Gate cluster-dependent k8s tests behind KC_INTEGRATION_TESTS

[Copilot]

Adding or modifying a card/dashboard? Read the Card Development Guide first — it covers required patterns, common pitfalls, and the full file checklist.

New CNCF project card? New cards go in kubestellar/console-marketplace, not this repo. PRs adding new cards here will be redirected.

Use a coding agent. This repo is primarily developed with Claude Code (Opus 4.5/4.6). It knows all codebase patterns (isDemoData, useCardLoadingState, locale strings, DCO). Manual PRs that miss required patterns will be sent back.

📌 Fixes

Issue linkage is handled automatically by the system.

---

📝 Summary of Changes

Tests in k8s-related packages were executing live in-cluster API paths when KUBERNETES_SERVICE_HOST was present, causing RBAC-forbidden failures in restricted CI environments. This change makes those tests explicitly opt-in as integration tests via KC_INTEGRATION_TESTS=1.

• Integration test gating
  • Added a guard at the top of each affected test:
    • pkg/k8s/gateway_test.go (TestListGateways, TestListHTTPRoutes)
    • pkg/k8s/client/client_test.go (TestGetAllClusterHealth)
    • pkg/k8s/rbac_extra_test.go (TestGetAllClusterPermissions, TestGetAllPermissionsSummaries)
    • pkg/k8s/workload_scaling_test.go (TestGetClusterCapabilities)
    • pkg/stellar/observer/observer_event_test.go (TestFetchResourceStateNodeWithConditions)
• Behavioral outcome
  • Default CI runs skip these cluster/RBAC-dependent tests unless explicitly enabled.
  • Full-permission environments can still execute them by setting KC_INTEGRATION_TESTS=1.

if os.Getenv("KC_INTEGRATION_TESTS") != "1" {
    t.Skip("skipping integration test; set KC_INTEGRATION_TESTS=1 to run")
}

---

Changes Made

• Updated targeted tests to require KC_INTEGRATION_TESTS=1 before running
• Refactored ...
• Fixed CI fragility from unintended live-cluster test execution under limited RBAC
• Added tests for ...

---

Checklist

Please ensure the following before submitting your PR:

• I used a coding agent (Claude Code, Copilot, Gemini, or Codex) to generate/review this code
• I have reviewed the project's contribution guidelines
• New cards target console-marketplace, not this repo
• isDemoData is wired correctly (cards show Demo badge when using demo data)
• I have written unit tests for the changes (if applicable)
• I have tested the changes locally and ensured they work as expected
• All commits are signed with DCO (git commit -s)

---

Screenshots or Logs (if applicable)

N/A (test-only change).

---

👀 Reviewer Notes

• This is intentionally minimal and limited to gating only the known cluster-dependent tests called out in the issue.
• No production code paths were changed.

Original prompt

Fix issue #17895: k8s package tests lack mock infrastructure and fail without cluster RBAC.

The failing tests (TestListGateways, TestListHTTPRoutes, TestGetAllClusterHealth, TestGetAllClusterPermissions, TestGetAllPermissionsSummaries, TestGetClusterCapabilities, TestFetchResourceStateNodeWithConditions) detect real KUBERNETES_SERVICE_HOST and attempt live API calls.

They pass only when running in a pod with broad cluster-admin RBAC. In CI environments without full cluster RBAC, these tests fail with permission errors like:
"gateways.gateway.networking.k8s.io is forbidden: User "system:serviceaccount:..." cannot list resource"

Solution: Gate integration tests behind KC_INTEGRATION_TESTS=1 environment variable check. Tests should skip gracefully in CI environments without the env var set using t.Skip() at the beginning of each affected test function.

Failing tests to fix:

1. pkg/k8s/gateway_test.go - TestListGateways, TestListHTTPRoutes
2. pkg/k8s/client/client_health_test.go - TestGetAllClusterHealth
3. pkg/k8s/client/client_clusters_test.go or rbac_permissions_test.go - TestGetAllClusterPermissions, TestGetAllPermissionsSummaries
4. pkg/k8s/workload_scaling_test.go - TestGetClusterCapabilities
5. pkg/k8s/dependencies_extract_test.go or similar - TestFetchResourceStateNodeWithConditions

Each test should start with:

if os.Getenv("KC_INTEGRATION_TESTS") != "1" {
    t.Skip("skipping integration test; set KC_INTEGRATION_TESTS=1 to run")
}

This approach is minimally invasive (single skip check at start) and allows tests to run in full-permission environments while gracefully skipping in restricted CI.

[netlify]

❌ Deploy Preview for kubestellarconsole failed. Why did it fail? →

Name	Link
🔨 Latest commit	f132e1d
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6a2b7b59a483d20008b7b189

[github-actions]

👋 Hey @Copilot — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[kubestellar-prow]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• d8d6897 Initial plan
• f132e1d 🐛 Gate cluster-dependent k8s tests behind KC_INTEGRATION_TESTS

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from clubanderson. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Status Check

This draft PR appears to be stalled with no activity since creation (~2h20m ago). This check ran outside business hours (05:43 UTC), so human follow-up when the team is online is fine.

