Skip to content

feat: Add configurable Ingress hostname template for non-OpenShift cluster#1757

Open
osmman wants to merge 1 commit into
mainfrom
tturek/SECURESIGN-3862
Open

feat: Add configurable Ingress hostname template for non-OpenShift cluster#1757
osmman wants to merge 1 commit into
mainfrom
tturek/SECURESIGN-3862

Conversation

@osmman
Copy link
Copy Markdown
Collaborator

@osmman osmman commented Apr 29, 2026

Introduces --ingress-host-template flag (INGRESS_HOST_TEMPLATE env var) to control default Ingress hostnames on non-OpenShift clusters. The default "%[1]s.local" preserves existing behavior. CI is configured with "%[1]s.%[2]s.traefik.me" to produce namespace-unique hostnames, eliminating Ingress hostname collisions between e2e test namespaces that caused Konflux pipeline timeouts.

Refs: SECURESIGN-3862

@qodo-code-review
Copy link
Copy Markdown

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

@osmman osmman force-pushed the tturek/SECURESIGN-3862 branch 2 times, most recently from 14ad068 to 7394be9 Compare April 29, 2026 13:40
@osmman osmman added enhancement New feature or request Tests labels Apr 30, 2026
@osmman osmman requested review from JasonPowr and bouskaJ May 4, 2026 11:55
@osmman
Copy link
Copy Markdown
Collaborator Author

osmman commented May 4, 2026

/agentic_review

@osmman osmman marked this pull request as draft May 4, 2026 15:34
@osmman osmman marked this pull request as ready for review May 4, 2026 15:35
@qodo-for-securesign
Copy link
Copy Markdown

qodo-for-securesign Bot commented May 4, 2026

Review Summary by Qodo

(Agentic_describe updated until commit 4e3f148)

Add configurable Ingress hostname template for non-OpenShift clusters

✨ Enhancement

Grey Divider

Walkthroughs

Description
• Add configurable Ingress hostname template for non-OpenShift clusters
• Default template "%[1]s.local" preserves existing behavior
• CI configured with "%[1]s.%[2]s.traefik.me" for namespace-unique hostnames
• Eliminates Ingress hostname collisions in e2e test namespaces
Diagram
flowchart LR
  A["CLI Flag & Env Var"] -->|"--ingress-host-template"| B["Config Variable"]
  B -->|"IngressHostTemplate"| C["CalculateHostname Function"]
  C -->|"fmt.Sprintf"| D["Dynamic Hostname"]
  D -->|"Service.Namespace.Domain"| E["Ingress Resource"]
Loading

Grey Divider

File Changes

1. cmd/main.go ✨ Enhancement +3/-0

Add ingress hostname template CLI flag

• Added --ingress-host-template CLI flag with INGRESS_HOST_TEMPLATE environment variable support
• Flag accepts Go fmt.Sprintf template with %[1]s for service name and %[2]s for namespace
• Includes documentation noting the flag is ignored on OpenShift clusters

cmd/main.go


2. internal/config/config.go ✨ Enhancement +1/-0

Add ingress hostname template config variable

• Added IngressHostTemplate global variable with default value "%[1]s.local"
• Preserves existing behavior while allowing runtime configuration

internal/config/config.go


3. internal/utils/kubernetes/common.go ✨ Enhancement +1/-1

Use configurable template in hostname calculation

• Modified CalculateHostname function to use configurable template for non-OpenShift clusters
• Replaced hardcoded svcName + ".local" with `fmt.Sprintf(config.IngressHostTemplate, svcName,
 ns)`
• OpenShift behavior remains unchanged

internal/utils/kubernetes/common.go


View more (4)
4. internal/utils/kubernetes/common_test.go 🧪 Tests +135/-0

Add hostname calculation unit tests

• Added comprehensive test suite for CalculateHostname function
• Tests non-OpenShift behavior with multiple template formats
• Tests OpenShift behavior with cluster domain resolution
• Tests error handling for missing cluster Ingress on OpenShift

