🌱 Add e2e test for collision protection with higher-revision ClusterObjectSet

Verify that a conflicting ClusterExtension with a higher-revision
ClusterObjectSet does not take over resources owned by the original
ClusterExtension.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Per G. da Silva

test/e2e/features/install.feature

@@ -678,3 +678,100 @@ Feature: Install ClusterExtension
     Then ClusterExtension is available
     And ClusterExtension reports Progressing as True with Reason Succeeded
     And ClusterExtension reports Installed as True
+
+  @BoxcutterRuntime
+  @DeploymentConfig
+  Scenario: A conflicting ClusterExtension with a higher revision does not take over resources from the original owner
+    Given a catalog "test" with packages:
+      | package | version | channel | replaces | contents                   |
+      | test    | 1.0.0   | alpha   |          | CRD, Deployment, ConfigMap |
+    And ServiceAccount "olm-sa" with needed permissions is available in test namespace
+    # Install the first ClusterExtension and verify it is installed with a single ClusterObjectSet
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-sa
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: ${PACKAGE:test}
+            version: 1.0.0
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": ${CATALOG:test}
+      """
+    Then ClusterExtension is rolled out
+    And ClusterExtension is available
+    And ClusterExtension "${NAME}" has 1 ClusterObjectSet
+    # Track the first ClusterExtension for cleanup before applying the second one
+    And the current ClusterExtension is tracked for cleanup
+    # Apply a second ClusterExtension pointing to the same package and version
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}-dup
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-sa
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: ${PACKAGE:test}
+            version: 1.0.0
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": ${CATALOG:test}
+      """
+    # The second ClusterExtension should be retrying because of resource collisions
+    Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      revision object collisions
+      """
+    # Update the conflicting ClusterExtension with a deployment config env var. At the time
+    # of writing, there is no other way to get the operator controller to generate another
+    # ClusterObjectSet by simply targeting another bundle version in the ClusterExtension.
+    # Since nothing has been installed yet for this CE, the resolver returns the currently
+    # installed bundle. Injecting an environment variable via DeploymentConfig changes the
+    # desired state, which causes the controller to create a second ClusterObjectSet
+    # (revision 2) after the first one collides.
+    When ClusterExtension is updated
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-sa
+        config:
+          configType: Inline
+          inline:
+            deploymentConfig:
+              env:
+                - name: MY_VAR
+                  value: "my-value"
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: ${PACKAGE:test}
+            version: 1.0.0
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": ${CATALOG:test}
+      """
+    Then ClusterExtension "${NAME}" has 2 ClusterObjectSets
+    # The higher-revision COS (revision 2) should also collide, not take over resources
+    And ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      revision object collisions
+      """

test/e2e/steps/steps.go

@@ -183,6 +183,7 @@ func RegisterSteps(sc *godog.ScenarioContext) {
 	sc.Step(`^(?i)min value for (ClusterExtension|ClusterObjectSet) ((?:\.[a-zA-Z]+)+) is set to (\d+)$`, SetCRDFieldMinValue)
 
 	sc.Step(`^(?i)the current ClusterExtension is tracked for cleanup$`, TrackCurrentClusterExtensionForCleanup)
+	sc.Step(`^(?i)ClusterExtension "([^"]+)" has (\d+) ClusterObjectSets?$`, ClusterExtensionHasClusterObjectSets)
 
 	// TLS profile enforcement steps — deployment configuration
 	sc.Step(`^(?i)the "([^"]+)" deployment is configured with custom TLS minimum version "([^"]+)"$`, ConfigureDeploymentWithCustomTLSVersion)
@@ -393,6 +394,24 @@ func TrackCurrentClusterExtensionForCleanup(ctx context.Context) error {
 	return nil
 }
 
+// ClusterExtensionHasClusterObjectSets waits for the named ClusterExtension to own exactly the
+// expected number of ClusterObjectSets. Polls with timeout.
+func ClusterExtensionHasClusterObjectSets(ctx context.Context, extName string, expectedCount int) error {
+	sc := scenarioCtx(ctx)
+	extName = substituteScenarioVars(extName, sc)
+	waitFor(ctx, func() bool {
+		out, err := k8sClient("get", "clusterobjectsets",
+			"-l", fmt.Sprintf("olm.operatorframework.io/owner-name=%s", extName),
+			"-o", "jsonpath={.items[*].metadata.name}")
+		if err != nil {
+			return false
+		}
+		names := strings.Fields(strings.TrimSpace(out))
+		return len(names) == expectedCount
+	})
+	return nil
+}
+
 // ClusterExtensionVersionUpdate patches the ClusterExtension's catalog version to the specified value.
 func ClusterExtensionVersionUpdate(ctx context.Context, version string) error {
 	sc := scenarioCtx(ctx)