OCPBUGS-99920: Fix ClusterResourceQuota test for Istio 1.30 configmap name change

[gcs278]

Summary

Istio 1.30 (OSSM 3.4) replaced the istio-ca-root-cert configmap with istio-ca-crl in every namespace. The ClusterResourceQuota test workaround only checked for istio-ca-root-cert, so it failed to account for the extra configmap and reported a false quota failure.

Changes istio-ca-root-cert → istio-ca-crl and updates the TODO comment from OSSM 3.0.1 to 3.4.1.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Updated cluster quota recovery checks to recognize the current Istio-generated ConfigMap.
  • Improved ConfigMap creation reliability when cluster quota limits are recalculated after an initial failure.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@gcs278: This pull request references Jira Issue OCPBUGS-99920, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Istio 1.30 (OSSM 3.4) replaced the istio-ca-root-cert configmap with istio-ca-crl in every namespace. The ClusterResourceQuota test workaround only checked for istio-ca-root-cert, so it failed to account for the extra configmap and reported a false quota failure.

Changes istio-ca-root-cert → istio-ca-crl and updates the TODO comment from OSSM 3.0.1 to 3.4.1.

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gcs278
Once this PR has been reviewed and has the lgtm label, please assign bertinatto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6ddb2c71-9786-4ab9-b6ba-a18e0bb137ad

📥 Commits

Reviewing files that changed from the base of the PR and between cd90523 and 99a61b6.

📒 Files selected for processing (1)

• test/extended/quota/clusterquota.go

---

Walkthrough

The cluster quota test now checks for the Istio-generated istio-ca-crl ConfigMap during ConfigMap creation error recovery, updating the related TODO while preserving quota adjustment and retry behavior.

Changes

Cluster quota recovery

Layer / File(s)	Summary
Update Istio ConfigMap detection test/extended/quota/clusterquota.go	The recovery path detects istio-ca-crl instead of istio-ca-root-cert before adjusting the ConfigMap quota and retrying creation.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating the ClusterResourceQuota test for the Istio ConfigMap name change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo title in the changed file contains dynamic data; the test names are static and the PR only adjusts ConfigMap logic.
Test Structure And Quality	✅ Passed	PASS: The diff only renames the Istio ConfigMap check and updates the TODO; it doesn’t add new test-structure, timeout, or cleanup issues.
Microshift Test Compatibility	✅ Passed	No new Ginkgo test was added; the existing test already has apigroup tags that MicroShift jobs skip, so the change is protected.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only updates an existing quota test’s Istio ConfigMap name/comment; it adds no new Ginkgo test and no SNO-sensitive multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a test quota workaround changed a ConfigMap name/comment; no manifests, controllers, node selectors, affinity, or replica logic were added.
Ote Binary Stdout Contract	✅ Passed	The change is only inside an It body in clusterquota.go; no TestMain/init/BeforeSuite stdout writes or klog/logging to stdout were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The modified Ginkgo test only uses cluster API objects and has no IP literals, IPv4-only logic, or external/public network calls.
No-Weak-Crypto	✅ Passed	The only change is a ConfigMap name/comment in a quota test; no weak-crypto primitives, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	Only a Go test file changed; it contains no privileged container/K8s settings or manifests.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only changes a ConfigMap name/comment; added logging is generic t.Fatalf("unexpected error: %v", err) and exposes no sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}