CNF-26153: Add unit tests across codebase to close coverage gaps

[sebrandon1]

Summary

• Full-codebase unit test audit targeting general coverage gaps not tied to specific bug-fix PRs
• Adds ~1,450 lines of test code across 12 files (5 new, 7 modified) without touching production code
• Bug-specific tests redistributed to their respective fix PRs for co-location with the code they validate

Coverage by package

Package	What is Covered
pkg/controller/certmanager	Network policy validation, default CertManager controller, log level hook, deployment overrides (unsupported JSON), related images for all operands
pkg/controller/common	Utility functions (UpdateName, DecodeObjBytes)
pkg/controller/istiocsr	validateIstioCSRConfig (5 branches)
pkg/controller/trustmanager	managedAnnotationsModified, webhook rules and AdmissionReviewVersions drift
pkg/features	IsIstioCSRFeatureGateEnabled, SetupWithFlagValue invalid flag
pkg/operator/operatorclient	GetOperatorState, EnsureFinalizer, RemoveFinalizer, ApplyOperatorStatus, GetUnsupportedConfigOverrides
pkg/operator	buildCacheObjectList, addControllerCacheConfig, findExistingCacheEntry

Related PRs

Tests for specific bugs were moved to their respective fix PRs:

PR	Title	Tests Moved
openshift/cert-manager-operator#462	CNF-26102: Fix istiocsr updateCondition error aggregation bug	TestUpdateCondition
openshift/cert-manager-operator#438	CM-1113: Replace unsafe.Pointer casts	Validation + override helper tests
openshift/cert-manager-operator#419	CM-1039: Thread context.Context through controller helpers	Finalizer + status tests
openshift/cert-manager-operator#420	CM-1040: Extract shared ApplyResource helper	Client wrapper + network policy tests
openshift/cert-manager-operator#417	CM-1114: Add health probes and richer status conditions	reconcile_result + port/probe tests

Jira

• CNF-26153 — Add unit tests across codebase to close coverage gaps (To Do)
• Epic: CNF-23509 — cert-manager-operator Tuning

Test Plan

• All tests pass across affected packages
• make lint passes (no new lint issues)
• No production code modified
• CI e2e tests pass

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sebrandon1: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Full-codebase unit test audit identified 42 coverage gaps across 12 packages. This PR addresses the high and medium priority gaps, adding 3,337 lines of new test code across 18 files (11 new, 7 modified) without touching any production code.

New test coverage by package

Package	New Tests	What is Covered
pkg/controller/certmanager	~50	Network policy validation, default CertManager controller, log level hook, deployment helper overrides (args/env/labels), unsupported overrides invalid JSON, related images for all operands
pkg/controller/common	~50	Client methods (Exists/Get/Create/Update/UpdateWithRetry/Patch/StatusUpdate), HandleReconcileResult (3 branches), 6 validation functions, utility functions
pkg/controller/trustmanager	~30	managedAnnotationsModified, addFinalizer/removeFinalizer error branches, updateStatus retry logic, containerPortsMatch, readinessProbeModified, webhook rules and AdmissionReviewVersions drift
pkg/controller/istiocsr	~17	Network policy CRUD (6 scenarios), validateIstioCSRConfig (5 branches), updateCondition (4 branches)
pkg/features	~6	IsIstioCSRFeatureGateEnabled, SetupWithFlagValue invalid flag
pkg/operator/operatorclient	~13	GetOperatorState, EnsureFinalizer, RemoveFinalizer, ApplyOperatorStatus, GetUnsupportedConfigOverrides
pkg/operator	~8	buildCacheObjectList, addControllerCacheConfig, findExistingCacheEntry

Bug found

pkg/controller/istiocsr/utils.go:484 - updateCondition aggregates {err, errUpdate} instead of {prependErr, errUpdate}, losing the original reconcile error when both the reconcile and the status update fail. The http01proxy version of the same function correctly uses prependErr. A test documents this bug.

Test plan

• All 638 tests pass across affected packages
• make lint passes (no new lint issues in test files)
• No production code modified

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a155fd92-5e51-48a9-a25b-0e6e274fad6b

📥 Commits

Reviewing files that changed from the base of the PR and between 8cedfe4 and 6d84e2f.

