Fix E2E update tests for OCP cluster (#1985)

- Add missing IstioCNI NS creation for control plane update sub tests.
- Refactor proxy version retrieve for ztunnel mode.

Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

Author: MaxBab

tests/e2e/controlplane/control_plane_update_test.go

@@ -310,6 +310,10 @@ spec:
 			BeforeAll(func(ctx SpecContext) {
 				clr.Record(ctx)
 				Expect(k.CreateNamespace(controlPlaneNamespace)).To(Succeed(), "Istio namespace failed to be created")
+				Expect(k.CreateNamespace(istioCniNamespace)).To(Succeed(), "IstioCNI namespace failed to be created")
+
+				common.CreateIstioCNI(k, baseVersion.Name)
+				common.AwaitCondition(ctx, v1.IstioCNIConditionReady, kube.Key(istioCniName), &v1.IstioCNI{}, k, cl)
 			})
 
 			When(fmt.Sprintf("Istio CR is created with InPlace updateStrategy for version %s", baseVersion.Name), func() {
@@ -476,6 +480,10 @@ updateStrategy:
 			BeforeAll(func(ctx SpecContext) {
 				clr.Record(ctx)
 				Expect(k.CreateNamespace(controlPlaneNamespace)).To(Succeed(), "Istio namespace failed to be created")
+				Expect(k.CreateNamespace(istioCniNamespace)).To(Succeed(), "IstioCNI namespace failed to be created")
+
+				common.CreateIstioCNI(k, testVersion.Name)
+				common.AwaitCondition(ctx, v1.IstioCNIConditionReady, kube.Key(istioCniName), &v1.IstioCNI{}, k, cl)
 
 				// Create Istio CR with test version
 				common.CreateIstio(k, testVersion.Name, `

tests/e2e/util/common/e2e_utils.go

@@ -537,7 +537,7 @@ func EnsureNamespace(ctx context.Context, ctrlclient client.Client, namespace st
 func GetProxyVersion(podName, namespace string) (*semver.Version, error) {
 	proxyStatus, err := istioctl.GetProxyStatus("--namespace " + namespace)
 	if err != nil {
-		return nil, fmt.Errorf("error getting sidecar version: %w", err)
+		return nil, fmt.Errorf("error getting proxy version: %w", err)
 	}
 
 	lines := strings.Split(proxyStatus, "\n")
@@ -559,8 +559,10 @@ func GetProxyVersion(podName, namespace string) (*semver.Version, error) {
 	for _, line := range lines[1:] {
 		if strings.Contains(line, podName+"."+namespace) {
 			values := colSplit.Split(strings.TrimSpace(line), -1)
-			versionStr = values[versionIdx]
-			break
+			if versionIdx < len(values) {
+				versionStr = values[versionIdx]
+				break
+			}
 		}
 	}
 
@@ -569,7 +571,7 @@ func GetProxyVersion(podName, namespace string) (*semver.Version, error) {
 	}
 	version, err := semver.NewVersion(versionStr)
 	if err != nil {
-		return version, fmt.Errorf("error parsing sidecar version %q: %w", versionStr, err)
+		return version, fmt.Errorf("error parsing proxy version %q: %w", versionStr, err)
 	}
 	return version, err
 }

tests/e2e/util/common/workload_validator.go

@@ -22,9 +22,7 @@ import (
 	"strings"
 
 	"github.com/Masterminds/semver/v3"
-	"github.com/istio-ecosystem/sail-operator/pkg/kube"
 	"github.com/istio-ecosystem/sail-operator/tests/e2e/util/kubectl"
-	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -129,29 +127,36 @@ func (w *WorkloadValidator) ValidateConnectivity(ctx context.Context) error {
 
 // ValidateProxyVersion validates proxy version based on dataplane mode
 func (w *WorkloadValidator) ValidateProxyVersion(ctx context.Context, expectedVersion *semver.Version) error {
+	var namespace string
+	var checkAllPods bool // true = check all pods, false = check first pod only
+
 	switch w.DataplaneMode {
 	case DataplaneModeSidecar:
-		return w.validateSidecarProxyVersion(ctx, expectedVersion)
+		namespace = w.Namespace
+		checkAllPods = true // check all workload pods
 	case DataplaneModeAmbient:
-		return w.validateZTunnelVersion(ctx, expectedVersion)
+		namespace = ZtunnelNamespace
+		checkAllPods = false // All ZTunnel pods share same version, check first only
 	default:
 		return fmt.Errorf("unsupported dataplane mode: %s", w.DataplaneMode)
 	}
-}
 
-// validateSidecarProxyVersion checks proxy container version in workload pods
-func (w *WorkloadValidator) validateSidecarProxyVersion(ctx context.Context, expectedVersion *semver.Version) error {
 	pods := &corev1.PodList{}
-	if err := w.Cl.List(ctx, pods, client.InNamespace(w.Namespace)); err != nil {
-		return fmt.Errorf("failed to list pods in %s: %w", w.Namespace, err)
+	if err := w.Cl.List(ctx, pods, client.InNamespace(namespace)); err != nil {
+		return fmt.Errorf("failed to list pods in %s: %w", namespace, err)
 	}
 
 	if len(pods.Items) == 0 {
-		return fmt.Errorf("no pods found in %s namespace", w.Namespace)
+		return fmt.Errorf("no pods found in %s namespace", namespace)
 	}
 
-	for _, pod := range pods.Items {
-		proxyVersion, err := GetProxyVersion(pod.Name, w.Namespace)
+	podsToValidate := pods.Items
+	if !checkAllPods {
+		podsToValidate = pods.Items[:1]
+	}
+
+	for _, pod := range podsToValidate {
+		proxyVersion, err := GetProxyVersion(pod.Name, namespace)
 		if err != nil {
 			return fmt.Errorf("failed to get proxy version for pod %s: %w", pod.Name, err)
 		}
@@ -160,40 +165,8 @@ func (w *WorkloadValidator) validateSidecarProxyVersion(ctx context.Context, exp
 				pod.Name, proxyVersion, expectedVersion)
 		}
 	}
-	return nil
-}
-
-// validateZTunnelVersion checks ZTunnel DaemonSet version by reading image tag
-func (w *WorkloadValidator) validateZTunnelVersion(ctx context.Context, expectedVersion *semver.Version) error {
-	daemonset := &appsv1.DaemonSet{}
-	if err := w.Cl.Get(ctx, kube.Key("ztunnel", ZtunnelNamespace), daemonset); err != nil {
-		return fmt.Errorf("failed to get ZTunnel DaemonSet: %w", err)
-	}
-
-	// Extract version from ZTunnel container image tag
-	// Image format: gcr.io/istio-release/ztunnel:1.29.2
-	for _, container := range daemonset.Spec.Template.Spec.Containers {
-		if container.Name == "istio-proxy" {
-			parts := strings.Split(container.Image, ":")
-			if len(parts) != 2 {
-				return fmt.Errorf("unexpected ZTunnel image format: %s", container.Image)
-			}
-			tag := parts[1]
-
-			// Parse version from tag
-			version, err := semver.NewVersion(tag)
-			if err != nil {
-				return fmt.Errorf("failed to parse ZTunnel version from tag %s: %w", tag, err)
-			}
-
-			if !version.Equal(expectedVersion) {
-				return fmt.Errorf("ZTunnel has version %s, expected %s", version, expectedVersion)
-			}
-			return nil
-		}
-	}
 
-	return fmt.Errorf("istio-proxy container not found in ZTunnel DaemonSet")
+	return nil
 }
 
 // Cleanup removes workload and httpbin namespaces