internal/utils/kubernetes/common_test.go


5. test/e2e/custom_install/suite_test.go ✨ Enhancement +4/-0

Pass ingress template to manager pod

• Added INGRESS_HOST_TEMPLATE environment variable to manager pod configuration
• Uses support.EnvOrDefault to allow override with default "%[1]s.local"

test/e2e/custom_install/suite_test.go


6. test/e2e/support/kubernetes/olm/olm.go ✨ Enhancement +18/-6

Extract and enhance OLM subscription environment setup

• Extracted environment variable setup into new subscriptionEnv helper function
• Added logic to pass INGRESS_HOST_TEMPLATE from environment if set
• Maintains backward compatibility with existing OPENSHIFT variable

test/e2e/support/kubernetes/olm/olm.go


7. .github/workflows/main.yml ⚙️ Configuration changes +26/-5

Configure CI with namespace-scoped ingress hostnames

• Added INGRESS_HOST_TEMPLATE: '%[1]s.%[2]s.traefik.me' to workflow environment variables
• Added deployment step to configure ingress template on operator after deployment
• Removed hardcoded .local hostnames from /etc/hosts entries in multiple test jobs
• Updated e2e test to use dynamic hostnames instead of static .local entries
• Added comments explaining hostname template behavior in upgrade and base operator tests
• Simplified /etc/hosts entries to only include necessary non-Ingress services

.github/workflows/main.yml


Grey Divider

Qodo Logo

@qodo-for-securesign
Copy link
Copy Markdown

Code Review by Qodo

Grey Divider

Looking for bugs?

Check back in a few minutes. An AI review agent is analyzing this pull request.

Grey Divider

Qodo Logo

@qodo-for-securesign
Copy link
Copy Markdown

qodo-for-securesign Bot commented May 4, 2026

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

Context used

Grey Divider


Remediation recommended

1. Unvalidated hostname template 🐞 Bug ☼ Reliability
Description
CalculateHostname() formats config.IngressHostTemplate with fmt.Sprintf and returns it without
validating it is a legal hostname. A malformed template can generate an invalid Ingress host /
certificate CommonName, leading to repeated reconciliation errors until configuration is fixed.
Code

internal/utils/kubernetes/common.go[89]

+	return fmt.Sprintf(config.IngressHostTemplate, svcName, ns), nil
Evidence
On non-OpenShift clusters, CalculateHostname() now always returns
fmt.Sprintf(config.IngressHostTemplate, svcName, ns) with no validation. That value is then used
directly as the Ingress rule host (and therefore must satisfy Kubernetes hostname constraints) and
is also used as the TLS CommonName for Fulcio/TSA when ExternalAccess.Host is not set, amplifying
the blast radius of a bad template.

internal/utils/kubernetes/common.go[81-90]
internal/utils/kubernetes/ingress.go[27-33]
internal/utils/kubernetes/ingress.go[53-86]
internal/controller/fulcio/actions/generate_cert.go[287-300]
internal/controller/tsa/utils/tsa_cert_chain.go[242-253]
cmd/main.go[111-116]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`CalculateHostname()` formats a user-configurable template and returns the result without validating it as a DNS hostname. If the template is malformed or produces an invalid hostname, the operator may repeatedly fail to create/update Ingresses and may also generate certificates with invalid/unexpected CommonNames.

