Skip to content

WIP: UPSTREAM: 141218: test: create snapshot metadata resources in PrepareTest when CapSnapshotMetadata is enabled - #2739

Open
RomanBednar wants to merge 2 commits into
openshift:masterfrom
RomanBednar:fix-csi-snapshot-metadata-openshift
Open

WIP: UPSTREAM: 141218: test: create snapshot metadata resources in PrepareTest when CapSnapshotMetadata is enabled#2739
RomanBednar wants to merge 2 commits into
openshift:masterfrom
RomanBednar:fix-csi-snapshot-metadata-openshift

Conversation

@RomanBednar

@RomanBednar RomanBednar commented Aug 10, 2026

Copy link
Copy Markdown

Summary

Cherry-pick of upstream PR kubernetes#141218

When CSI_PROW_ENABLE_SNAPSHOT_METADATA=true, PrepareTest() deploys the csi-hostpath
StatefulSet with the csi-snapshot-metadata sidecar that mounts a TLS secret volume.
Previously, the secret, Service, and SnapshotMetadataService CR were only created in
the snapshot metadata test suite's BeforeEach. Non-snapshot-metadata tests never
created these resources, causing FailedMount errors on the secret volume.

This moves resource creation into PrepareTest() so all tests that deploy the sidecar
also have the backing resources. Cleanup is handled via DeferCleanup.

Why this is needed downstream

OpenShift CI runs the full CSI suite with snapshot metadata enabled, unlike upstream
which isolates snapshot metadata tests with FOCUS=[Feature:snapshotmetadata]. The
bug causes every non-snapshot-metadata CSI hostpath test to fail with:

FailedMount: MountVolume.SetUp failed for volume "csi-snapshot-metadata-server-certs":
secret "csi-snapshot-metadata-server-certs" not found

Changes

  • test/e2e/storage/drivers/csi.go: Call CreateSnapshotMetadataResources in PrepareTest() when CapSnapshotMetadata is enabled, with DeferCleanup for teardown
  • test/e2e/storage/testsuites/snapshot-metadata.go: Remove duplicate resource creation and cleanup from the snapshot metadata test suite (now handled by PrepareTest)

/cc @dobsonj

Summary by CodeRabbit

  • Tests
    • Improved storage end-to-end test coverage for drivers supporting snapshot metadata.
    • Snapshot metadata resources are now created automatically during test preparation.
    • Added deferred cleanup to help prevent leftover test resources after test execution.
    • Resource creation failures now fail tests clearly, while cleanup issues are logged for troubleshooting.
    • Simplified test teardown by centralizing snapshot metadata resource management across applicable test scenarios.

@openshift-ci-robot openshift-ci-robot added the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Aug 10, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@RomanBednar: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@openshift-ci
openshift-ci Bot requested a review from dobsonj August 10, 2026 13:58
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 07a9e165-8a24-44bd-814e-122b630eacdd

📥 Commits

Reviewing files that changed from the base of the PR and between 0caf91a and 1061046.

📒 Files selected for processing (1)
  • test/e2e/storage/drivers/csi.go

Walkthrough

The CSI driver setup now creates snapshot metadata resources when supported and defers cleanup. The snapshot metadata test suite removes its duplicate cleanup logic.

Changes

Snapshot metadata lifecycle

Layer / File(s) Summary
Driver-owned metadata lifecycle
test/e2e/storage/drivers/csi.go, test/e2e/storage/testsuites/snapshot-metadata.go
PrepareTest creates and defers cleanup for supported snapshot metadata resources. Creation failures fail the test, and cleanup failures produce warnings. The test suite no longer manages these resources.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dobsonj