📒 Files selected for processing (2)

• pkg/controller/istiocsr/utils_test.go
• pkg/controller/trustmanager/utils_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

Walkthrough

The pull request adds unit and reconciliation tests for cert-manager controllers, shared utilities, feature gates, operator state handling, and controller cache configuration.

Changes

Controller and operator test coverage

Layer / File(s)	Summary
Cert-manager controller behavior tests pkg/controller/certmanager/*_test.go	Tests cover network policy validation and construction, default CertManager creation, deployment log-level arguments, unsupported argument overrides, and related image selection.
Shared validation and reconciliation tests pkg/controller/common/utils_test.go, pkg/controller/istiocsr/utils_test.go, pkg/controller/trustmanager/*_test.go, pkg/features/features_test.go	Tests cover object name updates, YAML decoding, IstioCSR configuration validation, managed annotation changes, webhook drift correction, and feature gate handling.
Operator state and lifecycle tests pkg/operator/operatorclient/operatorclient_test.go	Tests cover override parsing, operator state retrieval, finalizer addition and removal, status creation, error handling, and unchanged-status patch suppression.
Controller cache configuration tests pkg/operator/setup_manager_test.go	Tests cover cache resource selectors, selector merging, disabled controllers, cache entry lookup, and label matching.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 6d84e

This change adds unit-test coverage without modifying production behavior, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: swghosh, bharath-b-rh

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.30% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed files use Go testing and t.Run with static table-case names; no Ginkgo It, Describe, Context, When, or dynamic Ginkgo titles were introduced.
Test Structure And Quality	✅ Passed	The PR adds standard Go testing/testify tests only; the diff has no Ginkgo It blocks, lifecycle hooks, Eventually, Consistently, or cluster waits, so this Ginkgo-specific check is inapplicable.
Microshift Test Compatibility	✅ Passed	The PR adds only Go unit tests using standard Test(t *testing.T) functions; no new Ginkgo e2e tests or MicroShift-incompatible test references were found.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds only Go testing.T unit tests; no Ginkgo e2e tests, topology checks, node scheduling, or multi-node assumptions were introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only *_test.go files; no production code or manifests changed, and added lines contain no scheduling constraints or topology-specific selectors.
Ote Binary Stdout Contract	✅ Passed	The diff changes only *_test.go files; outlines show no init, TestMain, or suite hooks, and added-line scans found no fmt/log/klog/stdout writes. Test-case output is exempt.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff adds only standard Go unit tests; it adds no Ginkgo e2e tests, IPv4 assumptions, IP parsing, network calls, downloads, or image pulls.
No-Weak-Crypto	✅ Passed	The PR changes only test files; added-line and changed-file searches found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The PR diff adds or modifies only Go test files; it adds no manifests or privilege-related fields such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds tests only; no application logging or sensitive fixtures were introduced. Test failures report static fake values, Kubernetes names, and public image references.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding unit tests across the codebase to address coverage gaps.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign swghosh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

pkg/controller/certmanager/deployment_helper_test.go (1)

946-1377: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Triplicated informer/watch-reactor setup across three tests.

TestGetOverrideArgsFor, TestGetOverrideEnvFor, and TestGetOverridePodLabelsFor each re-implement the same ~90-line fake-clientset/watch-reactor/informer/channel setup and create-wait-assert-delete-wait loop. Extracting a shared helper would remove significant duplication and make future additions (e.g., a 4th override type) cheaper.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/certmanager/deployment_helper_test.go` around lines 946 -
1377, The three override tests duplicate identical informer setup and
create/delete event synchronization. Extract the shared fake client, watch
reactor, informer, event channel, and test-case execution loop into a reusable
helper, then have TestGetOverrideArgsFor, TestGetOverrideEnvFor, and
TestGetOverridePodLabelsFor provide only their test data and override assertion
logic while preserving existing error and cleanup behavior.

pkg/controller/certmanager/related_images_test.go (1)

68-69: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer t.Setenv over os.Setenv/defer os.Unsetenv.

t.Setenv auto-restores the env var even on failure and is the idiomatic Go testing pattern for this.

