[WIP]: CNTRLPLANE-3375: Increase external OIDC cleanup settle timeout to 70min

[ShazaAldawamneh]

The kube-apiserver rollout after switching back from external OIDC to integrated OAuth has been observed to take ~48+ minutes in worst-case back-to-back revision rollout scenarios. Bump the WaitForOperatorsToSettle timeout from 50 to 70 minutes to avoid flaky test failures.

Summary by CodeRabbit

• Tests
  • Extended the operator settling window during authentication rollout testing to better accommodate longer disruptive rollouts.
  • Updated related timing documentation in the test suite.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references CNTRLPLANE-3375 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

The kube-apiserver rollout after switching back from external OIDC to integrated OAuth has been observed to take ~48+ minutes in worst-case back-to-back revision rollout scenarios. Bump the WaitForOperatorsToSettle timeout from 50 to 70 minutes to avoid flaky test failures.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ShazaAldawamneh
Once this PR has been reviewed and has the lgtm label, please assign ibihim for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/extended/authentication/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 37009ac6-0690-4b05-b6cf-b1cc5f4f3555

📥 Commits

Reviewing files that changed from the base of the PR and between c367745 and c3ecb68.

📒 Files selected for processing (1)

• test/extended/authentication/oidc.go

---

Walkthrough

The OIDC rollout test’s operator settling window and corresponding comments were updated from 50 to 70 minutes.

Changes

OIDC rollout testing

Layer / File(s)	Summary
Extend operator settling window test/extended/authentication/oidc.go	waitForRollout now waits 70 minutes for cluster operators to settle, with updated comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: everettraven

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: increasing the external OIDC settle timeout to 70 minutes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes rollout timeout/comments; all Ginkgo titles in oidc.go are static, with no dynamic data or new test-name edits.
Test Structure And Quality	✅ Passed	Only a rollout timeout/comment changed; the helper still uses bounded waits and existing setup/cleanup patterns, with no new test-quality issues.
Microshift Test Compatibility	✅ Passed	No new Ginkgo tests were added; only an existing wait timeout/comment changed, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS - The PR only bumps a rollout wait timeout/comment in an existing authentication suite; it adds no new Ginkgo tests and no multi-node/SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a test timeout changed in oidc.go; no manifests, controllers, or scheduling constraints were added or modified.
Ote Binary Stdout Contract	✅ Passed	PR only raises the rollout wait timeout; I found no stdout/log-to-stdout writes in the suite file or package setup.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: PR only increases a rollout timeout in an existing test; no new Ginkgo test, hardcoded IPv4, or external/public connectivity assumptions were introduced.
No-Weak-Crypto	✅ Passed	Touched change only increases operator wait timeout from 50 to 70 minutes; no crypto primitives or secret comparisons were added.
Container-Privileges	✅ Passed	Only a Go test timeout changed; no container/K8s manifests or privilege fields were added or modified.
No-Sensitive-Data-In-Logs	✅ Passed	The change only adjusts a rollout timeout/comment; it adds no logging or sensitive-value exposure.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ShazaAldawamneh]

/retest-required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[openshift-ci]

@ShazaAldawamneh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[everettraven]

The changes here seem fine to me. I'm going to trigger an aggregate run to ensure that we don't see the same timeout problem as frequently with this change.

/payload-aggregate periodic-ci-openshift-cluster-authentication-operator-release-5.0-periodics-e2e-azure-external-oidc-upstream-parity 10

[openshift-ci]

@everettraven: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-cluster-authentication-operator-release-5.0-periodics-e2e-azure-external-oidc-upstream-parity

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/fa3db380-85f7-11f1-83dc-a70518012d9f-0

[jubittajohn]

/payload-aggregate periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node 4
(kindly ignore this - triggering this to collect some data for the origin rebase PR)

[openshift-ci]

@jubittajohn: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/32c74910-85fc-11f1-8a09-28c5d86b8262-0

[jubittajohn]

/payload-aggregate periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node 4

[openshift-ci]

@jubittajohn: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/71c309a0-8602-11f1-840b-e75e262dcce6-0

[everettraven]

@ShazaAldawamneh I think we've proven here that this isn't actually the issue. We can probably close this PR out.