Current status:

• Build: ❌ FAILING (build (ubuntu/mac/win/arm), go test ./..., fullstack-smoke, Verify console starts successfully, pr-check)
• Netlify: ❌ FAILING (redirect/header/pages checks)
• Merge state: ❌ DIRTY (needs rebase onto main)
• DCO signoff: ❌ Missing (dco-signoff: no)
• Review: Not approved

Known blockers:

1. Needs rebase — the PR branch is dirty and has conflicts with main. A rebase is required.
2. DCO signoff missing — commits d8d6897 and f132e1d lack Signed-off-by.
3. Build/test failures — go test ./... and multi-platform builds are failing. May be related to the rebase conflicts or base branch state.

Recommended next steps:

• A human maintainer should check whether this PR's changes are still valid after the rebase conflicts are resolved.
• If the base branch now has conflicting changes for the same test files, this PR may need to be reworked.
• DCO signoff must be added to all commits.

Generated by Stuck Detection Workflow · 202.2 AIC · ⌖ 12.6 AIC · ⊞ 35.9K · ◷

[kubestellar-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Status Check (Follow-Up)

Item: PR #17909 — Gate cluster-dependent k8s tests behind KC_INTEGRATION_TESTS
Last stuck-detection comment: 2026-06-12T05:47Z (~6h 52m ago)
Last activity: 2026-06-12T08:04Z (prow rebase notice — no human/commit activity since)
Total stuck duration: ~9.5 hours

Current State

Area	Status
Netlify deploy	❌ Failed
Build (go, fullstack-smoke, pr-check)	❌ Failing
DCO sign-off	❌ Missing on 2 commits (d8d6897, f132e1d)
Rebase	❌ Needs rebase (needs-rebase label, prow flagged at 08:04Z)
Review / LGTM	❌ None
Draft → Ready	❌ Still draft

No new commits or human activity have occurred since the last status check (~6h 52m ago). The PR remains blocked on rebase, DCO, and build failures.

Recommended Next Steps

• A human maintainer should check whether this PR's gating approach is still valid given any changes to the test files since it was created
• Rebase the branch onto main to resolve merge conflicts
• Add DCO Signed-off-by: trailers to both commits (d8d6897 and f132e1d)
• Investigate whether build/test failures are pre-existing or introduced by this PR's changes

Generated by Stuck Detection Workflow · 174 AIC · ⌖ 13.6 AIC · ⊞ 35.9K · ◷

[github-actions]

Status Check (Follow-Up)

Item: PR #17909 — Gate cluster-dependent k8s tests behind KC_INTEGRATION_TESTS
Last stuck-detection comment: ~2026-06-12T12:43Z (~3h ago)
Last activity: 2026-06-12T12:43Z — no human or commit activity since
Stuck duration: ~12h since PR opened at 03:17 UTC

Current State

Area	Status
Netlify deploy	❌ Failed
DCO sign-off	❌ Missing on 2 commits (d8d6897, f132e1d)
Rebase	❌ needs-rebase — branch is behind main
Review / LGTM	❌ None

Recommended Next Steps

A human maintainer should:

1. Review the Netlify deploy failure logs — this PR gates k8s integration tests behind KC_INTEGRATION_TESTS; check if the gating logic conflicts with anything merged to main after this PR was opened
2. Rebase the branch onto main
3. Add DCO sign-off to both commits (git commit --amend -s)
4. Resolve the deploy failure, then mark ready for review

Generated by Stuck Detection Workflow · 348.4 AIC · ⌖ 12.7 AIC · ⊞ 35.9K · ◷

[github-actions]

Status Check

This draft PR appears to be stalled and requires human intervention.

Stuck since: 2026-06-12T03:17Z (≈ 14 hours)
Current state: Draft, no recent commits

Blockers identified:

• needs-rebase — the branch is behind main and must be rebased before CI can pass
• dco-signoff: no — commits are missing the DCO Signed-off-by trailer

Build/Review:

• Build: failing (needs rebase first)
• Review: Not approved

Recommended next steps for a human maintainer:

1. Rebase the branch on latest main
2. Amend commits to add DCO sign-off (git commit --amend -s)
3. Force-push and convert from draft when ready for review

Generated by Stuck Detection Workflow · 309.4 AIC · ⌖ 12.7 AIC · ⊞ 35.9K · ◷

[github-actions]

Status Check — Still Stuck (~16 hours)

This draft PR remains stalled with no progress since creation.

Current blockers:

• needs-rebase — branch is behind main
• dco-signoff: no — commits are missing Signed-off-by trailers (DCO required)
• Not approved — awaiting review

State: Draft · Not merged · ai-needs-human already applied

Recommended next steps: A human maintainer should review this PR and either:

1. Close it if the fix is no longer needed, or
2. Rebase onto main, add DCO sign-off, and route for review

Note: Current time is outside business hours (UTC). Follow-up when the team is online is fine.

Generated by Stuck Detection Workflow · 195.2 AIC · ⌖ 13 AIC · ⊞ 35.9K · ◷

[kubestellar-hive]

Closing: stale needs-rebase PR with WIP/DCO failures. Per #18190, these have been sitting without progress and should be re-opened with a fresh branch if still needed.