From c60551e72fcb38f71aa47b01fce3fb008533f12d Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Thu, 4 Jun 2026 11:36:23 +0200 Subject: [PATCH 1/6] testing cert-manager trust-manager deployment with RF Signed-off-by: Evgeny Slutsky --- .../assets/cert-manager/trust-manager-cr.yaml | 6 + test/suites/optional/cert-manager.robot | 260 ++++++++++++++++-- 2 files changed, 242 insertions(+), 24 deletions(-) create mode 100644 test/assets/cert-manager/trust-manager-cr.yaml diff --git a/test/assets/cert-manager/trust-manager-cr.yaml b/test/assets/cert-manager/trust-manager-cr.yaml new file mode 100644 index 0000000000..a439635ba1 --- /dev/null +++ b/test/assets/cert-manager/trust-manager-cr.yaml @@ -0,0 +1,6 @@ +apiVersion: operator.openshift.io/v1alpha1 +kind: TrustManager +metadata: + name: cluster +spec: + trustManagerConfig: {} diff --git a/test/suites/optional/cert-manager.robot b/test/suites/optional/cert-manager.robot index 2109feec75..7a81e4df8c 100644 --- a/test/suites/optional/cert-manager.robot +++ b/test/suites/optional/cert-manager.robot @@ -23,30 +23,36 @@ Test Tags cert-manager certificates tls *** Variables *** -${CERT_NAME} test-certificate -${SECRET_NAME} test-cert-secret -${ISSUER_NAME} test-issuer -${CERT_COMMON_NAME} example.com -${CERT_DNS_NAME} example.com -${ROUTE_NAME} hello-app -${CERT_ISSUER_YAML} SEPARATOR=\n -... --- -... apiVersion: cert-manager.io/v1 -... kind: ClusterIssuer -... metadata: -... \ \ name: ${ISSUER_NAME} -... spec: -... \ \ selfSigned: {} - -${HTTP01_ISSUER_NAME} letsencrypt-http01 -${HTTP01_CERT_NAME} cert-from-${HTTP01_ISSUER_NAME} -${HTTP01_SECRET_NAME} ${HTTP01_CERT_NAME} -${PEBBLE_DEPLOYMENT_FILE} ./assets/cert-manager/pebble-server.yaml -${HOSTSFILE_ENABLED} SEPARATOR=\n -... --- -... dns: -... \ \ hosts: -... \ \ \ \ status: Enabled +${CERT_NAME} test-certificate +${SECRET_NAME} test-cert-secret +${ISSUER_NAME} test-issuer +${CERT_COMMON_NAME} example.com +${CERT_DNS_NAME} example.com +${ROUTE_NAME} hello-app +${CERT_ISSUER_YAML} SEPARATOR=\n +... --- +... apiVersion: cert-manager.io/v1 +... kind: ClusterIssuer +... metadata: +... \ \ name: ${ISSUER_NAME} +... spec: +... \ \ selfSigned: {} + +${HTTP01_ISSUER_NAME} letsencrypt-http01 +${HTTP01_CERT_NAME} cert-from-${HTTP01_ISSUER_NAME} +${HTTP01_SECRET_NAME} ${HTTP01_CERT_NAME} +${PEBBLE_DEPLOYMENT_FILE} ./assets/cert-manager/pebble-server.yaml +${HOSTSFILE_ENABLED} SEPARATOR=\n +... --- +... dns: +... \ \ hosts: +... \ \ \ \ status: Enabled + +${TRUST_MANAGER_BUNDLE_NAME} test-trust-bundle +${TRUST_MANAGER_OPERATOR_NS} cert-manager-operator +${TRUST_MANAGER_NS} cert-manager +${TRUST_MANAGER_DEPLOYMENT} cert-manager-operator-controller-manager +${TRUST_MANAGER_MANIFESTS_DIR} /etc/microshift/manifests.d/trust-manager *** Test Cases *** @@ -95,6 +101,72 @@ Test Cert manager with local acme server ... Cleanup HTTP01 Resources ... AND Cleanup DNS For Test ${dns_name} +Trust Manager Deployment + [Documentation] Verify trust-manager can be enabled and deploys successfully + [Tags] trust-manager + [Setup] Enable Trust Manager + Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} + ${status}= Oc Get JsonPath trustmanager ${EMPTY} cluster + ... .status.conditions[?