TLS propagation test

pkg/testsuites/standard_suites.go

@@ -478,6 +478,23 @@ var staticSuites = []ginkgo.TestSuite{
 		TestTimeout:                40 * time.Minute,
 		ClusterStabilityDuringTest: ginkgo.Disruptive,
 	},
+	{
+		Name: "openshift/tls-observed-config",
+		Description: templates.LongDesc(`
+		Tests that verify TLS configuration is properly propagated from the cluster
+		APIServer to operator workloads. This includes ObservedConfig verification,
+		deployment env var checks, and wire-level TLS enforcement for services that
+		adopt the TLS config sync pattern (e.g. image-registry, controller-manager).
+		The suite includes a disruptive config-change test that switches the cluster
+		to Modern TLS profile and validates all targets.
+		`),
+		Qualifiers: []string{
+			withStandardEarlyOrLateTests(`name.contains("[Suite:openshift/tls-observed-config]")`),
+		},
+		Parallelism:                1,
+		TestTimeout:                40 * time.Minute,
+		ClusterStabilityDuringTest: ginkgo.Disruptive,
+	},
 }
 
 func withExcludedTestsFilter(baseExpr string) string {

test/extended/include.go

@@ -57,6 +57,7 @@ import (
 	_ "github.com/openshift/origin/test/extended/storage"
 	_ "github.com/openshift/origin/test/extended/tbr_health"
 	_ "github.com/openshift/origin/test/extended/templates"
+	_ "github.com/openshift/origin/test/extended/tls"
 	_ "github.com/openshift/origin/test/extended/two_node"
 	_ "github.com/openshift/origin/test/extended/user"
 	_ "github.com/openshift/origin/test/extended/windows"

test/extended/tls/OWNERS

@@ -0,0 +1,13 @@
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+
+reviewers:
+  - ricardomaraschini
+  - ingvagabund
+  - gangwgr
+  - kaleemsiddiqu
+
+approvers:
+  - ricardomaraschini
+  - ingvagabund
+  - gangwgr
+  - kaleemsiddiqu