### Issue Context
The hostname is consumed by:
- `internal/utils/kubernetes.CreateIngress` / `EnsureIngressSpec` as `Ingress.spec.rules[0].host`
- Fulcio/TSA certificate generation when `ExternalAccess.Host` is unset

### Fix Focus Areas
- internal/utils/kubernetes/common.go[81-90]
- internal/utils/kubernetes/ingress.go[27-33]
- internal/utils/kubernetes/ingress.go[89-126]
- internal/utils/kubernetes/common_test.go[15-135]

### Suggested fix
1. In `CalculateHostname()`, after `fmt.Sprintf(...)`, validate the resulting hostname.
  - Use Kubernetes validation helpers (e.g. `k8s.io/apimachinery/pkg/util/validation.IsDNS1123Subdomain`) or equivalent.
  - If invalid, return a descriptive error like: `invalid ingress host %q computed from INGRESS_HOST_TEMPLATE=%q: %s`.
2. Add a unit test case with an invalid template (e.g. empty string, or a template that yields illegal characters / `%!` formatting artifacts) asserting that `CalculateHostname()` returns an error.

This keeps failures explicit and easier to diagnose, instead of surfacing later as repeated reconcile failures during resource creation.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Previous review results

Review updated until commit 4e3f148

Results up to commit N/A


Sorry, something went wrong


We weren't able to complete the code review on our side. Please try again


Qodo Logo

@osmman osmman force-pushed the tturek/SECURESIGN-3862 branch from 7394be9 to 4e3f148 Compare May 11, 2026 13:26
@osmman osmman marked this pull request as draft May 11, 2026 13:28
@osmman osmman assigned osmman and unassigned osmman May 11, 2026
@osmman osmman marked this pull request as ready for review May 11, 2026 13:28
@qodo-for-securesign
Copy link
Copy Markdown

qodo-for-securesign Bot commented May 11, 2026

Persistent review updated to latest commit 4e3f148

@qodo-for-securesign
Copy link
Copy Markdown

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: Execute securesign/sigstore-e2e

Failed stage: Run tests [❌]

Failed test name: TestCosignTest

Failure summary:

The action failed during the e2e test run because multiple test suites could not download required
CLI binaries from the in-cluster CLI server, causing network/DNS errors and panics.
- TestCosignTest
failed with EOF while downloading cosign from
http://cli-server.trusted-artifact-signer.traefik.me/....
- TestGitsignE2E failed with EOF while
downloading gitsign from the same CLI server host.
- TestRekorSearchUIE2E failed with EOF while
downloading rekor-cli from the same CLI server host.
- TestTrillianTest and TestManualTUFRepoTest
panicked when attempting to download updatetree/tuftool due to DNS lookup timeouts:
- dial tcp:
lookup cli-server.trusted-artifact-signer.traefik.me on 127.0.0.53:53: ... i/o timeout
- stack
trace points to
/home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:67 and
:70 inside github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip.
Additional evidence
shows the cluster services were not ready/accessible (e.g., operator logs show deployment is not
ready(...) and rekor-server connect: connection refused), consistent with the ingress/endpoint not
being reachable when the tests tried to fetch binaries.
The job ultimately exited with Process
completed with exit code 1.

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

386:  ##[endgroup]
387:  ##[group]Run helm/kind-action@v1.12.0
388:  with:
389:  version: v0.31.0
390:  node_image: kindest/node:v1.35.0
391:  kubectl_version: v1.35.0
392:  cluster_name: kind
393:  config: ./ci/config.yaml
394:  wait: 60s
395:  verbosity: 0
396:  registry: false
397:  registry_image: registry:2
398:  registry_name: kind-registry
399:  registry_port: 5000
400:  registry_enable_delete: false
401:  ignore_failed_clean: false
402:  env:
...

474:  configmap/ingress-nginx-controller created
475:  service/ingress-nginx-controller created
476:  service/ingress-nginx-controller-admission created
477:  deployment.apps/ingress-nginx-controller created
478:  job.batch/ingress-nginx-admission-create created
479:  job.batch/ingress-nginx-admission-patch created
480:  ingressclass.networking.k8s.io/nginx created
481:  validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission created
482:  pod/ingress-nginx-controller-589b66c8-7r8jn condition met
483:  ##[group]Run # Download the bundle.yaml
484:  �[36;1m# Download the bundle.yaml�[0m
485:  �[36;1mcurl -sL https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.84.0/bundle.yaml -o bundle.yaml �[0m
486:  �[36;1m�[0m
487:  �[36;1m# Check if the download was successful and the file is not empty�[0m
488:  �[36;1mif [ ! -s "bundle.yaml" ]; then�[0m
489:  �[36;1m  echo "Error: Downloaded bundle.yaml is empty or failed to download."�[0m
490:  �[36;1m  exit 1�[0m
...

770:  BUNDLE_IMG: ghcr.io/securesign/secure-sign-operator-bundle:dev-1cef76fe938621dedb0289b6155f7d0c8eee1ebd
771:  CATALOG_IMG: ghcr.io/securesign/secure-sign-operator-fbc:dev-1cef76fe938621dedb0289b6155f7d0c8eee1ebd
772:  NEW_OLM_CHANNEL: rhtas-operator.v1.5.0
773:  OCP_VERSION: v4.19
774:  INGRESS_HOST_TEMPLATE: %[1]s.%[2]s.traefik.me
775:  TEST_NAMESPACE: test
776:  REGISTRY_AUTH_FILE: /tmp/config.json
777:  ##[endgroup]
778:  /home/runner/work/secure-sign-operator/secure-sign-operator/bin/controller-gen-v0.17.0 rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
779:  Downloading sigs.k8s.io/kustomize/kustomize/v5@v5.6.0
780:  go: downloading sigs.k8s.io/kustomize/kustomize/v5 v5.6.0
781:  go: downloading sigs.k8s.io/kustomize/api v0.19.0
782:  go: downloading github.com/spf13/cobra v1.8.0
783:  go: downloading sigs.k8s.io/kustomize/cmd/config v0.19.0
784:  go: downloading sigs.k8s.io/kustomize/kyaml v0.19.0
785:  go: downloading github.com/go-errors/errors v1.4.2
786:  go: downloading github.com/davecgh/go-spew v1.1.1
...

2130:  go: downloading github.com/vbatts/tar-split v0.11.3
2131:  testing: warning: no tests to run
2132:  PASS
2133:  ok  	github.com/securesign/sigstore-e2e/test/benchmark	0.104s [no tests to run]
2134:  === RUN   TestCosignTest
2135:  Running Suite: Sign containers with cosign tool - /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/test/cosign
2136:  =============================================================================================================================
2137:  Random Seed: �[1m1778506762�[0m
2138:  Will run �[1m13�[0m of �[1m13�[0m specs
2139:  t=l=info m=Starting cosign test
2140:  t=l=info m=Mandatory configuration:
2141:  t=l=info m=TUF_URL=http://tuf.test.traefik.me
2142:  t=l=info m=KEYCLOAK_REALM=trusted-artifact-signer
2143:  t=l=info m=Getting binary 'cosign' from CLI server http://cli-server.trusted-artifact-signer.traefik.me
2144:  t=l=info m=Downloading cosign from http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/cosign-amd64.gz
2145:  t=l=error m=Failed due to
2146:  EOF
...

2151:  created by github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip in goroutine 35
2152:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:67 +0x132
2153:  FAIL	github.com/securesign/sigstore-e2e/test/cosign	10.030s
2154:  === RUN   TestGitsignE2E
2155:  Running Suite: Sign commit with gitsign tool - /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/test/gitsign
2156:  ===========================================================================================================================
2157:  Random Seed: �[1m1778506763�[0m
2158:  Will run �[1m9�[0m of �[1m9�[0m specs
2159:  t=l=info m=Mandatory configuration:
2160:  t=l=info m=TUF_URL=http://tuf.test.traefik.me
2161:  t=l=info m=OIDC_ISSUER_URL=http://keycloak-internal.keycloak-system.svc/realms/trusted-artifact-signer
2162:  t=l=info m=REKOR_URL=http://rekor-server.test.traefik.me
2163:  t=l=info m=TUF_URL=http://tuf.test.traefik.me
2164:  t=l=info m=Getting binary 'gitsign' from CLI server http://cli-server.trusted-artifact-signer.traefik.me
2165:  t=l=info m=Downloading gitsign from http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/gitsign-amd64.gz
2166:  t=l=error m=Failed due to
2167:  EOF
...

