CNF-26150: Fix flaky e2e ConditionMatcher.Matches early-return when Any mode is true

[sebrandon1]

Summary

• Fix ConditionMatcher.Matches() early-return bug that short-circuits in Any mode on the first status mismatch, causing false negatives when iteration order places a non-matching condition before a matching one
• Add regression test reproducing the exact CI failure scenario (static-resources Degraded=False iterated before deployment Degraded=True)
• Guard the early-return with !m.Any so Any mode continues searching for at least one match

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode -- Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Affected PRs

This flaky failure has been causing spurious CI failures on these open PRs:

• CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer #463 -- CNF-26103: Add default case in istiocsr getIssuer to prevent nil-pointer
• CM-1112: Fix cluster-monitoring set as annotation instead of label #437 -- CM-1112: Fix cluster-monitoring set as annotation instead of label
• CM-1040: Extract shared ApplyResource helper and migrate istiocsr to SSA #420 -- CM-1040: Extract shared ApplyResource helper and migrate istiocsr to SSA
• CM-1114: Add health probes and richer status conditions #417 -- CM-1114: Add health probes and richer status conditions

Related PRs

PR	Title	Status
#462	CNF-26102: Fix istiocsr updateCondition error aggregation bug	Open
#461	CNF-26153: Add unit tests across codebase to close coverage gaps	Open
#463	CNF-26103: Add default case in istiocsr getIssuer	Open

Jira

• CNF-26150 -- Fix flaky e2e ConditionMatcher.Matches early-return (To Do)
• Epic: CNF-23509 -- cert-manager-operator Tuning (In Progress)

Test Plan

• CI passes (e2e-operator, e2e-operator-tech-preview)
• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sebrandon1: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Fixes a bug in ConditionMatcher.Matches() where the early-return on status mismatch fires even when Any=true, causing false negatives when a non-matching condition is iterated before a matching one
• Adds a unit test reproducing the exact CI failure scenario (static-resources Degraded=False before deployment Degraded=True)

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode — Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Fix

Guard the early-return with !m.Any so Any mode continues searching instead of short-circuiting on the first mismatch.

Test plan

• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases, 360s)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes instantly (would timeout at 180s without the fix)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The condition matcher now continues evaluation after a status mismatch in match-any mode. An e2e test verifies that a later matching condition succeeds after an earlier mismatch.

Changes

Condition matcher behavior

Layer / File(s)	Summary
Match-any status evaluation test/e2e/condition_matcher_test.go, test/e2e/condition_matcher_unit_test.go	The matcher fails immediately on a status mismatch only in match-all mode. The test verifies a later matching Degraded condition in match-any mode.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: trilokgeer, mytreya-rh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added test uses the static title "Any mode succeeds when matching condition appears after non-matching one"; no dynamic values or Ginkgo titles were added.
Test Structure And Quality	✅ Passed	The added table case targets one behavior, uses a local fake client, and exercises PollUntilContextTimeout with the repository's 3-minute timeout; no cleanup or Ginkgo lifecycle is required.
Microshift Test Compatibility	✅ Passed	The added case is a standard Go table-driven unit test, not a Ginkgo e2e test, and it uses only a fake CertManager client with no MicroShift-incompatible API or feature.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The added case is a table-driven Go unit test using a fake client and operator conditions only; it adds no Ginkgo spec or multi-node/HA assumption.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only e2e condition-matching code and tests; it adds no deployment, controller, operator, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR adds only matcher logic and test data; no added stdout calls, and main.go plus suite setup files are unchanged.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The added case is a Go table-driven unit test using a fake client and in-memory conditions. It adds no Ginkgo test, IPv4 assumption, or external connectivity.
No-Weak-Crypto	✅ Passed	The PR changes only condition matching logic and test data. Added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only two Go test files; the patch adds no Kubernetes/container manifests or privilege-related settings such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilege...
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging. New test data uses fixed synthetic identifiers and statuses, with no passwords, tokens, API keys, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the fix to ConditionMatcher.Matches in Any mode and the resulting flaky e2e behavior.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign bharath-b-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26150 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Fixes a bug in ConditionMatcher.Matches() where the early-return on status mismatch fires even when Any=true, causing false negatives when a non-matching condition is iterated before a matching one
• Adds a unit test reproducing the exact CI failure scenario (static-resources Degraded=False before deployment Degraded=True)

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode — Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Fix

Guard the early-return with !m.Any so Any mode continues searching instead of short-circuiting on the first mismatch.

Test plan

• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases, 360s)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes instantly (would timeout at 180s without the fix)

Summary by CodeRabbit

• Bug Fixes

• Improved condition matching in “Any” mode so a non-matching condition does not prevent later matching conditions from succeeding.

• Tests

• Added coverage confirming that a valid matching condition is recognized even when it follows a non-matching condition.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sebrandon1]

/retest

[openshift-ci]

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator-tech-preview	b6c869a	link	false	/test e2e-operator-tech-preview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.