Skip to content

CNF-26102: Fix istiocsr updateCondition error aggregation bug - #462

Open
sebrandon1 wants to merge 1 commit into
openshift:masterfrom
sebrandon1:fix/istiocsr-update-condition-bug
Open

CNF-26102: Fix istiocsr updateCondition error aggregation bug#462
sebrandon1 wants to merge 1 commit into
openshift:masterfrom
sebrandon1:fix/istiocsr-update-condition-bug

Conversation

@sebrandon1

@sebrandon1 sebrandon1 commented Jul 23, 2026

Copy link
Copy Markdown
Member

Summary

  • Fixes a bug where updateCondition in pkg/controller/istiocsr/utils.go:484 aggregated {err, errUpdate} instead of {prependErr, errUpdate}, silently dropping the original reconcile error when both the reconciliation and status update fail simultaneously
  • The trustmanager version of the same function (pkg/controller/trustmanager/utils.go:134) correctly uses prependErr; this aligns the istiocsr implementation to match
  • Adds table-driven tests covering all four branches of updateCondition (nil/non-nil prependErr x success/failure status update)

Related PRs

PR Title Status
#461 CNF-26153: Add unit tests across codebase to close coverage gaps Open
#464 CNF-26150: Fix flaky e2e ConditionMatcher.Matches early-return Open

Jira

  • CNF-26102 -- Fix istiocsr updateCondition error aggregation bug (To Do)
  • Epic: CNF-23509 -- cert-manager-operator Tuning (In Progress)

Test Plan

  • Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 -- 117 passed)
  • make lint clean
  • CI passes

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 23, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 23, 2026

Copy link
Copy Markdown

@sebrandon1: This pull request references CNF-26102 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Fixes a bug where updateCondition in istiocsr utils.go:484 aggregated {err, errUpdate} instead of {prependErr, errUpdate}, silently dropping the original reconcile error when both the reconciliation and status update fail
  • The trustmanager version of the same function correctly uses prependErr
  • One-line fix: err to prependErr

Test plan

  • Existing unit tests pass (go test ./pkg/controller/istiocsr/... -count=1 — 117 passed)
  • make lint clean
  • CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

updateCondition now combines prependErr with the status-update error. Table-driven tests cover successful updates and error propagation.

Changes

updateCondition error handling

Layer / File(s) Summary
Error aggregation and validation
pkg/controller/istiocsr/utils.go, pkg/controller/istiocsr/utils_test.go
updateCondition combines prependErr with errUpdate. Tests cover successful updates, propagated reconcile errors, status-update failures, and combined errors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested reviewers: swghosh, trilokgeer

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The added tests use standard Go t.Run with four static literal names; no Ginkgo titles or dynamic pod, namespace, node, timestamp, UUID, or IP values occur.
Test Structure And Quality ✅ Passed TestUpdateCondition uses standard table-driven testing, not Ginkgo; each subtest covers one branch, uses only a fake client, has no waits or persistent resources, and reports assertion context.
Microshift Test Compatibility ✅ Passed The PR adds a standard Go TestUpdateCondition unit test, not a Ginkgo e2e test; it references no MicroShift-incompatible OpenShift APIs or assumptions.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR adds a standard Go unit test, TestUpdateCondition, not a Ginkgo e2e test. It has no multi-node assumptions or SNO guard requirements.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only updateCondition error aggregation and unit tests; no deployment manifest or scheduling constraints are added or modified.
Ote Binary Stdout Contract ✅ Passed The PR delta adds only TestUpdateCondition and related imports; it adds no main/suite setup code or stdout writes, and existing suite logging targets GinkgoWriter.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR adds a standard Go TestUpdateCondition unit test, not a Ginkgo e2e test, and it performs no IP parsing or external network access.
No-Weak-Crypto ✅ Passed The PR changes only error aggregation and unit-test setup; changed files contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison code.
Container-Privileges ✅ Passed The PR changes only Go source and tests. No container or Kubernetes manifest changes or added privilege indicators were found.
No-Sensitive-Data-In-Logs ✅ Passed The patch adds only unit-test code and static error strings; it adds no logging calls and contains no passwords, tokens, API keys, PII, or customer data.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the istiocsr function and the error aggregation bug that the pull request fixes.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from TrilokGeer and swghosh July 23, 2026 21:45
@openshift-ci

openshift-ci Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign mytreya-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sebrandon1
sebrandon1 force-pushed the fix/istiocsr-update-condition-bug branch from 874b029 to 45ba1c0 Compare July 24, 2026 02:31
@sebrandon1
sebrandon1 force-pushed the fix/istiocsr-update-condition-bug branch 2 times, most recently from b2f16d3 to 95cc6a2 Compare August 4, 2026 18:07

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pkg/controller/istiocsr/utils_test.go (1)

576-589: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Simulate the status-write failure in the status-error cases.

Lines 576-579 return a Get error. updateCondition therefore does not reach CtrlClient.StatusUpdate in these cases. Configure a successful GetCalls stub and pass an error to StatusUpdateReturns when tt.statusErr is true. This verifies the actual status-write failure path and its error aggregation.

Proposed test setup
-			if tt.statusErr {
-				fakeClient.GetCalls(func(_ context.Context, _ types.NamespacedName, obj client.Object) error {
-					return fmt.Errorf("simulated get error")
-				})
-			} else {
-				fakeClient.GetCalls(func(_ context.Context, _ types.NamespacedName, obj client.Object) error {
-					switch o := obj.(type) {
-					case *v1alpha1.IstioCSR:
-						testIstioCSR().DeepCopyInto(o)
-					}
-					return nil
-				})
-				fakeClient.StatusUpdateReturns(nil)
-			}
+			fakeClient.GetCalls(func(_ context.Context, _ types.NamespacedName, obj client.Object) error {
+				switch o := obj.(type) {
+				case *v1alpha1.IstioCSR:
+					testIstioCSR().DeepCopyInto(o)
+				}
+				return nil
+			})
+			if tt.statusErr {
+				fakeClient.StatusUpdateReturns(fmt.Errorf("simulated status update error"))
+			} else {
+				fakeClient.StatusUpdateReturns(nil)
+			}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/istiocsr/utils_test.go` around lines 576 - 589, Update the
test setup around the tt.statusErr branch so fakeClient.GetCalls always returns
a valid IstioCSR, then configure fakeClient.StatusUpdateReturns with an error
when tt.statusErr is true and nil otherwise. Preserve the existing successful
GetCalls behavior and ensure the test exercises the status-write failure and
error aggregation path in updateCondition.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/controller/istiocsr/utils_test.go`:
- Around line 576-589: Update the test setup around the tt.statusErr branch so
fakeClient.GetCalls always returns a valid IstioCSR, then configure
fakeClient.StatusUpdateReturns with an error when tt.statusErr is true and nil
otherwise. Preserve the existing successful GetCalls behavior and ensure the
test exercises the status-write failure and error aggregation path in
updateCondition.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 62437282-b49a-4ae4-b03c-82d5dd959580

📥 Commits

Reviewing files that changed from the base of the PR and between 95cc6a2 and 1b7838f.

📒 Files selected for processing (1)
  • pkg/controller/istiocsr/utils_test.go

The updateCondition method was passing the status-update error instead
of the original prependErr into the aggregate, silently dropping the
caller's error. Includes table-driven tests covering all four branches.
@sebrandon1

Copy link
Copy Markdown
Member Author

/retest

@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-operator 922b9c5 link true /test e2e-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants