test(e2e): add orchestrator RBAC e2e tests #4009

chadcrum · 2026-01-15T19:58:31Z

Summary

Add comprehensive RBAC e2e tests for the Orchestrator plugin covering workflow and instance access control.

Changes

New: `orchestrator-rbac.spec.ts` (28 tests)

Global workflow permissions - read-write, read-only, and denied access
Individual workflow permissions - workflow-specific access controls
Instance access isolation - users see only their own workflow instances
Admin override - instanceAdminView grants access to all instances

Modified: `rbac.spec.ts`

Re-enabled RBAC API validation test (previously test.fixme)
Added filtering for dynamically created workflow roles to prevent test interference

Modified: `orchestrator.ts` (support page)

Added timeout parameters for RBAC permission propagation delay

Permissions Tested

Permission	Description
`orchestrator.workflow`	View all workflows
`orchestrator.workflow.use`	Execute all workflows
`orchestrator.workflow.<id>`	View specific workflow
`orchestrator.workflow.use.<id>`	Execute specific workflow
`orchestrator.instanceAdminView`	View all workflow instances (admin)

Testing

Validated on OCP Helm nightly jobs (28/28 tests passing)
Validated on OCP Operator nightly jobs
Tests skip appropriately on OSD-GCP and GKE (orchestrator not deployed)

Note

#4140 fixes the pre-existing flaky rbac tests, so there should be no issue re-enabling them.

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

chadcrum · 2026-01-15T20:01:52Z

/ok-to-test

chadcrum · 2026-01-15T20:04:18Z

/test e2e-ocp-helm

github-actions · 2026-01-15T20:40:52Z

The image is available at:

/test e2e-ocp-helm

chadcrum · 2026-01-15T23:27:11Z

/test e2e-ocp-operator-nightly

chadcrum · 2026-01-15T23:42:05Z

/test e2e-ocp-operator-nightly

chadcrum · 2026-01-16T00:03:28Z

/retest-required

github-actions · 2026-01-16T00:17:47Z

The image is available at:

/test e2e-ocp-helm

github-actions · 2026-01-23T02:14:21Z

This PR is stale because it has been open 7 days with no activity. Remove stale label or comment or this will be closed in 21 days.

chadcrum · 2026-01-30T01:14:02Z

/test e2e-ocp-helm-nightly

qodo-code-review · 2026-01-30T01:14:06Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

rhdh-qodo-merge · 2026-01-30T01:14:06Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

github-actions · 2026-01-30T01:47:05Z

The image is available at:

chadcrum · 2026-01-31T00:19:09Z

/test e2e-ocp-helm-nightly

rhdh-qodo-merge · 2026-01-31T00:19:12Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

github-actions · 2026-01-31T00:58:50Z

The image is available at:

chadcrum · 2026-01-31T01:36:48Z

/test e2e-ocp-helm-nightly

rhdh-qodo-merge · 2026-01-31T01:36:52Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

github-actions · 2026-01-31T02:19:19Z

The image is available at:

chadcrum · 2026-01-31T02:54:23Z

/test e2e-ocp-helm-nightly

rhdh-qodo-merge · 2026-01-31T02:54:27Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

github-actions · 2026-01-31T03:35:56Z

The image is available at:

chadcrum · 2026-01-31T05:08:59Z

/test e2e-ocp-helm-nightly

rhdh-qodo-merge · 2026-01-31T05:09:02Z

ⓘ Your monthly quota for Qodo has expired. Upgrade your plan

ⓘ Paying users. Check that your Qodo account is linked with this Git user account

github-actions · 2026-01-31T21:53:45Z

🚫 Image Push Skipped.

The container image push was skipped because the build was skipped (either due to [skip-build] tag or no relevant changes with existing image)

github-actions · 2026-02-01T20:40:17Z

🚫 Image Push Skipped.

The container image push was skipped because the build was skipped (either due to [skip-build] tag or no relevant changes with existing image)

chadcrum · 2026-02-01T20:47:47Z

@gustavolira this is has been tested against helm and operator nightly jobs and the rbac tests succeed consistently.

Ready for review / merge

github-actions · 2026-02-03T01:28:45Z

The image is available at:

github-actions · 2026-02-03T16:19:11Z

The image is available at:

gustavolira · 2026-02-03T21:42:40Z

/lgtm

chadcrum · 2026-02-03T23:27:56Z

/retest

chadcrum · 2026-02-04T00:22:51Z

/retest

chadcrum · 2026-02-04T00:54:03Z

/retest

Add comprehensive RBAC end-to-end tests for the Orchestrator plugin covering workflow and instance access control: ## New Test File: orchestrator-rbac.spec.ts (28 tests) ### Global Workflow Permissions (9 tests) - Read-write access: users can view and execute all workflows - Read-only access: users can view but not execute workflows - Denied access: users cannot see any workflows ### Individual Workflow Permissions (9 tests) - Workflow-specific read-write: access only to specific workflow - Workflow-specific read-only: view only specific workflow - Workflow-specific denied: hide specific workflow ### Workflow Instance Access (10 tests) - Initiator-based access: users can only see their own instances - Admin override: instanceAdminView grants access to all instances - Cross-user isolation verification ## Changes to Existing Files ### rbac.spec.ts - Re-enable RBAC API validation test (previously test.fixme) - Add filtering for dynamically created workflow roles/policies - Prevents test interference during parallel execution ### orchestrator.ts (support page) - Add waitForWorkflowVisible() helper with configurable timeout - Add timeout parameter to selectGreetingWorkflowItem() - Add timeout parameter to selectFailSwitchWorkflowItem() - Handles RBAC permission propagation delay ## Permissions Tested - orchestrator.workflow / orchestrator.workflow.<id> (read) - orchestrator.workflow.use / orchestrator.workflow.use.<id> (update) - orchestrator.instanceAdminView (read) - admin access to all instances Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add testIgnore to SHOWCASE_RBAC, SHOWCASE_RBAC_K8S, and SHOWCASE_OPERATOR_RBAC projects to prevent orchestrator-rbac.spec.ts from running on PR jobs and K8s environments where orchestrator is not deployed. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sonarqubecloud · 2026-02-04T00:59:50Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-02-04T01:40:06Z

The image is available at:

openshift-ci · 2026-02-04T02:10:28Z

@chadcrum: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ocp-helm-nightly	`1bc4809`	link	false	`/test e2e-ocp-helm-nightly`
ci/prow/e2e-ocp-operator-nightly	`af54422`	link	false	`/test e2e-ocp-operator-nightly`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

chadcrum · 2026-02-04T02:11:38Z

/retest

christoph-jerolimov · 2026-02-04T05:35:36Z

This pr had lgtm from others before and was just rebased. Reapply lgtm to merge it.

/lgtm

openshift-ci · 2026-02-04T05:35:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: christoph-jerolimov, gustavolira

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~e2e-tests/OWNERS~~ [christoph-jerolimov,gustavolira]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

* test(e2e): add orchestrator RBAC e2e test suite Add comprehensive RBAC end-to-end tests for the Orchestrator plugin covering workflow and instance access control: - Read-write access: users can view and execute all workflows - Read-only access: users can view but not execute workflows - Denied access: users cannot see any workflows - Workflow-specific read-write: access only to specific workflow - Workflow-specific read-only: view only specific workflow - Workflow-specific denied: hide specific workflow - Initiator-based access: users can only see their own instances - Admin override: instanceAdminView grants access to all instances - Cross-user isolation verification - Re-enable RBAC API validation test (previously test.fixme) - Add filtering for dynamically created workflow roles/policies - Prevents test interference during parallel execution - Add waitForWorkflowVisible() helper with configurable timeout - Add timeout parameter to selectGreetingWorkflowItem() - Add timeout parameter to selectFailSwitchWorkflowItem() - Handles RBAC permission propagation delay - orchestrator.workflow / orchestrator.workflow.<id> (read) - orchestrator.workflow.use / orchestrator.workflow.use.<id> (update) - orchestrator.instanceAdminView (read) - admin access to all instances Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(e2e): skip orchestrator RBAC tests when orchestrator not deployed Add testIgnore to SHOWCASE_RBAC, SHOWCASE_RBAC_K8S, and SHOWCASE_OPERATOR_RBAC projects to prevent orchestrator-rbac.spec.ts from running on PR jobs and K8s environments where orchestrator is not deployed. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