♻️ Example for one case

-			os.Setenv("RELATED_IMAGE_CERT_MANAGER_WEBHOOK", tt.envVarValue)
-			defer os.Unsetenv("RELATED_IMAGE_CERT_MANAGER_WEBHOOK")
+			t.Setenv("RELATED_IMAGE_CERT_MANAGER_WEBHOOK", tt.envVarValue)

Also applies to: 99-100, 130-131, 141-142

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/certmanager/related_images_test.go` around lines 68 - 69,
Replace the os.Setenv/defer os.Unsetenv calls in the related image test cases
with t.Setenv, including the cases around the existing environment-variable
setup blocks, so each test automatically restores
RELATED_IMAGE_CERT_MANAGER_WEBHOOK.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/controller/istiocsr/utils_test.go`:
- Around line 199-211: Remove the non-asserting checkBuggyAggregate logging
block, or replace it with a real assertion that verifies the aggregate includes
“original reconcile error” when prependErr is set and the status update fails.
Keep the existing wantErrMsg validation as the primary regression check and
eliminate misleading t.Log-only behavior.

---

Nitpick comments:
In `@pkg/controller/certmanager/deployment_helper_test.go`:
- Around line 946-1377: The three override tests duplicate identical informer
setup and create/delete event synchronization. Extract the shared fake client,
watch reactor, informer, event channel, and test-case execution loop into a
reusable helper, then have TestGetOverrideArgsFor, TestGetOverrideEnvFor, and
TestGetOverridePodLabelsFor provide only their test data and override assertion
logic while preserving existing error and cleanup behavior.

In `@pkg/controller/certmanager/related_images_test.go`:
- Around line 68-69: Replace the os.Setenv/defer os.Unsetenv calls in the
related image test cases with t.Setenv, including the cases around the existing
environment-variable setup blocks, so each test automatically restores
RELATED_IMAGE_CERT_MANAGER_WEBHOOK.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 695c0df9-44c0-4988-8185-da9798463447

📥 Commits

Reviewing files that changed from the base of the PR and between 849995e and 9beb5eb.

📒 Files selected for processing (18)

• pkg/controller/certmanager/cert_manager_networkpolicy_test.go
• pkg/controller/certmanager/default_cert_manager_controller_test.go
• pkg/controller/certmanager/deployment_helper_test.go
• pkg/controller/certmanager/deployment_log_level_test.go
• pkg/controller/certmanager/deployment_overrides_test.go
• pkg/controller/certmanager/related_images_test.go
• pkg/controller/common/client_test.go
• pkg/controller/common/reconcile_result_test.go
• pkg/controller/common/utils_test.go
• pkg/controller/common/validation_test.go
• pkg/controller/istiocsr/networkpolicies_test.go
• pkg/controller/istiocsr/utils_test.go
• pkg/controller/trustmanager/deployments_test.go
• pkg/controller/trustmanager/utils_test.go
• pkg/controller/trustmanager/webhooks_test.go
• pkg/features/features_test.go
• pkg/operator/operatorclient/operatorclient_test.go
• pkg/operator/setup_manager_test.go

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26153 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Full-codebase unit test audit identified 42 coverage gaps across 12 packages. This PR addresses the high and medium priority gaps, adding 3,337 lines of new test code across 18 files (11 new, 7 modified) without touching any production code.

New test coverage by package

Package	New Tests	What is Covered
pkg/controller/certmanager	~50	Network policy validation, default CertManager controller, log level hook, deployment helper overrides (args/env/labels), unsupported overrides invalid JSON, related images for all operands
pkg/controller/common	~50	Client methods (Exists/Get/Create/Update/UpdateWithRetry/Patch/StatusUpdate), HandleReconcileResult (3 branches), 6 validation functions, utility functions
pkg/controller/trustmanager	~30	managedAnnotationsModified, addFinalizer/removeFinalizer error branches, updateStatus retry logic, containerPortsMatch, readinessProbeModified, webhook rules and AdmissionReviewVersions drift
pkg/controller/istiocsr	~17	Network policy CRUD (6 scenarios), validateIstioCSRConfig (5 branches), updateCondition (4 branches)
pkg/features	~6	IsIstioCSRFeatureGateEnabled, SetupWithFlagValue invalid flag
pkg/operator/operatorclient	~13	GetOperatorState, EnsureFinalizer, RemoveFinalizer, ApplyOperatorStatus, GetUnsupportedConfigOverrides
pkg/operator	~8	buildCacheObjectList, addControllerCacheConfig, findExistingCacheEntry

Bug found

pkg/controller/istiocsr/utils.go:484 - updateCondition aggregates {err, errUpdate} instead of {prependErr, errUpdate}, losing the original reconcile error when both the reconcile and the status update fail. The http01proxy version of the same function correctly uses prependErr. A test documents this bug.