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR adds no It/Describe/Context/When titles. Existing snapshot metadata titles are static; added ginkgo.By labels are also static and are not test titles.
Test Structure And Quality ✅ Passed The change uses the capability guard, context-bound API calls, a diagnostic failure message, and DeferCleanup; the TestDriver contract explicitly specifies cleanup in PrepareTest.
Microshift Test Compatibility ✅ Passed The patch adds snapshot-metadata setup and cleanup only. It adds no Ginkgo test declarations and no MicroShift-incompatible OpenShift API usage.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The patch adds no Ginkgo tests or multi-node assumptions; it only moves snapshot metadata resource setup and cleanup between existing CSI code paths.
Topology-Aware Scheduling Compatibility ✅ Passed The diff only creates a Secret, Service, and CR and registers cleanup; it adds no affinity, topology spread, replica, node selector, toleration, or PDB constraints, and the hostpath manifest is unc...
Ote Binary Stdout Contract ✅ Passed The diff adds no direct stdout writes; PrepareTest runs from Ginkgo test callbacks, and framework.Logf writes to GinkgoWriter.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The patch adds no new Ginkgo test declarations. It only moves snapshot metadata resource setup and cleanup, with no added IPv4 literals or external connectivity.
No-Weak-Crypto ✅ Passed The commit adds only snapshot metadata resource creation and cleanup; it introduces no weak algorithms, crypto implementation, or secret/token comparison. The existing helper uses RSA-4096 and cryp...
Container-Privileges ✅ Passed The PR adds no privilege-related manifest fields. It creates only a Secret, Service, and CR; existing privileged CSI manifest entries are unchanged.
No-Sensitive-Data-In-Logs ✅ Passed Added logs contain fixed resource labels and operation errors; generated private keys, certificates, and secret data are never passed to logging calls.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: creating snapshot metadata resources in PrepareTest when CapSnapshotMetadata is enabled.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: RomanBednar
Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/storage/drivers/csi.go`:
- Around line 388-390: Capture the return value of
utils.CleanupSnapshotMetadataResources in a scoped error variable within the
cleanup flow, then check that cleanup error when deciding whether to call
framework.Logf. Do not reuse the earlier setup err from resource creation, and
ensure the cleanup function’s error return is handled rather than ignored.
- Around line 382-383: Remove the duplicate
utils.CreateSnapshotMetadataResources call from snapshotMetadataTestSuite.init
because PrepareTest already owns creation of the TLS Secret, Service, and
SnapshotMetadataService. Update CleanupSnapshotMetadataResources to return
deletion errors, then have the deferred cleanup callback capture and handle that
returned error rather than checking the earlier setup error.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f6ef5468-65a5-4d7e-be41-e02a10b5d5fa

📥 Commits

Reviewing files that changed from the base of the PR and between e63ab41 and 7f22945.

📒 Files selected for processing (2)
  • test/e2e/storage/drivers/csi.go
  • test/e2e/storage/testsuites/snapshot-metadata.go
💤 Files with no reviewable changes (1)
  • test/e2e/storage/testsuites/snapshot-metadata.go

Comment on lines +382 to +383
err = utils.CreateSnapshotMetadataResources(ctx, f, config.Driver.GetDriverInfo().Name, driverns)
if err != nil {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

if rg -n '\bCreateSnapshotMetadataResources\s*\(' \
  test/e2e/storage/testsuites/snapshot-metadata.go; then
  echo "duplicate snapshot metadata resource creation remains"
  exit 1
fi

rg -n -C 3 '\bCreateSnapshotMetadataResources\s*\(' \
  test/e2e/storage/drivers/csi.go \
  test/e2e/storage/utils/snapshot-metadata.go

Repository: openshift/kubernetes

Length of output: 342


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- snapshot metadata suite ---'
sed -n '270,335p' test/e2e/storage/testsuites/snapshot-metadata.go

printf '%s\n' '--- CSI driver setup and cleanup ---'
sed -n '350,410p' test/e2e/storage/drivers/csi.go

printf '%s\n' '--- resource helper ---'
sed -n '1,220p' test/e2e/storage/utils/snapshot-metadata.go

printf '%s\n' '--- all relevant call sites and cleanup references ---'
rg -n -C 4 '\b(CreateSnapshotMetadataResources|DeleteSnapshotMetadataResources|snapshotMetadataTestSuite\.init|PrepareTest)\b' \
  test/e2e/storage

Repository: openshift/kubernetes

Length of output: 50376


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- helper implementation ---'
sed -n '219,305p' test/e2e/storage/utils/snapshot-metadata.go

printf '%s\n' '--- PrepareTest declaration and resource setup ---'
sed -n '240,270p' test/e2e/storage/drivers/csi.go
sed -n '370,402p' test/e2e/storage/drivers/csi.go

printf '%s\n' '--- exact call-site counts ---'
rg -n '\bCreateSnapshotMetadataResources\s*\(' \
  test/e2e/storage/drivers/csi.go \
  test/e2e/storage/testsuites/snapshot-metadata.go \
  test/e2e/storage/utils/snapshot-metadata.go

printf '%s\n' '--- cleanup function declarations and calls ---'
rg -n -C 5 '\bCleanupSnapshotMetadataResources\b' \
  test/e2e/storage/utils/snapshot-metadata.go \
  test/e2e/storage/drivers/csi.go