chadcrum had a problem deploying to external January 15, 2026 19:58 — with GitHub Actions Error

openshift-ci bot added the ok-to-test label Jan 15, 2026

chadcrum had a problem deploying to external January 15, 2026 23:35 — with GitHub Actions Error

chadcrum changed the title ~~test: add e2e orchestrator rbac tests~~ test(e2e): add orchestrator RBAC e2e tests Jan 15, 2026

github-actions bot added the Stale label Jan 23, 2026

chadcrum force-pushed the add-e2e-orchestrator-rbac-tests-rhdh-1-9 branch from aee3607 to bc99305 Compare January 30, 2026 01:10

github-actions bot removed the Stale label Jan 30, 2026

chadcrum force-pushed the add-e2e-orchestrator-rbac-tests-rhdh-1-9 branch from 51bc2cb to de7c0bb Compare February 1, 2026 20:39

chadcrum force-pushed the add-e2e-orchestrator-rbac-tests-rhdh-1-9 branch from de7c0bb to f2a475f Compare February 3, 2026 00:51

gustavolira approved these changes Feb 3, 2026

View reviewed changes

openshift-ci bot added the approved label Feb 3, 2026

openshift-ci bot assigned gustavolira Feb 3, 2026

openshift-ci bot added the lgtm label Feb 3, 2026

chadcrum and others added 2 commits February 3, 2026 19:58

chadcrum force-pushed the add-e2e-orchestrator-rbac-tests-rhdh-1-9 branch from 63dacb9 to ddde1be Compare February 4, 2026 00:58

openshift-ci bot removed the lgtm label Feb 4, 2026

openshift-ci bot assigned christoph-jerolimov Feb 4, 2026

openshift-ci bot added the lgtm label Feb 4, 2026

openshift-merge-bot bot merged commit 1e75c20 into redhat-developer:main Feb 4, 2026
16 checks passed

chadcrum mentioned this pull request Feb 4, 2026

[release-1.9] test(e2e): add orchestrator RBAC e2e tests #4197

Draft

2 tasks

test(e2e): add orchestrator RBAC e2e tests #4009

test(e2e): add orchestrator RBAC e2e tests #4009

Uh oh!

Conversation

chadcrum commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

New: orchestrator-rbac.spec.ts (28 tests)

Modified: rbac.spec.ts

Modified: orchestrator.ts (support page)

Permissions Tested

Testing

Note

Uh oh!

chadcrum commented Jan 15, 2026

Uh oh!

chadcrum commented Jan 15, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

chadcrum commented Jan 15, 2026

Uh oh!

chadcrum commented Jan 15, 2026

Uh oh!

chadcrum commented Jan 16, 2026

Uh oh!

github-actions bot commented Jan 16, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

chadcrum commented Jan 30, 2026

Uh oh!

qodo-code-review bot commented Jan 30, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 30, 2026

Uh oh!

github-actions bot commented Jan 30, 2026

Uh oh!

chadcrum commented Jan 31, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 31, 2026

Uh oh!

github-actions bot commented Jan 31, 2026

Uh oh!

chadcrum commented Jan 31, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 31, 2026

Uh oh!

github-actions bot commented Jan 31, 2026

Uh oh!

chadcrum commented Jan 31, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 31, 2026

Uh oh!

github-actions bot commented Jan 31, 2026

Uh oh!

chadcrum commented Jan 31, 2026

Uh oh!

rhdh-qodo-merge bot commented Jan 31, 2026

Uh oh!

github-actions bot commented Jan 31, 2026

Uh oh!

github-actions bot commented Feb 1, 2026

Uh oh!

chadcrum commented Feb 1, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

gustavolira commented Feb 3, 2026

Uh oh!

chadcrum commented Feb 3, 2026

Uh oh!

chadcrum commented Feb 4, 2026

Uh oh!

chadcrum commented Feb 4, 2026

Uh oh!

sonarqubecloud bot commented Feb 4, 2026

chadcrum commented Jan 15, 2026 •

edited

Loading

New: `orchestrator-rbac.spec.ts` (28 tests)

Modified: `rbac.spec.ts`

Modified: `orchestrator.ts` (support page)

openshift-ci bot commented Feb 4, 2026 •

edited

Loading