Test plan

• All 638 tests pass across affected packages
• make lint passes (no new lint issues in test files)
• No production code modified

Summary by CodeRabbit

• Tests
• Expanded automated coverage for CertManager network policy generation/validation, default CertManager creation, deployment overrides/log level handling, and related image overrides.
• Expanded reconciliation tests for IstioCSR and TrustManager, including network policy create/update flows, readiness/probe logic, webhook drift patching, and finalizer/status handling.
• Added shared controller test coverage for client wrappers, reconcile result/condition behavior, and common validation/encoding utilities.
• Added feature gate and cache configuration tests, plus improved Operator client tests for overrides, finalizers, and status application.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

pkg/controller/istiocsr/networkpolicies_test.go (1)

75-208: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a test case for istioCSRCreateRecon: true.

Every case in TestCreateOrUpdateNetworkPolicy leaves istioCSRCreateRecon at its zero value (false). Add a case with istioCSRCreateRecon: true to cover the reconciliation-creation code path of createOrUpdateNetworkPolicy, if that flag affects behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/istiocsr/networkpolicies_test.go` around lines 75 - 208, Add a
table entry in TestCreateOrUpdateNetworkPolicy with istioCSRCreateRecon set to
true, configuring the fake client and assertions to exercise the
reconciliation-creation path of createOrUpdateNetworkPolicy. Verify the expected
create/update behavior for this flag while preserving the existing cases.

pkg/controller/common/client_test.go (1)

143-231: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider extracting the shared mockClient/mockStatusClient test doubles.

The graph context shows an essentially identical mockClient/mockStatusClient pair (same Get, Create, Update, Delete, List, Patch, Status structure) already exists in pkg/controller/certmanager/deployment_helper_test.go. Duplicating this scaffolding across packages increases the maintenance burden: any change to the client.Client interface signature requires updating every copy.

Move mockClient and mockStatusClient into a shared internal test helper package (for example pkg/controller/common/testutil or a small fakes package) that both pkg/controller/certmanager and pkg/controller/common tests import.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/common/client_test.go` around lines 143 - 231, Extract the
duplicated mockClient and mockStatusClient implementations from
pkg/controller/common and certmanager tests into a shared internal test helper
or fakes package. Export the helper types and preserve their configurable
callbacks and Client/Status method behavior, then update newCtrlClient and both
test suites to use the shared definitions and remove the local copies.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/controller/certmanager/deployment_helper_test.go`:
- Around line 950-1015: Refactor TestGetOverrideArgsFor, TestGetOverrideEnvFor,
and TestGetOverridePodLabelsFor to reuse setupSyncedFakeCertManagerInformer and
withFakeCertManagerForTest instead of creating watchers, event handlers, and
create/delete flows inline. Remove the duplicated informer setup and channel
handling, preserving each test’s existing assertions and test data while relying
on the helpers’ checked AddEventHandler registration and tombstone-safe
DeleteFunc.

In `@pkg/operator/operatorclient/operatorclient_test.go`:
- Around line 124-126: Update the test comparison around json.Marshal to check
both error returns immediately, failing the test with the relevant error before
comparing got and want. Do not discard marshal errors, while preserving the
existing JSON string comparison in operatorclient tests.

---

Nitpick comments:
In `@pkg/controller/common/client_test.go`:
- Around line 143-231: Extract the duplicated mockClient and mockStatusClient
implementations from pkg/controller/common and certmanager tests into a shared
internal test helper or fakes package. Export the helper types and preserve
their configurable callbacks and Client/Status method behavior, then update
newCtrlClient and both test suites to use the shared definitions and remove the
local copies.

In `@pkg/controller/istiocsr/networkpolicies_test.go`:
- Around line 75-208: Add a table entry in TestCreateOrUpdateNetworkPolicy with
istioCSRCreateRecon set to true, configuring the fake client and assertions to
exercise the reconciliation-creation path of createOrUpdateNetworkPolicy. Verify
the expected create/update behavior for this flag while preserving the existing
cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1bdc7251-3f53-4af1-bbe9-62ef5e2e8fa0

📥 Commits

Reviewing files that changed from the base of the PR and between f945972 and 25a087d.