(@.type=="Ready")].status + Should Be Equal ${status} True msg=TrustManager CR is not ready + [Teardown] Disable Trust Manager + +Trust Manager Bundle Creates ConfigMap + [Documentation] Verify trust-manager Bundle CR syncs a CA cert into a ConfigMap + [Tags] trust-manager + [Setup] Enable Trust Manager + + Create CA Secret For Trust Manager + ${bundle_yaml}= Create Trust Bundle From Source Secret YAML + Apply Trust Manager YAML ${bundle_yaml} + Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME} + ... --for=jsonpath='{.status.conditions[0].reason}'=Synced --timeout=${DEFAULT_WAIT_TIMEOUT} + + ${cm_data}= Oc Get JsonPath + ... configmap + ... ${NAMESPACE} + ... ${TRUST_MANAGER_BUNDLE_NAME} + ... .data.ca-bundle\\.crt + Should Contain ${cm_data} BEGIN CERTIFICATE msg=ConfigMap does not contain CA certificate data + + [Teardown] Run Keywords + ... Cleanup Trust Bundle + ... AND Run With Kubeconfig oc delete secret ca-source-secret -n ${TRUST_MANAGER_NS} --ignore-not-found + ... AND Disable Trust Manager + +Trust Manager Bundle With Cert Manager CA + [Documentation] Verify trust-manager Bundle can use a cert-manager CA secret as a source + [Tags] trust-manager + [Setup] Enable Trust Manager + + ${issuer_yaml}= Create Cert Issuer YAML + Apply Trust Manager YAML ${issuer_yaml} + Oc Wait -n ${NAMESPACE} clusterissuer ${ISSUER_NAME} + ... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT} + + ${ca_cert_yaml}= Create CA Certificate YAML + Apply Trust Manager YAML ${ca_cert_yaml} + Oc Wait -n ${TRUST_MANAGER_NS} certificate ca-certificate + ... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT} + + ${bundle_yaml}= Create Trust Bundle From Secret YAML + Apply Trust Manager YAML ${bundle_yaml} + Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME} + ... --for=jsonpath='{.status.conditions[0].reason}'=Synced --timeout=${DEFAULT_WAIT_TIMEOUT} + + ${cm_data}= Oc Get JsonPath + ... configmap + ... ${NAMESPACE} + ... ${TRUST_MANAGER_BUNDLE_NAME} + ... .data.ca-bundle\\.crt + Should Contain ${cm_data} BEGIN CERTIFICATE msg=ConfigMap does not contain CA certificate data + + [Teardown] Run Keywords + ... Cleanup Trust Bundle + ... AND Oc Delete certificate/ca-certificate -n ${TRUST_MANAGER_NS} + ... AND Remove ClusterIssuer + ... AND Disable Trust Manager + *** Keywords *** Setup @@ -432,3 +504,143 @@ Cleanup DNS For Test Remove Entry From Hosts ${dns_name} Remove Drop In MicroShift Config 20-dns Restart MicroShift + +Enable Trust Manager + [Documentation] Deploy trust-manager by creating a TrustManager CR via manifests.d + ... and restarting MicroShift. The UNSUPPORTED_ADDON_FEATURES=TrustManager=true + ... feature gate is already set in the system cert-manager kustomization. + Create Trust Manager CR Manifests + Restart MicroShift + Wait Until Keyword Succeeds 30x 10s + ... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} + +Disable Trust Manager + [Documentation] Remove the TrustManager CR manifests.d and restart MicroShift. + Run With Kubeconfig oc delete trustmanager cluster --ignore-not-found + Run With Kubeconfig oc delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found + Run With Kubeconfig oc delete deployment trust-manager -n ${TRUST_MANAGER_NS} --ignore-not-found + Remove Trust Manager CR Manifests + Restart MicroShift + Wait Until Keyword Succeeds 12x 10s + ... Trust Manager Pod Should Not Exist + +Trust Manager Pod Should Not Exist + [Documentation] Verify trust-manager pod no longer exists in cert-manager namespace + ${output}= Run With Kubeconfig + ... oc get pods -n ${TRUST_MANAGER_NS} -l app.kubernetes.io/name\=cert-manager-trust-manager --no-headers + ... allow_fail=True + Should Be Empty ${output} msg=trust-manager pod still exists + +Create Trust Manager CR Manifests + [Documentation] Create the manifests.d kustomization with the TrustManager CR + ${stdout} ${stderr} ${rc}= Execute Command + ... mkdir -p ${TRUST_MANAGER_MANIFESTS_DIR} + ... sudo=True return_rc=True return_stdout=True return_stderr=True + Should Be Equal As Integers ${rc} 0 + ${kustomization}= CATENATE SEPARATOR=\n + ... apiVersion: kustomize.config.k8s.io/v1beta1 + ... kind: Kustomization + ... resources: + ... \ \ - trust-manager-cr.yaml + Upload String To File ${kustomization} ${TRUST_MANAGER_MANIFESTS_DIR}/kustomization.yaml + ${tm_cr}= CATENATE SEPARATOR=\n + ... apiVersion: operator.openshift.io/v1alpha1 + ... kind: TrustManager + ... metadata: + ... \ \ name: cluster + ... spec: + ... \ \ trustManagerConfig: {} + Upload String To File ${tm_cr} ${TRUST_MANAGER_MANIFESTS_DIR}/trust-manager-cr.yaml + +Remove Trust Manager CR Manifests + [Documentation] Remove the trust-manager manifests.d directory + ${stdout} ${stderr} ${rc}= Execute Command + ... rm -rf ${TRUST_MANAGER_MANIFESTS_DIR} + ... sudo=True return_rc=True return_stdout=True return_stderr=True + Should Be Equal As Integers ${rc} 0 + +Create CA Secret For Trust Manager + [Documentation] Generate a self-signed CA cert locally and create a secret in the trust namespace + ${cert_file}= Create Random Temp File + ${result}= Process.Run Process + ... openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 + ... -nodes -keyout /dev/null -out ${cert_file} -days 365 + ... -subj /CN\=test-ca.example.com + ... stderr=STDOUT + Should Be Equal As Integers ${result.rc} 0 + Run With Kubeconfig + ... oc create secret generic ca-source-secret -n ${TRUST_MANAGER_NS} --from-file=tls.crt=${cert_file} + Remove File ${cert_file} + +Create Trust Bundle From Source Secret YAML + [Documentation] Creates a Bundle CR YAML sourced from a manually created secret in the trust namespace + ${yaml}= CATENATE SEPARATOR=\n + ... --- + ... apiVersion: trust.cert-manager.io/v1alpha1 + ... kind: Bundle + ... metadata: + ... \ \ name: ${TRUST_MANAGER_BUNDLE_NAME} + ... spec: + ... \ \ sources: + ... \ \ \ \ - secret: + ... \ \ \ \ \ \ \ \ name: ca-source-secret + ... \ \ \ \ \ \ \ \ key: tls.crt + ... \ \ target: + ... \ \ \ \ configMap: + ... \ \ \ \ \ \ key: ca-bundle.crt + ... \ \ \ \ namespaceSelector: + ... \ \ \ \ \ \ matchLabels: + ... \ \ \ \ \ \ \ \ kubernetes.io/metadata.name: ${NAMESPACE} + RETURN ${yaml} + +Create CA Certificate YAML + [Documentation] Creates a cert-manager CA Certificate in the trust namespace + ${yaml}= CATENATE SEPARATOR=\n + ... --- + ... apiVersion: cert-manager.io/v1 + ... kind: Certificate + ... metadata: + ... \ \ name: ca-certificate + ... \ \ namespace: ${TRUST_MANAGER_NS} + ... spec: + ... \ \ isCA: true + ... \ \ commonName: test-ca.example.com + ... \ \ secretName: ca-certificate-secret + ... \ \ issuerRef: + ... \ \ \ \ name: ${ISSUER_NAME} + ... \ \ \ \ kind: ClusterIssuer + RETURN ${yaml} + +Create Trust Bundle From Secret YAML + [Documentation] Creates a Bundle CR YAML sourced from a cert-manager CA secret in the trust namespace + ${yaml}= CATENATE SEPARATOR=\n + ... --- + ... apiVersion: trust.cert-manager.io/v1alpha1 + ... kind: Bundle + ... metadata: + ... \ \ name: ${TRUST_MANAGER_BUNDLE_NAME} + ... spec: + ... \ \ sources: + ... \ \ \ \ - secret: + ... \ \ \ \ \ \ \ \ name: ca-certificate-secret + ... \ \ \ \ \ \ \ \ key: tls.crt + ... \ \ target: + ... \ \ \ \ configMap: + ... \ \ \ \ \ \ key: ca-bundle.crt + ... \ \ \ \ namespaceSelector: + ... \ \ \ \ \ \ matchLabels: + ... \ \ \ \ \ \ \ \ kubernetes.io/metadata.name: ${NAMESPACE} + RETURN ${yaml} + +Apply Trust Manager YAML + [Documentation] Apply YAML manifest, allowing both created and configured/unchanged results + [Arguments] ${yaml_content} + ${temp_file}= Create Random Temp File ${yaml_content} + ${result}= Oc Apply -f ${temp_file} + Remove File ${temp_file} + Log Applied manifest: ${result} + +Cleanup Trust Bundle + [Documentation] Remove the test trust-manager Bundle CR and its target ConfigMap + Run With Kubeconfig oc delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found + Run With Kubeconfig oc delete configmap ${TRUST_MANAGER_BUNDLE_NAME} -n ${NAMESPACE} --ignore-not-found From 42af1a130b5b6b0c9ac9e654b2888c38e89bc28b Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Tue, 9 Jun 2026 17:25:59 +0200 Subject: [PATCH 2/6] update kustomization with RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER image Signed-off-by: Evgeny Slutsky --- .../cert-manager/manager/kustomization.yaml | 10 ++ test/suites/optional/cert-manager.robot | 109 +++++++----------- 2 files changed, 52 insertions(+), 67 deletions(-) diff --git a/assets/optional/cert-manager/manager/kustomization.yaml b/assets/optional/cert-manager/manager/kustomization.yaml index 3689551b81..40df5045ee 100644 --- a/assets/optional/cert-manager/manager/kustomization.yaml +++ b/assets/optional/cert-manager/manager/kustomization.yaml @@ -55,6 +55,16 @@ replacements: name: controller-manager fieldPaths: - spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_ISTIOCSR].value + - source: + kind: ConfigMap + name: cert-manager-images + fieldPath: data.cert-manager-trust-manager + targets: + - select: + kind: Deployment + name: controller-manager + fieldPaths: + - spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER].value - source: kind: ConfigMap name: cert-manager-images diff --git a/test/suites/optional/cert-manager.robot b/test/suites/optional/cert-manager.robot index 7a81e4df8c..7b8a7fc2ac 100644 --- a/test/suites/optional/cert-manager.robot +++ b/test/suites/optional/cert-manager.robot @@ -23,36 +23,35 @@ Test Tags cert-manager certificates tls *** Variables *** -${CERT_NAME} test-certificate -${SECRET_NAME} test-cert-secret -${ISSUER_NAME} test-issuer -${CERT_COMMON_NAME} example.com -${CERT_DNS_NAME} example.com -${ROUTE_NAME} hello-app -${CERT_ISSUER_YAML} SEPARATOR=\n -... --- -... apiVersion: cert-manager.io/v1 -... kind: ClusterIssuer -... metadata: -... \ \ name: ${ISSUER_NAME} -... spec: -... \ \ selfSigned: {} - -${HTTP01_ISSUER_NAME} letsencrypt-http01 -${HTTP01_CERT_NAME} cert-from-${HTTP01_ISSUER_NAME} -${HTTP01_SECRET_NAME} ${HTTP01_CERT_NAME} -${PEBBLE_DEPLOYMENT_FILE} ./assets/cert-manager/pebble-server.yaml -${HOSTSFILE_ENABLED} SEPARATOR=\n -... --- -... dns: -... \ \ hosts: -... \ \ \ \ status: Enabled - -${TRUST_MANAGER_BUNDLE_NAME} test-trust-bundle -${TRUST_MANAGER_OPERATOR_NS} cert-manager-operator -${TRUST_MANAGER_NS} cert-manager -${TRUST_MANAGER_DEPLOYMENT} cert-manager-operator-controller-manager -${TRUST_MANAGER_MANIFESTS_DIR} /etc/microshift/manifests.d/trust-manager +${CERT_NAME} test-certificate +${SECRET_NAME} test-cert-secret +${ISSUER_NAME} test-issuer +${CERT_COMMON_NAME} example.com +${CERT_DNS_NAME} example.com +${ROUTE_NAME} hello-app +${CERT_ISSUER_YAML} SEPARATOR=\n +... --- +... apiVersion: cert-manager.io/v1 +... kind: ClusterIssuer +... metadata: +... \ \ name: ${ISSUER_NAME} +... spec: +... \ \ selfSigned: {} + +${HTTP01_ISSUER_NAME} letsencrypt-http01 +${HTTP01_CERT_NAME} cert-from-${HTTP01_ISSUER_NAME} +${HTTP01_SECRET_NAME} ${HTTP01_CERT_NAME} +${PEBBLE_DEPLOYMENT_FILE} ./assets/cert-manager/pebble-server.yaml +${HOSTSFILE_ENABLED} SEPARATOR=\n +... --- +... dns: +... \ \ hosts: +... \ \ \ \ status: Enabled + +${TRUST_MANAGER_BUNDLE_NAME} test-trust-bundle +${TRUST_MANAGER_OPERATOR_NS} cert-manager-operator +${TRUST_MANAGER_NS} cert-manager +${TRUST_MANAGER_DEPLOYMENT} cert-manager-operator-controller-manager *** Test Cases *** @@ -506,21 +505,25 @@ Cleanup DNS For Test Restart MicroShift Enable Trust Manager - [Documentation] Deploy trust-manager by creating a TrustManager CR via manifests.d - ... and restarting MicroShift. The UNSUPPORTED_ADDON_FEATURES=TrustManager=true - ... feature gate is already set in the system cert-manager kustomization. - Create Trust Manager CR Manifests - Restart MicroShift + [Documentation] Deploy trust-manager by applying the TrustManager CR directly. + ... The UNSUPPORTED_ADDON_FEATURES=TrustManager=true feature gate is already + ... set in the system cert-manager kustomization. + ${tm_cr}= CATENATE SEPARATOR=\n + ... apiVersion: operator.openshift.io/v1alpha1 + ... kind: TrustManager + ... metadata: + ... \ \ name: cluster + ... spec: + ... \ \ trustManagerConfig: {} + Apply Trust Manager YAML ${tm_cr} Wait Until Keyword Succeeds 30x 10s ... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} Disable Trust Manager - [Documentation] Remove the TrustManager CR manifests.d and restart MicroShift. + [Documentation] Remove the TrustManager CR and wait for cleanup. Run With Kubeconfig oc delete trustmanager cluster --ignore-not-found Run With Kubeconfig oc delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found Run With Kubeconfig oc delete deployment trust-manager -n ${TRUST_MANAGER_NS} --ignore-not-found - Remove Trust Manager CR Manifests - Restart MicroShift Wait Until Keyword Succeeds 12x 10s ... Trust Manager Pod Should Not Exist @@ -529,35 +532,7 @@ Trust Manager Pod Should Not Exist ${output}= Run With Kubeconfig ... oc get pods -n ${TRUST_MANAGER_NS} -l app.kubernetes.io/name\=cert-manager-trust-manager --no-headers ... allow_fail=True - Should Be Empty ${output} msg=trust-manager pod still exists - -Create Trust Manager CR Manifests - [Documentation] Create the manifests.d kustomization with the TrustManager CR - ${stdout} ${stderr} ${rc}= Execute Command - ... mkdir -p ${TRUST_MANAGER_MANIFESTS_DIR} - ... sudo=True return_rc=True return_stdout=True return_stderr=True - Should Be Equal As Integers ${rc} 0 - ${kustomization}= CATENATE SEPARATOR=\n - ... apiVersion: kustomize.config.k8s.io/v1beta1 - ... kind: Kustomization - ... resources: - ... \ \ - trust-manager-cr.yaml - Upload String To File ${kustomization} ${TRUST_MANAGER_MANIFESTS_DIR}/kustomization.yaml - ${tm_cr}= CATENATE SEPARATOR=\n - ... apiVersion: operator.openshift.io/v1alpha1 - ... kind: TrustManager - ... metadata: - ... \ \ name: cluster - ... spec: - ... \ \ trustManagerConfig: {} - Upload String To File ${tm_cr} ${TRUST_MANAGER_MANIFESTS_DIR}/trust-manager-cr.yaml - -Remove Trust Manager CR Manifests - [Documentation] Remove the trust-manager manifests.d directory - ${stdout} ${stderr} ${rc}= Execute Command - ... rm -rf ${TRUST_MANAGER_MANIFESTS_DIR} - ... sudo=True return_rc=True return_stdout=True return_stderr=True - Should Be Equal As Integers ${rc} 0 + Should Not Contain ${output} trust-manager msg=trust-manager pod still exists Create CA Secret For Trust Manager [Documentation] Generate a self-signed CA cert locally and create a secret in the trust namespace From 9ec44039fd7149acdea504f28fc65f5c6cf65278 Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Thu, 4 Jun 2026 11:35:50 +0200 Subject: [PATCH 3/6] Enabling trust-manager featuregate by default Signed-off-by: Evgeny Slutsky --- .../cert-manager/manager/kustomization.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/assets/optional/cert-manager/manager/kustomization.yaml b/assets/optional/cert-manager/manager/kustomization.yaml index 40df5045ee..2df3255384 100644 --- a/assets/optional/cert-manager/manager/kustomization.yaml +++ b/assets/optional/cert-manager/manager/kustomization.yaml @@ -4,6 +4,24 @@ resources: - manager.yaml - images.yaml +patches: + - target: + kind: Deployment + name: controller-manager + patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: controller-manager + spec: + template: + spec: + containers: + - name: cert-manager-operator + env: + - name: UNSUPPORTED_ADDON_FEATURES + value: TrustManager=true + replacements: - source: kind: ConfigMap From fb2a85bb58db22fb5000bb00316a81d676984f66 Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Tue, 23 Jun 2026 15:45:38 +0200 Subject: [PATCH 4/6] address review comments Signed-off-by: Evgeny Slutsky --- test/suites/optional/cert-manager.robot | 39 +++++++++++-------------- 1 file changed, 17 insertions(+), 22 deletions(-) diff --git a/test/suites/optional/cert-manager.robot b/test/suites/optional/cert-manager.robot index 7b8a7fc2ac..7c8320ed3f 100644 --- a/test/suites/optional/cert-manager.robot +++ b/test/suites/optional/cert-manager.robot @@ -51,7 +51,7 @@ ${HOSTSFILE_ENABLED} SEPARATOR=\n ${TRUST_MANAGER_BUNDLE_NAME} test-trust-bundle ${TRUST_MANAGER_OPERATOR_NS} cert-manager-operator ${TRUST_MANAGER_NS} cert-manager -${TRUST_MANAGER_DEPLOYMENT} cert-manager-operator-controller-manager +${TRUST_MANAGER_CR_FILE} ./assets/cert-manager/trust-manager-cr.yaml *** Test Cases *** @@ -119,7 +119,7 @@ Trust Manager Bundle Creates ConfigMap ${bundle_yaml}= Create Trust Bundle From Source Secret YAML Apply Trust Manager YAML ${bundle_yaml} Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME} - ... --for=jsonpath='{.status.conditions[0].reason}'=Synced --timeout=${DEFAULT_WAIT_TIMEOUT} + ... --for=jsonpath='{.status.conditions[?(@.type=="Synced")].status}'=True --timeout=${DEFAULT_WAIT_TIMEOUT} ${cm_data}= Oc Get JsonPath ... configmap @@ -130,7 +130,7 @@ Trust Manager Bundle Creates ConfigMap [Teardown] Run Keywords ... Cleanup Trust Bundle - ... AND Run With Kubeconfig oc delete secret ca-source-secret -n ${TRUST_MANAGER_NS} --ignore-not-found + ... AND Oc Delete secret ca-source-secret -n ${TRUST_MANAGER_NS} --ignore-not-found ... AND Disable Trust Manager Trust Manager Bundle With Cert Manager CA @@ -151,7 +151,7 @@ Trust Manager Bundle With Cert Manager CA ${bundle_yaml}= Create Trust Bundle From Secret YAML Apply Trust Manager YAML ${bundle_yaml} Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME} - ... --for=jsonpath='{.status.conditions[0].reason}'=Synced --timeout=${DEFAULT_WAIT_TIMEOUT} + ... --for=jsonpath='{.status.conditions[?