Integration tests: check reboot with boot ID, test Ingress resolvability, wait for image committed

[Jakob-Naucke]

• Waiting for SSH unavailability is unreliable when the reboot is fast. Instead, check for SSH availability and a changed boot ID.
• openshift: Test resolvability of ingress and retry up to 3 times. Also bump timeout for creation.
• Wait for ApprovedImage to be Committed to catch early if it wasn't committed, which would lead to Trustee
  failures later

First two commits assisted by AI.

Summary by Sourcery

Improve integration test reliability around VM reboot behavior, OpenShift ingress exposure, and ApprovedImage readiness.

New Features:

• Add DNS resolvability checks with retries when exposing OpenShift services via LoadBalancer.
• Add a boot ID retrieval helper for VM backends to verify reboots in tests.
• Add a test wait step for the ApprovedImage resource to reach the Committed condition before proceeding.

Enhancements:

• Increase OpenShift ingress creation timeout and introduce multiple exposure attempts with fallback to ClusterIP.
• Replace SSH unavailability-based reboot detection with boot ID change verification in VM reboot-related tests.
• Rename the trustee ConfigMap reference in trusted execution cluster tests to use the trustee-rv-data name.

Tests:

• Tighten integration tests to depend on ApprovedImage being committed and on verified VM reboot via boot ID rather than transient SSH failures.

[sourcery-ai]

Reviewer's Guide

Integration test reliability improvements: VM reboot detection now uses boot IDs instead of SSH unavailability, OpenShift ingress exposure includes DNS resolvability retries and longer timeouts, and cluster tests wait for ApprovedImage to reach Committed state to avoid later Trustee failures.

File-Level Changes

Change	Details	Files
Make OpenShift service exposure more robust by retrying LoadBalancer/ingress creation and verifying DNS resolvability before proceeding.	Introduce EXPOSE_MAX_ATTEMPTS constant and use a loop to attempt LoadBalancer exposure up to three times. Use await_condition with an increased timeout to wait for Service load balancer ingress and fall back to ClusterIP on failure. Resolve the OpenShift host once per successful attempt and use Poller with lookup_host to ensure hostname is DNS-resolvable. Propagate the resolved host into certificate patching logic instead of re-fetching URL.	test_utils/src/lib.rs
Add a wait for ApprovedImage to reach Committed condition before continuing TEC-related tests.	Expose APPROVED_IMAGE_NAME constant for reuse in tests. Import Condition, ApprovedImageStatus, and COMMITTED_CONDITION to inspect ApprovedImage status conditions. Create an await_condition-based helper closure that checks for COMMITTED_CONDITION with status True on the ApprovedImage resource. Use a 300-second scaled timeout around the ApprovedImage condition wait and return early on failure.	test_utils/src/lib.rs
Change VM reboot-related SSH checks to rely on boot ID changes instead of transient SSH unavailability.	Add get_boot_id method to VmBackend that reads /proc/sys/kernel/random/boot_id via SSH. Refactor wait_for_vm_ssh_ready to accept an optional previous boot ID, polling until SSH is available and the boot ID changes if provided. Remove wait_for_vm_ssh_unavail helper and the generic wait_for_vm_ssh implementation that toggled on availability/unavailability. Update attestation and reboot tests to capture the current boot ID before issuing reboot, then call wait_for_vm_ssh_ready with that ID and adjust expectations accordingly.	test_utils/src/virt/mod.rs tests/attestation.rs
Align trusted execution cluster tests with new resource names and image constants.	Replace TRUSTEE_CONFIG_MAP constant with TRUSTEE_RV_MAP to reflect updated ConfigMap naming. Remove duplicate APPROVED_IMAGE_NAME constant from the TEC test file in favor of the shared constant from test_utils. Ensure imports and references in TEC tests match the new naming and image handling.	tests/trusted_execution_cluster.rs test_utils/src/lib.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• There are now two different APPROVED_IMAGE_NAME constants (one in test_utils and one in tests/trusted_execution_cluster.rs); consider consolidating to a single shared constant to avoid divergence or confusion if the name ever changes.
• In the OpenShift expose_service logic, repeatedly patching the Service type back and forth between LoadBalancer and ClusterIP on failures may have side effects if other code relies on the Service type; if possible, consider a less intrusive mechanism for retrying ingress/DNS resolution (e.g., leaving it as LoadBalancer and only retrying the readiness and DNS checks).

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- There are now two different APPROVED_IMAGE_NAME constants (one in test_utils and one in tests/trusted_execution_cluster.rs); consider consolidating to a single shared constant to avoid divergence or confusion if the name ever changes.
- In the OpenShift expose_service logic, repeatedly patching the Service type back and forth between LoadBalancer and ClusterIP on failures may have side effects if other code relies on the Service type; if possible, consider a less intrusive mechanism for retrying ingress/DNS resolution (e.g., leaving it as LoadBalancer and only retrying the readiness and DNS checks).

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: alicefr, Jakob-Naucke

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[alicefr]

Looks good and good idea about the boot id!