Refactor OIDC test suite structure and fix review feedback

This commit improves the OIDC test suite organization by making tag
semantics more accurate and addressing code review feedback.

Changes:
- Remove [OIDC] tag from IntegratedOAuth IDP tests (Keycloak/GitLab)
  These tests use OIDC providers as identity sources for OpenShift's
  IntegratedOAuth, not external OIDC authentication.

- Simplify External OIDC test tags: [OIDC] only (remove [Serial][Disruptive])
  This test runs in its own dedicated suite via OTE framework.

- Add new OTE suite: operator-oidc/serial
  Dedicated suite for external OIDC tests that bypass IntegratedOAuth.

- Update serial suite qualifier to properly match [Serial] tests
  and non-disruptive operator/template/token tests.

- Fix context usage in external_oidc.go poll function
  Use poll-derived context instead of outer context to ensure
  API calls are cancelled when poll times out.

- Add nsCleanup() to idpdeployment.go cleanup function
  Fixes resource leak by properly cleaning up test namespaces.

- Remove placeholder bug reference (OCPBUGS-XXXXX)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: 2 people

cmd/cluster-authentication-operator-tests-ext/main.go

@@ -77,16 +77,16 @@ func prepareOperatorTestsRegistry() (*oteextension.Registry, error) {
 
 	// The following suite runs tests that must execute serially (one at a time)
 	// because they modify cluster-wide resources like OAuth configuration.
-	// Tests tagged with [Serial] and any of [Operator], [OIDC], [Templates], [Tokens] are included in this suite.
+	// Tests tagged with [Serial] are included, as well as tests with [Operator], [Templates], or [Tokens].
 	// Excludes [Disruptive] tests which run in the disruptive suite instead.
-	// ClusterStability set to Disruptive: OIDC tests temporarily put authentication operator
-	// in Degraded state during cleanup when IDP configuration is rolled back.
+	// ClusterStability set to Disruptive: IntegratedOAuth IDP tests (Keycloak/GitLab) temporarily
+	// put authentication operator in Degraded state during cleanup when IDP configuration is rolled back.
 	extension.AddSuite(oteextension.Suite{
 		Name:             "openshift/cluster-authentication-operator/operator/serial",
 		Parallelism:      1,
 		ClusterStability: oteextension.ClusterStabilityDisruptive,
 		Qualifiers: []string{
-			`name.contains("[Serial]") && !name.contains("[Disruptive]") && (name.contains("[Operator]") || name.contains("[OIDC]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
+			`!name.contains("[Disruptive]") && (name.contains("[Serial]") || name.contains("[Operator]") || name.contains("[Templates]") || name.contains("[Tokens]"))`,
 		},
 	})
 
@@ -110,6 +110,17 @@ func prepareOperatorTestsRegistry() (*oteextension.Registry, error) {
 		},
 	})
 
+	// The following suite runs external OIDC tests that authenticate directly via external OIDC
+	// (bypassing OpenShift's IntegratedOAuth). These are long-running tests in their own suite.
+	extension.AddSuite(oteextension.Suite{
+		Name:             "openshift/cluster-authentication-operator/operator-oidc/serial",
+		Parallelism:      1,
+		ClusterStability: oteextension.ClusterStabilityDisruptive,
+		Qualifiers: []string{
+			`name.contains("[OIDC]")`,
+		},
+	})
+
 	// ClusterStability set to Disruptive: encryption perf tests trigger API server rollouts.
 	extension.AddSuite(oteextension.Suite{
 		Name:             "openshift/cluster-authentication-operator/operator-encryption-perf/serial",

test/e2e-oidc/external_oidc.go

@@ -51,7 +51,7 @@ import (
 )
 
 var _ = g.Describe("[sig-auth] authentication operator", func() {
-	g.It("[OIDC][Serial][Disruptive] TestExternalOIDCWithKeycloak [Timeout:3h]", func(ctx context.Context) {
+	g.It("[OIDC] TestExternalOIDCWithKeycloak [Timeout:3h]", func(ctx context.Context) {
 		testExternalOIDCWithKeycloak(ctx, g.GinkgoTB())
 	})
 })
@@ -849,14 +849,13 @@ func (tc *testClient) validateOAuthState(t testing.TB, ctx context.Context, requ
 
 	var validationErrs []error
 	// Increased timeout from 5 minutes to 10 minutes to allow for slower OAuth resource cleanup
-	// See: https://issues.redhat.com/browse/OCPBUGS-XXXXX
-	waitErr := wait.PollUntilContextTimeout(ctx, 30*time.Second, 10*time.Minute, false, func(_ context.Context) (bool, error) {
+	waitErr := wait.PollUntilContextTimeout(ctx, 30*time.Second, 10*time.Minute, false, func(pollCtx context.Context) (bool, error) {
 		validationErrs = make([]error, 0)
-		validationErrs = append(validationErrs, validateOAuthResources(ctx, dynamicClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
-		validationErrs = append(validationErrs, validateOAuthRoutes(ctx, tc.routeClient, tc.configClient, requireMissing)...)
+		validationErrs = append(validationErrs, validateOAuthResources(pollCtx, dynamicClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
+		validationErrs = append(validationErrs, validateOAuthRoutes(pollCtx, tc.routeClient, tc.configClient, requireMissing)...)
 		validationErrs = append(validationErrs, validateOAuthControllerConditions(tc.operatorClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
-		validationErrs = append(validationErrs, validateOperandVersions(ctx, tc.configClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
-		validationErrs = append(validationErrs, validateOAuthRelatedObjects(ctx, tc.configClient, requireMissing)...)
+		validationErrs = append(validationErrs, validateOperandVersions(pollCtx, tc.configClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
+		validationErrs = append(validationErrs, validateOAuthRelatedObjects(pollCtx, tc.configClient, requireMissing)...)
 
 		// Log progress every iteration to help debug timeout issues
 		if len(validationErrs) > 0 {

test/e2e/gitlab.go

@@ -10,7 +10,7 @@ import (
 )
 
 var _ = g.Describe("[sig-auth] authentication operator", func() {
-	g.It("[OIDC][Serial] TestGitLabAsOIDCPasswordGrantCheck", func() {
+	g.It("[Serial] TestGitLabAsOIDCPasswordGrantCheck", func() {
 		testGitLabAsOIDCPasswordGrantCheck(g.GinkgoTB())
 	})
 })

test/e2e/keycloak.go

@@ -26,7 +26,7 @@ import (
 )
 
 var _ = g.Describe("[sig-auth] authentication operator", func() {
-	g.It("[OIDC][Serial] TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync", func() {
+	g.It("[Serial] TestKeycloakAsOIDCPasswordGrantCheckAndGroupSync", func() {
 		testKeycloakAsOIDCPasswordGrantCheckAndGroupSync(g.GinkgoTB())
 	})
 })

test/library/idpdeployment.go

@@ -136,6 +136,7 @@ func deployPodWithImageStream(
 	cleanup = func() {
 		isCleanup()
 		podCleanup()
+		nsCleanup()
 	}
 
 	return namespace, host, cleanup