Merge pull request openstack-k8s-operators#1964 from abays/fix_tls_cert_rotate_kuttl

Fix cert-manager CA rotation race in TLS cert rotation KUTTL test

Author: openshift-merge-bot[bot]

config/samples/tls/custom_duration/patch.yaml

@@ -5,23 +5,15 @@ metadata:
 spec:
   tls:
     ingress:
-      ca:
-        duration: 1000h0m0s
       cert:
         duration: 500h0m0s
     podLevel:
       internal:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s
       libvirt:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s
       ovn:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s

test/kuttl/tests/ctlplane-tls-cert-rotation/03-assert-new-certs.yaml

@@ -19,6 +19,34 @@ metadata:
 spec:
   duration: 500h0m0s
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: neutron-internal-svc
+spec:
+  duration: 500h0m0s
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: glance-default-internal-svc
+spec:
+  duration: 500h0m0s
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cinder-internal-svc
+spec:
+  duration: 500h0m0s
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: placement-internal-svc
+spec:
+  duration: 500h0m0s
+---
 apiVersion: core.openstack.org/v1beta1
 kind: OpenStackControlPlane
 metadata:
@@ -196,25 +224,17 @@ spec:
   tls:
     ingress:
       enabled: true
-      ca:
-        duration: 1000h0m0s
       cert:
         duration: 500h0m0s
     podLevel:
       enabled: true
       internal:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s
       libvirt:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s
       ovn:
-        ca:
-          duration: 1000h0m0s
         cert:
           duration:  500h0m0s
 status:

test/kuttl/tests/ctlplane-tls-cert-rotation/04-assert-service-cert-rotation.yaml

@@ -2,8 +2,21 @@ apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 timeout: 900
 commands:
+  - script: |
+      echo "Waiting for OpenStack control plane to be ready after cert re-issuance..."
+      oc wait openstackcontrolplane -n $NAMESPACE --for=condition=Ready --timeout=600s -l core.openstack.org/openstackcontrolplane
+
   - script: |
       echo "Checking rotation of non API service certificates..."
+      for i in $(seq 1 15); do
+        if NAMESPACE=$NAMESPACE bash ../../common/osp_check_noapi_service_certs.sh 2>/dev/null; then
+          echo "Non-API service certificates verified successfully."
+          exit 0
+        fi
+        echo "Attempt $i/15: Non-API service certs not yet consistent, waiting 20s..."
+        sleep 20
+      done
+      echo "Final non-API service cert check..."
       NAMESPACE=$NAMESPACE bash ../../common/osp_check_noapi_service_certs.sh
 
   - script: |