(@.type=="Synced")].status}'=True --timeout=${DEFAULT_WAIT_TIMEOUT} ${cm_data}= Oc Get JsonPath ... configmap @@ -508,22 +508,15 @@ Enable Trust Manager [Documentation] Deploy trust-manager by applying the TrustManager CR directly. ... The UNSUPPORTED_ADDON_FEATURES=TrustManager=true feature gate is already ... set in the system cert-manager kustomization. - ${tm_cr}= CATENATE SEPARATOR=\n - ... apiVersion: operator.openshift.io/v1alpha1 - ... kind: TrustManager - ... metadata: - ... \ \ name: cluster - ... spec: - ... \ \ trustManagerConfig: {} - Apply Trust Manager YAML ${tm_cr} + Oc Apply -f ${TRUST_MANAGER_CR_FILE} Wait Until Keyword Succeeds 30x 10s ... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} Disable Trust Manager [Documentation] Remove the TrustManager CR and wait for cleanup. - Run With Kubeconfig oc delete trustmanager cluster --ignore-not-found - Run With Kubeconfig oc delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found - Run With Kubeconfig oc delete deployment trust-manager -n ${TRUST_MANAGER_NS} --ignore-not-found + Oc Delete trustmanager cluster --ignore-not-found + Oc Delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found + Oc Delete deployment trust-manager -n ${TRUST_MANAGER_NS} --ignore-not-found Wait Until Keyword Succeeds 12x 10s ... Trust Manager Pod Should Not Exist @@ -531,8 +524,7 @@ Trust Manager Pod Should Not Exist [Documentation] Verify trust-manager pod no longer exists in cert-manager namespace ${output}= Run With Kubeconfig ... oc get pods -n ${TRUST_MANAGER_NS} -l app.kubernetes.io/name\=cert-manager-trust-manager --no-headers - ... allow_fail=True - Should Not Contain ${output} trust-manager msg=trust-manager pod still exists + Should Be Empty ${output} msg=trust-manager pod still exists Create CA Secret For Trust Manager [Documentation] Generate a self-signed CA cert locally and create a secret in the trust namespace @@ -611,11 +603,14 @@ Apply Trust Manager YAML [Documentation] Apply YAML manifest, allowing both created and configured/unchanged results [Arguments] ${yaml_content} ${temp_file}= Create Random Temp File ${yaml_content} - ${result}= Oc Apply -f ${temp_file} - Remove File ${temp_file} - Log Applied manifest: ${result} + TRY + ${result}= Oc Apply -f ${temp_file} + Log Applied manifest: ${result} + FINALLY + Remove File ${temp_file} + END Cleanup Trust Bundle [Documentation] Remove the test trust-manager Bundle CR and its target ConfigMap - Run With Kubeconfig oc delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found - Run With Kubeconfig oc delete configmap ${TRUST_MANAGER_BUNDLE_NAME} -n ${NAMESPACE} --ignore-not-found + Oc Delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found + Oc Delete configmap ${TRUST_MANAGER_BUNDLE_NAME} -n ${NAMESPACE} --ignore-not-found From 531c8ababa06cd652f147659b5fdcb1b4048bba8 Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Mon, 6 Jul 2026 21:16:58 +0200 Subject: [PATCH 5/6] Fix trust-manager test teardown fighting operator reconciliation The Disable Trust Manager keyword was manually deleting the trust-manager deployment, but the cert-manager operator would immediately recreate it because the TrustManager feature gate is always enabled. This caused all 3 trust-manager tests to fail in teardown with "trust-manager pod still exists" after 12 retries. Remove the explicit deployment deletion and let the operator handle cleanup when the TrustManager CR is deleted. Increase the retry count from 12 to 30 to give the operator sufficient time to reconcile. Co-Authored-By: Claude Opus 4.6 --- test/suites/optional/cert-manager.robot | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/test/suites/optional/cert-manager.robot b/test/suites/optional/cert-manager.robot index 7c8320ed3f..5ca85503f1 100644 --- a/test/suites/optional/cert-manager.robot +++ b/test/suites/optional/cert-manager.robot @@ -513,11 +513,12 @@ Enable Trust Manager ... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} Disable Trust Manager - [Documentation] Remove the TrustManager CR and wait for cleanup. + [Documentation] Remove the TrustManager CR and let the operator clean up the deployment. + ... Do not delete the deployment directly — the operator would recreate it + ... because the TrustManager feature gate is always enabled. Oc Delete trustmanager cluster --ignore-not-found Oc Delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found - Oc Delete deployment trust-manager -n ${TRUST_MANAGER_NS} --ignore-not-found - Wait Until Keyword Succeeds 12x 10s + Wait Until Keyword Succeeds 30x 10s ... Trust Manager Pod Should Not Exist Trust Manager Pod Should Not Exist From ba93ece78d55f873815fed877cd74c26910bab0b Mon Sep 17 00:00:00 2001 From: Evgeny Slutsky Date: Tue, 7 Jul 2026 13:46:18 +0200 Subject: [PATCH 6/6] Stop asserting trust-manager pod absence in teardown The cert-manager operator keeps the trust-manager deployment running as long as UNSUPPORTED_ADDON_FEATURES=TrustManager=true is set in the operator deployment, regardless of whether the TrustManager CR exists. Deleting the CR alone does not cause the operator to remove the deployment, so waiting for the pod to disappear times out every time. The teardown now only cleans up the CR and Bundle resources. The Enable Trust Manager setup is idempotent (oc apply) and handles a pod that is already running. Co-Authored-By: Claude Opus 4.6 --- test/suites/optional/cert-manager.robot | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/test/suites/optional/cert-manager.robot b/test/suites/optional/cert-manager.robot index 5ca85503f1..6904849df0 100644 --- a/test/suites/optional/cert-manager.robot +++ b/test/suites/optional/cert-manager.robot @@ -513,19 +513,11 @@ Enable Trust Manager ... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS} Disable Trust Manager - [Documentation] Remove the TrustManager CR and let the operator clean up the deployment. - ... Do not delete the deployment directly — the operator would recreate it - ... because the TrustManager feature gate is always enabled. + [Documentation] Remove the TrustManager CR and leftover Bundle. + ... The operator keeps the trust-manager deployment running while the + ... TrustManager feature gate is enabled, so we do not assert pod absence. Oc Delete trustmanager cluster --ignore-not-found Oc Delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found - Wait Until Keyword Succeeds 30x 10s - ... Trust Manager Pod Should Not Exist - -Trust Manager Pod Should Not Exist - [Documentation] Verify trust-manager pod no longer exists in cert-manager namespace - ${output}= Run With Kubeconfig - ... oc get pods -n ${TRUST_MANAGER_NS} -l app.kubernetes.io/name\=cert-manager-trust-manager --no-headers - Should Be Empty ${output} msg=trust-manager pod still exists Create CA Secret For Trust Manager [Documentation] Generate a self-signed CA cert locally and create a secret in the trust namespace