Repository: openshift/kubernetes

Length of output: 7211


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

suite = Path("test/e2e/storage/testsuites/snapshot-metadata.go").read_text()
driver = Path("test/e2e/storage/drivers/csi.go").read_text()
helper = Path("test/e2e/storage/utils/snapshot-metadata.go").read_text()

suite_calls = re.findall(r"\b(?:storageutils\.)?CreateSnapshotMetadataResources\s*\(", suite)
driver_calls = re.findall(r"\butils\.CreateSnapshotMetadataResources\s*\(", driver)
helper_creates = [
    name for name in ("createTLSSecret", "createSnapshotMetadataSVC", "createSnapshotMetdataServiceCR")
    if re.search(r"\b" + name + r"\s*\(", helper)
]

cleanup_block = re.search(
    r"ginkgo\.DeferCleanup\(func\(ctx context\.Context\) \{(?P<body>.*?)\n\t\t\}\)",
    driver,
    re.S,
)
body = cleanup_block.group("body") if cleanup_block else ""
print({
    "suite_create_call_count": len(suite_calls),
    "prepare_test_create_call_count": len(driver_calls),
    "resources_created_by_helper": helper_creates,
    "cleanup_result_assigned": bool(re.search(
        r"\b(?:cleanupErr|err)\s*=\s*utils\.CleanupSnapshotMetadataResources\s*\(",
        body,
    )),
    "cleanup_condition_uses_setup_err": "if err != nil" in body,
})
PY

Repository: openshift/kubernetes

Length of output: 417


Keep snapshot metadata resource creation in one owner.

PrepareTest creates the TLS Secret, Service, and SnapshotMetadataService. Remove the duplicate call from snapshotMetadataTestSuite.init.

Make CleanupSnapshotMetadataResources return deletion errors. Capture and handle that result in the deferred cleanup callback instead of checking the earlier setup error.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/storage/drivers/csi.go` around lines 382 - 383, Remove the duplicate
utils.CreateSnapshotMetadataResources call from snapshotMetadataTestSuite.init
because PrepareTest already owns creation of the TLS Secret, Service, and
SnapshotMetadataService. Update CleanupSnapshotMetadataResources to return
deletion errors, then have the deferred cleanup callback capture and handle that
returned error rather than checking the earlier setup error.

Comment thread test/e2e/storage/drivers/csi.go Outdated
@RomanBednar RomanBednar changed the title UPSTREAM: 141218: e2e: create snapshot metadata resources in PrepareTest WIP: UPSTREAM: 141218: e2e: create snapshot metadata resources in PrepareTest Aug 11, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 11, 2026
When CSI_PROW_ENABLE_SNAPSHOT_METADATA is true, PrepareTest deploys
the csi-hostpath StatefulSet with the csi-snapshot-metadata sidecar
that mounts a TLS secret volume. Previously, the secret, Service,
and SnapshotMetadataService CR were only created in the snapshot
metadata test suite's BeforeEach. Non-snapshot-metadata tests never
created these resources, causing FailedMount errors on the secret
volume.

Move resource creation to PrepareTest so all tests that deploy the
sidecar also have the backing resources. This fixes mixed test
suites (e.g. OpenShift CI) that run snapshot-metadata and
non-snapshot-metadata tests together. Upstream CI didn't catch this
because it runs snapshot metadata tests in isolation with
FOCUS=[Feature:snapshotmetadata].
@RomanBednar
RomanBednar force-pushed the fix-csi-snapshot-metadata-openshift branch from 7f22945 to 0caf91a Compare August 11, 2026 08:32
@openshift-ci-robot

Copy link
Copy Markdown

@RomanBednar: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@RomanBednar RomanBednar changed the title WIP: UPSTREAM: 141218: e2e: create snapshot metadata resources in PrepareTest WIP: UPSTREAM: 141218: test: create snapshot metadata resources in PrepareTest when CapSnapshotMetadata is enabled Aug 11, 2026
@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown

@RomanBednar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-crun 0caf91a link true /test e2e-aws-ovn-crun

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci-robot

Copy link
Copy Markdown

@RomanBednar: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Caution

CodeRabbit couldn't update its existing comment. The review summary may be out of date.

Error details
putComment timed out

@RomanBednar

Copy link
Copy Markdown
Author

/payload-job-with-prs periodic-ci-openshift-origin-main-e2e-aws-ovn-techpreview openshift/release#81061

@openshift-ci

openshift-ci Bot commented Aug 13, 2026

Copy link
Copy Markdown

@RomanBednar: trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants