MCO-2541: Add no-reboot assertion to kubelet TLS upgrade test and move test from disruptive to serial

[machine424]

The TLS drop-in change (openshift/machine-config-operator#6426) makes KubeletConfig TLS profile changes trigger a kubelet restart instead of a full node reboot. Static pods with TLS args baked in their manifests (e.g. crio metrics proxy) are also recreated by kubelet. No drain occurs.

Assert that the node BootID remains unchanged after the MCP rollout completes.

Also move the test from [Disruptive] to [Serial] since the operation no longer reboots the node or drains workloads.

requires openshift-eng/ci-test-mapping#824

Summary by CodeRabbit

• Tests
  • Updated kubelet TLS validation to ensure configuration changes do not reboot the node.
  • Improved test scheduling and status reporting to account for expected kubelet and static-pod restarts.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 540a00fe-65d1-473d-894c-a6b2a25cf5cb

📥 Commits

Reviewing files that changed from the base of the PR and between 6e93454 and 780cc13.

📒 Files selected for processing (1)

• test/extended/node/kubeletconfig_tls.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The kubelet TLS test now runs serially, records the node BootID before configuration, and verifies that the BootID remains unchanged after the rollout.

Changes

Kubelet TLS validation

Layer / File(s)	Summary
TLS rollout reboot check test/extended/node/kubeletconfig_tls.go	The test metadata documents kubelet and static-pod restarts during MCP rollout. The test records the initial BootID and asserts that the TLS upgrade completes without a node reboot.

Estimated code review effort: 3 (Moderate) | ~15 minutes

Merge Risk: ⚪ Minimal · up to 780cc

This localized test change adds coverage for the no-reboot behavior and has no actionable merge-blocking risk beyond completing normal repository checks.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The added framework.Logf emits testNode (the internal worker node name) and originalBootID; the new assertion also includes both BootIDs in failure output.	Do not log node names or BootIDs. Use identifier-free messages, such as a boolean unchanged result and a generic reboot assertion message.
Test Structure And Quality	⚠️ Warning	The PR adds o.Expect(err).NotTo(o.HaveOccurred()) after the BootID node Get without a failure message; this violates the assertion-message requirement.	Add a diagnostic message, such as failed to record BootID for node %s, including the node name.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff changes only static Ginkgo metadata and adds static step text; the Describe and It titles contain no runtime node, namespace, timestamp, IP, UUID, or generated value.
Microshift Test Compatibility	✅ Passed	The PR only modifies an existing test. Its MachineConfig API use remains protected by [apigroup:machineconfiguration.openshift.io], and the new BootID check uses the standard Node API.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The existing test calls skipOnSingleNodeTopology before selecting a pure worker node; the PR only adds BootID checks and changes labels, so it introduces no unguarded SNO multi-node assumption.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only a node test's Ginkgo labels, BootID checks, and log text; it adds no manifests, operator/controller code, replicas, affinity, selectors, tolerations, or PDBs.
Ote Binary Stdout Contract	✅ Passed	The diff changes only Describe metadata and code inside g.It; it introduces no main/suite-setup stdout writes, fmt.Print, klog, or os.Stdout use.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff modifies an existing test only; added BootID reads and equality checks use cluster node API, with no IPv4 literals, URL construction, or external connectivity.
No-Weak-Crypto	✅ Passed	The diff adds BootID capture and equality checks only; it introduces no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparison.
Container-Privileges	✅ Passed	The patch changes only a Go test: it adds BootID checks and changes test labels. It adds no privileged, host namespace, SYS_ADMIN, or container security settings.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a no-reboot assertion to the kubelet TLS upgrade test.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@machine424: This PR was included in a payload test run from openshift/machine-config-operator#6426
trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

[openshift-ci]

@machine424: This PR was included in a payload test run from openshift/machine-config-operator#6426
trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.1-e2e-aws-ovn-serial-1of2
• periodic-ci-openshift-release-main-nightly-5.1-e2e-aws-ovn-serial-2of2

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1a942780-9d69-11f1-968a-0fb060ceecb8-0

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

[openshift-trt]

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: 780cc13

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-1of2	High - "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]" is a new test, was only seen in one job, and failed 1 time(s) against the current commit.

New tests seen in this PR at sha: 780cc13

• "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]" [Total: 1, Pass: 0, Fail: 1, Flake: 0]

[openshift-ci]

@machine424: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial-1of2	780cc13	link	true	/test e2e-aws-ovn-serial-1of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[machine424]

/testwith openshift/origin/main/e2e-aws-ovn-serial openshift/machine-config-operator#6426

[haircommander]

/lgtm

from node team side

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, machine424

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/extended/node/OWNERS [haircommander]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[machine424]

test passed with openshift/machine-config-operator#6426 https://github.com/openshift/origin/pull/31547/checks?check_run_id=97363340021

started: 0/94/110 "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]"

passed: (1m32s) 2026-08-24T13:04:43 "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]"

/verified by CI

[openshift-ci-robot]

@machine424: This PR has been marked as verified by CI.

Details

In response to this:

test passed with openshift/machine-config-operator#6426 https://github.com/openshift/origin/pull/31547/checks?check_run_id=97363340021

started: 0/94/110 "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]"

passed: (1m32s) 2026-08-24T13:04:43 "[sig-node][Serial] Kubelet TLS configuration should upgrade kubelet TLS from 1.2 to 1.3 on a custom pool [apigroup:machineconfiguration.openshift.io] [Suite:openshift/conformance/serial]"

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[machine424]

/hold

[machine424]

/retitle MCO-2541: Add no-reboot assertion to kubelet TLS upgrade test and move test from disruptive to serial

[openshift-ci-robot]

@machine424: This pull request references MCO-2541 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

The TLS drop-in change (openshift/machine-config-operator#6426) makes KubeletConfig TLS profile changes trigger a kubelet restart instead of a full node reboot. Static pods with TLS args baked in their manifests (e.g. crio metrics proxy) are also recreated by kubelet. No drain occurs.

Assert that the node BootID remains unchanged after the MCP rollout completes.

Also move the test from [Disruptive] to [Serial] since the operation no longer reboots the node or drains workloads.

requires openshift-eng/ci-test-mapping#824

Summary by CodeRabbit

• Tests
• Updated kubelet TLS validation to ensure configuration changes do not reboot the node.
• Improved test scheduling and status reporting to account for expected kubelet and static-pod restarts.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.