pod" ]; then
  echo "ERROR: No Redis pod found in openshift-gitops namespace"
  exit 1
fi

echo "Found Redis pod: $redis_pod"

# Get Redis version
echo "Extracting Redis version..."
version_output=$(oc exec -n openshift-gitops "$redis_pod" -- redis-server -v 2>/dev/null)
echo "Raw output: $version_output"

# Check if output matches expected format
if echo "$version_output" | grep -q "v="; then
  version=$(echo "$version_output" | sed 's/.*v=\([^ ]*\).*/\1/')
  echo "Parsed version: $version"
  echo "Expected version: 8.2.3"
  if [ "$version" = "8.2.3" ]; then
    echo "✓ Version matches expectation"
  else
    echo "✗ Version mismatch: got $version, expected 8.2.3"
  fi
else
  echo "✗ Output format does not contain 'v=' pattern"
  echo "This may break the version parsing logic"
fi

Repository: redhat-developer/gitops-operator

Length of output: 157

Fix Redis-version verification to locate the actual Redis pod before checking output format.

The suggested verification script doesn’t find any Redis pod in the openshift-gitops namespace with -l app.kubernetes.io/name=redis (“No Redis pod found…”). Update the script to discover the Redis pod using the same selector/pod name logic the test uses (or dynamically search pod names for “redis” in the relevant namespace(s)), then run redis-server -v and ensure the parsed v=X.Y.Z matches 8.2.3 and conforms to the expected Redis server v=X.X.X sha=... format used by the parsing logic (around lines 167-173).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go` at line
103, The test currently fails to find a Redis pod before running the version
check; update the verification to discover the actual Redis pod using the same
selector/pod-name resolution logic used elsewhere in the test (e.g., look for
pods with label app.kubernetes.io/name=redis or any pod name containing "redis"
in the openshift-gitops namespace), then exec into that pod and run
`redis-server -v`; parse the output to extract the v=X.Y.Z token and assert it
equals the expected_redisVersion ("8.2.3") and that the full output matches the
expected "Redis server v=X.X.X sha=..." format used by the parsing code around
lines 167-173 so the check reliably targets the real Redis container before
parsing.

Copy link
Copy Markdown
Member

@svghadi svghadi Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might not require this change. Please revert if the tests fail.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@svghadi, understood. The change aligns both the prow and non-prow paths to 8.2.3, so monitoring the test results will be the clearest signal. If the deployed Redis image reports a different version string, reverting this line should be straightforward. Feel free to ping me if you'd like help investigating a failure.

}

By("locating pods containing toolchain in openshift-gitops")
Expand Down
29 changes: 12 additions & 17 deletions test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ package parallel

import (
"context"
"strings"

argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1"
. "github.com/onsi/ginkgo/v2"
Expand Down Expand Up @@ -90,30 +89,26 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {

By("validating that the Dex Client Secret was copied from dex serviceaccount token secret in to argocd-secret, by the operator")

// To verify the behavior we should first get the token secret name of the dex service account.
// The operator now creates an Opaque secret with a deterministic name for the Dex token
// (via TokenRequest API) instead of using auto-generated kubernetes.io/service-account-token secrets.
// The secret name follows the pattern: <argocd-name>-<dex-sa-name>-token
dexTokenSecretName := "example-argocd-argocd-dex-server-token" // #nosec G101 -- This is a Kubernetes secret name, not a credential

var secretName string
for _, secretData := range serviceAccount.Secrets {

if strings.Contains(secretData.Name, "token") {
secretName = secretData.Name
}
}
Expect(secretName).ToNot(BeEmpty())

// Extract the clientSecret
secretReferencedFromServiceAccount := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: ns.Name}}
Eventually(secretReferencedFromServiceAccount).Should(k8sFixture.ExistByName())
tokenFromSASecret := secretReferencedFromServiceAccount.Data["token"]
Expect(tokenFromSASecret).ToNot(BeEmpty())
// Extract the clientSecret from the Dex token secret
dexTokenSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: dexTokenSecretName, Namespace: ns.Name}}
Eventually(dexTokenSecret, "30s", "2s").Should(k8sFixture.ExistByName())
tokenFromDexSecret := dexTokenSecret.Data["token"]
Expect(tokenFromDexSecret).ToNot(BeEmpty())
// Verify the secret also contains an expiry field
Expect(dexTokenSecret.Data["expiry"]).ToNot(BeEmpty())

// actualClientSecret is the value of the secret in argocd-secret where argocd-operator should copy the secret from
argocdSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "argocd-secret", Namespace: ns.Name}}
Eventually(argocdSecret).Should(k8sFixture.ExistByName())

actualClientSecret := argocdSecret.Data["oidc.dex.clientSecret"]

Expect(string(actualClientSecret)).To(Equal(string(tokenFromSASecret)), "Dex Client Secret for OIDC is not valid")
Expect(string(actualClientSecret)).To(Equal(string(tokenFromDexSecret)), "Dex Client Secret for OIDC is not valid")

})

Expand Down
40 changes: 15 additions & 25 deletions test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ package parallel
import (
"context"
"fmt"
"strings"

argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1"
. "github.com/onsi/ginkgo/v2"
Expand Down Expand Up @@ -86,40 +85,31 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {

By("validating that the Dex Client Secret was copied from dex serviceaccount token secret to argocd-secret, by the operator")
Eventually(func() error {
// Get the service account and find its token secret
err := k8sClient.Get(ctx, client.ObjectKeyFromObject(dexServiceAccount), dexServiceAccount)
if err != nil {
return err
}

// Find the token secret from the service account secrets
var tokenSecretName string
for _, secret := range dexServiceAccount.Secrets {
if secret.Name != "" && strings.Contains(secret.Name, "token") {
tokenSecretName = secret.Name
break
}
}
// The operator now creates an Opaque secret with a deterministic name for the Dex token
// (via TokenRequest API) instead of using auto-generated kubernetes.io/service-account-token secrets.
// The secret name follows the pattern: <argocd-name>-<dex-sa-name>-token
dexTokenSecretName := "example-argocd-argocd-dex-server-token" // #nosec G101 -- This is a Kubernetes secret name, not a credential

if tokenSecretName == "" {
return fmt.Errorf("no token secret found for service account %s", dexServiceAccount.Name)
}

// Get the token secret and extract the token
tokenSecret := &corev1.Secret{
// Get the Dex token secret and extract the token
dexTokenSecret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: tokenSecretName,
Name: dexTokenSecretName,
Namespace: namespace.Name,
},
}
err = k8sClient.Get(ctx, client.ObjectKeyFromObject(tokenSecret), tokenSecret)
err := k8sClient.Get(ctx, client.ObjectKeyFromObject(dexTokenSecret), dexTokenSecret)
if err != nil {
return err
}

expectedClientSecret, exists := tokenSecret.Data["token"]
expectedClientSecret, exists := dexTokenSecret.Data["token"]
if !exists {
return fmt.Errorf("token not found in secret %s", tokenSecretName)
return fmt.Errorf("token not found in secret %s", dexTokenSecretName)
}

// Verify the secret also contains an expiry field
if _, exists := dexTokenSecret.Data["expiry"]; !exists {
return fmt.Errorf("expiry not found in secret %s", dexTokenSecretName)
}

// Get the argocd-secret and extract the oidc.dex.clientSecret
Expand Down
Loading