CI run 28794778739 caught two race conditions in the render-side
Monitoring OIDC bats:
- `Grafana CR carries auth.generic_oauth pointing at the cozy realm`
(monitoring-oidc-system.bats:86) failed with `enabled=` empty after
a 0-second wait. The prior `until kubectl get grafana grafana`
only proved the CR EXISTS — it did not prove grafana-operator had
reconciled the mode=System values onto it. When the CR from the
previous `Monitoring CR accepts spec.oidc.mode=System` test was
already there but the operator hadn't yet flipped `.spec.config.auth
.generic_oauth.enabled` to "true", the jsonpath returned empty and
`[ "" = "true" ]` short-circuited the whole test.
- `secretRef variant mounts operator Secret under /etc/grafana/oidc`
(monitoring-oidc-customconfig.bats:119) timed out at 180s waiting
for the volumeMount swap from inline → ini. On a warm sandbox the
full inner-HR upgrade + grafana-operator reconcile cycle can
legitimately take >3m — the timeout was too tight.
Fix: replace `until kubectl get grafana` with `until [ "$(kubectl
... jsonpath=<target-field>)" = <expected> ]` on every subsequent
assertion, and bump the secretRef-swap window to 600s (well inside
the inner HR's 15m timeout). Same pattern used for the "no
role_attribute_path" and "operator payload verbatim" assertions so
the whole suite is race-free.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
IvanHunters
7f9e1a8bf6