WIP: CNTRLPLANE-3789: Add e2e tests for component-scoped proxy

cmd/cluster-authentication-operator-tests-ext/main.go

@@ -13,6 +13,7 @@ import (
 	"github.com/openshift/cluster-authentication-operator/pkg/version"
 
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e"
+	_ "github.com/openshift/cluster-authentication-operator/test/e2e-component-proxy"
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption"
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption-kms"
 	_ "github.com/openshift/cluster-authentication-operator/test/e2e-encryption-perf"
@@ -81,7 +82,18 @@ func prepareOperatorTestsRegistry() (*oteextension.Registry, error) {
 		Name:        "openshift/cluster-authentication-operator/operator/serial",
 		Parallelism: 1,
 		Qualifiers: []string{
-			`name.contains("[Serial]") && (name.contains("[Operator]") || name.contains("[OIDC]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
+			`name.contains("[Serial]") && !name.contains("[ComponentProxy]") && (name.contains("[Operator]") || name.contains("[OIDC]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
+		},
+	})
+
+	// ClusterStability set to Disruptive: component-proxy tests intentionally
+	// degrade the authentication operator to validate error handling.
+	extension.AddSuite(oteextension.Suite{
+		Name:             "openshift/cluster-authentication-operator/component-proxy/disruptive",
+		Parallelism:      1,
+		ClusterStability: oteextension.ClusterStabilityDisruptive,
+		Qualifiers: []string{
+			`name.contains("[ComponentProxy]")`,
 		},
 	})
 

pkg/controllers/configobservation/oauth/observe_proxy_trusted_ca_test.go

@@ -9,7 +9,6 @@ import (
 
 	"golang.org/x/net/http/httpproxy"
 
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	clocktesting "k8s.io/utils/clock/testing"
 
 	"github.com/openshift/library-go/pkg/operator/events"
@@ -91,7 +90,7 @@ func TestObserveComponentProxyTrustedCA(t *testing.T) {
 			existingConfig: map[string]interface{}{
 				"oauthConfig": "not-a-map",
 			},
-			expected:            map[string]interface{}{"oauthConfig": "not-a-map"},
+			expected:            map[string]interface{}{},
 			expectErrorContains: "accessor error",
 		},
 	}
@@ -113,9 +112,7 @@ func TestObserveComponentProxyTrustedCA(t *testing.T) {
 				require.Empty(t, errs)
 			}
 
-			observedValue, _, _ := unstructured.NestedString(observed, "oauthConfig", "proxyTrustedCA")
-			expectedValue, _, _ := unstructured.NestedString(tt.expected, "oauthConfig", "proxyTrustedCA")
-			require.Equal(t, expectedValue, observedValue)
+			require.Equal(t, tt.expected, observed)
 
 			recordedEvents := recorder.Events()
 			if tt.expectEvent {

pkg/controllers/proxyconfig/proxyconfig_controller.go

@@ -134,6 +134,7 @@ func (p *proxyConfigChecker) validateIdPConnectivity(ctx context.Context, record
 
 	idpURLs := extractIdPURLs(oauthConfig)
 	if len(idpURLs) == 0 {
+		p.lastIdPValidationHash = ""
 		return
 	}
 

pkg/controllers/proxyconfig/proxyconfig_controller_test.go

@@ -350,6 +350,41 @@ func Test_validateIdPConnectivity_hashDedup(t *testing.T) {
 		}
 	})
 
+	t.Run("removing all IdPs clears hash so re-adding triggers validation", func(t *testing.T) {
+		recorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		p := &proxyConfigChecker{
+			oauthLister: configv1listers.NewOAuthLister(indexer),
+		}
+
+		reachable := &http.Client{Transport: &workingHTTPRoundTripper{}}
+		p.validateIdPConnectivity(context.Background(), recorder, reachable, "http://proxy:3128", "", "")
+		if p.lastIdPValidationHash == "" {
+			t.Fatal("hash should be set after successful validation")
+		}
+
+		noIdPConfig := &configv1.OAuth{
+			ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
+			Spec:       configv1.OAuthSpec{},
+		}
+		noIdPIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
+		if err := noIdPIndexer.Add(noIdPConfig); err != nil {
+			t.Fatal(err)
+		}
+		p.oauthLister = configv1listers.NewOAuthLister(noIdPIndexer)
+		p.validateIdPConnectivity(context.Background(), recorder, reachable, "http://proxy:3128", "", "")
+		if p.lastIdPValidationHash != "" {
+			t.Fatal("hash should be cleared when no IdPs are configured")
+		}
+
+		p.oauthLister = configv1listers.NewOAuthLister(indexer)
+		unreachable := &http.Client{Transport: &faultyHTTPRoundTripper{}}
+		followupRecorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		p.validateIdPConnectivity(context.Background(), followupRecorder, unreachable, "http://proxy:3128", "", "")
+		if len(followupRecorder.Events()) != 1 {
+			t.Fatalf("expected validation to run after IdPs re-added, got %d events", len(followupRecorder.Events()))
+		}
+	})
+
 	t.Run("hash not saved on failure allows retry", func(t *testing.T) {
 		recorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
 		p := &proxyConfigChecker{