📒 Files selected for processing (18)

• pkg/controller/certmanager/cert_manager_networkpolicy_test.go
• pkg/controller/certmanager/default_cert_manager_controller_test.go
• pkg/controller/certmanager/deployment_helper_test.go
• pkg/controller/certmanager/deployment_log_level_test.go
• pkg/controller/certmanager/deployment_overrides_test.go
• pkg/controller/certmanager/related_images_test.go
• pkg/controller/common/client_test.go
• pkg/controller/common/reconcile_result_test.go
• pkg/controller/common/utils_test.go
• pkg/controller/common/validation_test.go
• pkg/controller/istiocsr/networkpolicies_test.go
• pkg/controller/istiocsr/utils_test.go
• pkg/controller/trustmanager/deployments_test.go
• pkg/controller/trustmanager/utils_test.go
• pkg/controller/trustmanager/webhooks_test.go
• pkg/features/features_test.go
• pkg/operator/operatorclient/operatorclient_test.go
• pkg/operator/setup_manager_test.go

🚧 Files skipped from review as they are similar to previous changes (12)

• pkg/controller/certmanager/deployment_overrides_test.go
• pkg/features/features_test.go
• pkg/controller/certmanager/default_cert_manager_controller_test.go
• pkg/controller/trustmanager/webhooks_test.go
• pkg/controller/trustmanager/deployments_test.go
• pkg/operator/setup_manager_test.go
• pkg/controller/common/reconcile_result_test.go
• pkg/controller/trustmanager/utils_test.go
• pkg/controller/certmanager/related_images_test.go
• pkg/controller/common/utils_test.go
• pkg/controller/certmanager/deployment_log_level_test.go
• pkg/controller/istiocsr/utils_test.go

[sebrandon1]

/retest

[sebrandon1]

/retest

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-26153 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

Jira: CNF-26153

Full-codebase unit test audit identified 42 coverage gaps across 12 packages. This PR addresses the high and medium priority gaps, adding 3,337 lines of new test code across 18 files (11 new, 7 modified) without touching any production code.

New test coverage by package

Package	New Tests	What is Covered
pkg/controller/certmanager	~50	Network policy validation, default CertManager controller, log level hook, deployment helper overrides (args/env/labels), unsupported overrides invalid JSON, related images for all operands
pkg/controller/common	~50	Client methods (Exists/Get/Create/Update/UpdateWithRetry/Patch/StatusUpdate), HandleReconcileResult (3 branches), 6 validation functions, utility functions
pkg/controller/trustmanager	~30	managedAnnotationsModified, addFinalizer/removeFinalizer error branches, updateStatus retry logic, containerPortsMatch, readinessProbeModified, webhook rules and AdmissionReviewVersions drift
pkg/controller/istiocsr	~17	Network policy CRUD (6 scenarios), validateIstioCSRConfig (5 branches), updateCondition (4 branches)
pkg/features	~6	IsIstioCSRFeatureGateEnabled, SetupWithFlagValue invalid flag
pkg/operator/operatorclient	~13	GetOperatorState, EnsureFinalizer, RemoveFinalizer, ApplyOperatorStatus, GetUnsupportedConfigOverrides
pkg/operator	~8	buildCacheObjectList, addControllerCacheConfig, findExistingCacheEntry

Bug found

pkg/controller/istiocsr/utils.go:484 -- updateCondition aggregates {err, errUpdate} instead of {prependErr, errUpdate}, losing the original reconcile error when both the reconcile and the status update fail. The http01proxy version of the same function correctly uses prependErr. A test documents this bug.

Test plan

• All 638 tests pass across affected packages
• make lint passes (no new lint issues in test files)
• No production code modified

Summary by CodeRabbit

• Tests
• Expanded automated coverage for certificate manager configuration, network policies, deployments, image overrides, and default resource creation.
• Added validation tests for Istio CSR settings, feature gates, annotations, webhook reconciliation, and shared controller utilities.
• Added operator client and cache-management tests covering status updates, finalizers, configuration overrides, and cache behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@sebrandon1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator-tech-preview	2821c01	link	false	/test e2e-operator-tech-preview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.