CNF-26150: Fix flaky e2e ConditionMatcher.Matches early-return when Any mode is true

[sebrandon1]

Summary

• Fixes a bug in ConditionMatcher.Matches() where the early-return on status mismatch fires even when Any=true, causing false negatives when a non-matching condition is iterated before a matching one
• Adds a unit test reproducing the exact CI failure scenario (static-resources Degraded=False before deployment Degraded=True)

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode — Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Fix

Guard the early-return with !m.Any so Any mode continues searching instead of short-circuiting on the first mismatch.

Test plan

• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases, 360s)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes instantly (would timeout at 180s without the fix)

Summary by CodeRabbit

• Bug Fixes

  • Improved condition matching in “Any” mode so a non-matching condition does not prevent later matching conditions from succeeding.

• Tests

  • Added coverage confirming that a valid matching condition is recognized even when it follows a non-matching condition.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sebrandon1: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Fixes a bug in ConditionMatcher.Matches() where the early-return on status mismatch fires even when Any=true, causing false negatives when a non-matching condition is iterated before a matching one
• Adds a unit test reproducing the exact CI failure scenario (static-resources Degraded=False before deployment Degraded=True)

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode — Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Fix

Guard the early-return with !m.Any so Any mode continues searching instead of short-circuiting on the first mismatch.

Test plan

• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases, 360s)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes instantly (would timeout at 180s without the fix)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The condition matcher now ignores a status mismatch in match-any mode and continues evaluating conditions. An end-to-end test verifies that a later matching condition succeeds after an earlier mismatch.

Changes

Condition matching

Layer / File(s)	Summary
Match-any status evaluation test/e2e/condition_matcher_test.go, test/e2e/condition_matcher_unit_test.go	The matcher only fails immediately on a status mismatch in match-all mode, and tests cover a later matching condition in match-any mode.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added test name is static and descriptive; no dynamic data or unstable identifiers appear in the changed test titles.
Test Structure And Quality	✅ Passed	Plain table-driven unit tests with a fake client; no cluster ops or Ginkgo hooks are needed, and the added case is single-purpose with reasonable failure messages.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e test was added; the change is a helper tweak plus a fake-client unit test, with no MicroShift-unsupported APIs or features.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo specs were added; the change is a matcher fix plus a plain Go unit test with no node-topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only e2e test files changed; no deployment manifests, operator code, or controllers were modified, so no new scheduling assumptions were introduced.
Ote Binary Stdout Contract	✅ Passed	Patch only changes matcher logic and adds a test; no main/init/TestMain/BeforeSuite stdout writes were added, and logging remains log.Printf (stderr by default).
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e specs were added; the change only touches helper code and a standard Go unit test with no IP or external-network assumptions.
No-Weak-Crypto	✅ Passed	Diff only changes condition-matching test logic and adds a unit test; no weak crypto, custom crypto, or secret-comparison code is present.
Container-Privileges	✅ Passed	PR only changes Go tests and matcher logic; no manifests or privileged container settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging was added, and the existing timeout logs only dump operator conditions/matchers, not passwords, tokens, PII, or hostnames.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main fix to ConditionMatcher.Matches in Any mode and matches the e2e flakiness addressed by the PR.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign bharath-b-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26150 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Fixes a bug in ConditionMatcher.Matches() where the early-return on status mismatch fires even when Any=true, causing false negatives when a non-matching condition is iterated before a matching one
• Adds a unit test reproducing the exact CI failure scenario (static-resources Degraded=False before deployment Degraded=True)

Problem

The Matches function short-circuits with return false when it finds a condition that matches the type pattern but not the expected status. This is correct for All mode but wrong for Any mode — Any should keep looking for at least one match.

Since the Kubernetes API returns conditions in non-deterministic order, this produces flaky e2e failures in the overrides tests. The e2e-operator-tech-preview job fails when cert-manager-webhook-static-resources-Degraded (False) is iterated before cert-manager-webhook-deploymentDegraded (True).

Fix

Guard the early-return with !m.Any so Any mode continues searching instead of short-circuiting on the first mismatch.

Test plan

• Existing unit test TestVerifyOperatorStatusCondition passes (5 cases, 360s)
• New test case "Any mode succeeds when matching condition appears after non-matching one" passes instantly (would timeout at 180s without the fix)

Summary by CodeRabbit

• Bug Fixes

• Improved condition matching in “Any” mode so a non-matching condition does not prevent later matching conditions from succeeding.

• Tests

• Added coverage confirming that a valid matching condition is recognized even when it follows a non-matching condition.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@sebrandon1: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.