Fix the failing Proxy test cases - precedence for proxy env vars from olm and openshift proxy CR were broken

Author: siddhibhor-56

pkg/controller/external_secrets/utils.go

@@ -125,17 +125,29 @@ func (r *Reconciler) IsCertManagerInstalled() bool {
 	return ok
 }
 
+// hasProxyURLs reports whether a ProxyConfig carries at least one proxy URL
+// (HTTPProxy, HTTPSProxy, or NoProxy). Control-plane fields like
+// NetworkPolicyProvisioning are intentionally excluded — they configure
+// operator behavior, not proxy endpoints.
+func hasProxyURLs(p *operatorv1alpha1.ProxyConfig) bool {
+	return p != nil && (p.HTTPProxy != "" || p.HTTPSProxy != "" || p.NoProxy != "")
+}
+
 // getProxyConfiguration returns the proxy configuration based on precedence.
 // The precedence order is: ExternalSecretsConfig > ExternalSecretsManager > OLM environment variables.
+// Only proxy URL fields (HTTPProxy, HTTPSProxy, NoProxy) participate in the
+// precedence decision; a ProxyConfig that carries only control-plane fields
+// (e.g. NetworkPolicyProvisioning) is treated as empty and falls through to the
+// next source. After resolving the URLs, any NetworkPolicyProvisioning value set
+// on the ExternalSecretsConfig CR is merged into the result so that administrators
+// can control network-policy management independently of where the proxy URLs originate.
 func (r *Reconciler) getProxyConfiguration(esc *operatorv1alpha1.ExternalSecretsConfig) (*operatorv1alpha1.ProxyConfig, error) {
 	var proxyConfig *operatorv1alpha1.ProxyConfig
 
-	// Check ExternalSecretsConfig first
 	switch {
-	case esc.Spec.ApplicationConfig.Proxy != nil:
+	case hasProxyURLs(esc.Spec.ApplicationConfig.Proxy):
 		proxyConfig = esc.Spec.ApplicationConfig.Proxy
-	case r.esm.Spec.GlobalConfig != nil && r.esm.Spec.GlobalConfig.Proxy != nil:
-		// Check ExternalSecretsManager second
+	case r.esm.Spec.GlobalConfig != nil && hasProxyURLs(r.esm.Spec.GlobalConfig.Proxy):
 		proxyConfig = r.esm.Spec.GlobalConfig.Proxy
 	default:
 		// Fall back to OLM environment variables
@@ -153,6 +165,15 @@ func (r *Reconciler) getProxyConfiguration(esc *operatorv1alpha1.ExternalSecrets
 		}
 	}
 
+	// Merge NetworkPolicyProvisioning from the CR even when proxy URLs came
+	// from a lower-priority source, so administrators can control network-policy
+	// management independently.
+	if crProxy := esc.Spec.ApplicationConfig.Proxy; crProxy != nil && proxyConfig != nil {
+		if crProxy.NetworkPolicyProvisioning != "" {
+			proxyConfig.NetworkPolicyProvisioning = crProxy.NetworkPolicyProvisioning
+		}
+	}
+
 	if proxyConfig != nil {
 		if err := validateProxy(proxyConfig.HTTPProxy); err != nil {
 			return nil, fmt.Errorf("failed to validate HTTP proxy: %w", err)

test/e2e/e2e_test.go

@@ -83,9 +83,9 @@ const (
 const (
 	userNPPrefix            = "eso-user-"
 	npProxyEgressPolicyName = "eso-sys-allow-proxy-egress"
-	managedByLabel = "app.kubernetes.io/managed-by"
-	partOfLabel    = "app.kubernetes.io/part-of"
-	managedByValue = "external-secrets-operator"
+	managedByLabel          = "app.kubernetes.io/managed-by"
+	partOfLabel             = "app.kubernetes.io/part-of"
+	managedByValue          = "external-secrets-operator"
 )
 
 var expectedStaticNPNames = []string{
@@ -1020,7 +1020,7 @@ var _ = Describe("External Secrets Operator End-to-End test scenarios", Ordered,
 			Expect(err).NotTo(HaveOccurred(), "should set proxy config with Unmanaged provisioning")
 
 			By("Verifying proxy egress policy is not created")
-			Consistently(func(g Gomega) {
+			Eventually(func(g Gomega) {
 				_, err := clientset.NetworkingV1().NetworkPolicies(operandNamespace).Get(ctx, npProxyEgressPolicyName, metav1.GetOptions{})
 				g.Expect(err).To(HaveOccurred(), "proxy egress policy should not exist when provisioning is Unmanaged")
 			}, 30*time.Second, 5*time.Second).Should(Succeed())