2192:  FAIL	github.com/securesign/sigstore-e2e/test/rekorcli	10.031s
2193:  === RUN   TestRekorSearchUIE2E
2194:  Running Suite: Search entries in UI - /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/test/rekorsearchui
2195:  ========================================================================================================================
2196:  Random Seed: �[1m1778506772�[0m
2197:  Will run �[1m20�[0m of �[1m20�[0m specs
2198:  t=l=info m=Mandatory configuration:
2199:  t=l=info m=TUF_URL=http://tuf.test.traefik.me
2200:  t=l=info m=KEYCLOAK_REALM=trusted-artifact-signer
2201:  t=l=info m=SIGSTORE_REKOR_UI_URL=http://rekor-search-ui.test.traefik.me
2202:  t=l=info m=OIDC_ISSUER_URL=http://keycloak-internal.keycloak-system.svc/realms/trusted-artifact-signer
2203:  t=l=info m=FULCIO_URL=http://fulcio-server.test.traefik.me
2204:  t=l=info m=REKOR_URL=http://rekor-server.test.traefik.me
2205:  t=l=info m=Getting binary 'rekor-cli' from CLI server http://cli-server.trusted-artifact-signer.traefik.me
2206:  t=l=info m=Downloading rekor-cli from http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/rekor-cli-amd64.gz
2207:  t=l=error m=Failed due to
2208:  EOF
...

2212:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:70 +0x86
2213:  created by github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip in goroutine 20
2214:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:67 +0x132
2215:  FAIL	github.com/securesign/sigstore-e2e/test/rekorsearchui	10.026s
2216:  ?   	github.com/securesign/sigstore-e2e/test/testsupport	[no test files]
2217:  === RUN   TestTrillianTest
2218:  Running Suite: Test Trillian Tree - /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/test/trillian
2219:  =================================================================================================================
2220:  Random Seed: �[1m1778506773�[0m
2221:  Will run �[1m2�[0m of �[1m2�[0m specs
2222:  t=l=info m=Mandatory configuration:
2223:  t=l=info m=TUF_URL=http://tuf.test.traefik.me
2224:  t=l=info m=KEYCLOAK_REALM=trusted-artifact-signer
2225:  t=l=info m=Getting binary 'updatetree' from CLI server http://cli-server.trusted-artifact-signer.traefik.me
2226:  t=l=info m=Downloading updatetree from http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/updatetree-amd64.gz
2227:  t=l=error m=Failed due to
2228:  EOF
2229:  panic: Get "http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/updatetree-amd64.gz": dial tcp: lookup cli-server.trusted-artifact-signer.traefik.me on 127.0.0.53:53: read udp 127.0.0.1:58986->127.0.0.53:53: i/o timeout
2230:  goroutine 10 [running]:
2231:  github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip.func1()
2232:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:70 +0x86
2233:  created by github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip in goroutine 9
2234:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:67 +0x132
2235:  FAIL	github.com/securesign/sigstore-e2e/test/trillian	10.025s
2236:  === RUN   TestManualTUFRepoTest
2237:  Running Suite: Create tuf repo manually - /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/test/tuftool
2238:  ======================================================================================================================
2239:  Random Seed: �[1m1778506774�[0m
2240:  Will run �[1m2�[0m of �[1m2�[0m specs
2241:  t=l=info m=Getting binary 'tuftool' from CLI server http://cli-server.trusted-artifact-signer.traefik.me
2242:  t=l=info m=Downloading tuftool from http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/tuftool-amd64.gz
2243:  t=l=error m=Failed due to
2244:  EOF
2245:  panic: Get "http://cli-server.trusted-artifact-signer.traefik.me/clients/linux/tuftool-amd64.gz": dial tcp: lookup cli-server.trusted-artifact-signer.traefik.me on 127.0.0.53:53: read udp 127.0.0.1:53956->127.0.0.53:53: i/o timeout
2246:  goroutine 38 [running]:
2247:  github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip.func1()
2248:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:70 +0x86
2249:  created by github.com/securesign/sigstore-e2e/pkg/support.DownloadAndUnzip in goroutine 37
2250:  /home/runner/work/secure-sign-operator/secure-sign-operator/e2e/pkg/support/testSupport.go:67 +0x132
2251:  FAIL	github.com/securesign/sigstore-e2e/test/tuftool	10.025s
2252:  FAIL
2253:  ##[error]Process completed with exit code 1.
2254:  ##[group]Run kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager
...

2312:  I0511 13:35:38.419383       1 controller.go:306] "Starting workers" controller="securesign" controllerGroup="rhtas.redhat.com" controllerKind="Securesign" worker count=1
2313:  I0511 13:35:38.433692       1 component.go:179] "resource" logger="setup.clidownload" name="&TypeMeta{Kind:Ingress,APIVersion:networking.k8s.io/v1,}" namespace="trusted-artifact-signer" operation="updated"
2314:  I0511 13:35:38.435543       1 warning_handler.go:64] "metadata.finalizers: \"tas.rhtas.redhat.com\": prefer a domain-qualified finalizer name including a path (/) to avoid accidental conflicts with other finalizer writers" controller="securesign" controllerGroup="rhtas.redhat.com" controllerKind="Securesign" Securesign="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="983cabc6-05ad-490e-bf61-f0f3b599e5c5"
2315:  I0511 13:35:38.518165       1 controller.go:303] "Starting Controller" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio"
2316:  I0511 13:35:38.518198       1 controller.go:306] "Starting workers" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio" worker count=1
2317:  I0511 13:35:38.518165       1 controller.go:303] "Starting Controller" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian"
2318:  I0511 13:35:38.518461       1 controller.go:306] "Starting workers" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" worker count=1
2319:  I0511 13:35:38.519221       1 controller.go:303] "Starting Controller" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf"
2320:  I0511 13:35:38.519265       1 controller.go:306] "Starting workers" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" worker count=1
2321:  I0511 13:35:38.519980       1 controller.go:303] "Starting Controller" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority"
2322:  I0511 13:35:38.521810       1 controller.go:306] "Starting workers" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority" worker count=1
2323:  I0511 13:35:38.521382       1 controller.go:303] "Starting Controller" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog"
2324:  I0511 13:35:38.523275       1 controller.go:306] "Starting workers" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" worker count=1
2325:  I0511 13:35:38.521419       1 controller.go:303] "Starting Controller" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor"
2326:  I0511 13:35:38.525183       1 controller.go:306] "Starting workers" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" worker count=1
2327:  I0511 13:35:39.116857       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio" Fulcio="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ae0b82d7-4744-4a8d-bdaf-f6ffce8df86b" error="deployment not ready(fulcio-server): not available"
2328:  I0511 13:35:39.116956       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio" Fulcio="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ae0b82d7-4744-4a8d-bdaf-f6ffce8df86b"
2329:  I0511 13:35:39.134838       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio" Fulcio="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d177ac69-b3f9-4d19-861a-6f93587cd654" error="deployment not ready(fulcio-server): not available"
2330:  I0511 13:35:39.134869       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="fulcio" controllerGroup="rhtas.redhat.com" controllerKind="Fulcio" Fulcio="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d177ac69-b3f9-4d19-861a-6f93587cd654"
2331:  I0511 13:35:39.181751       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority" TimestampAuthority="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="2419c7e3-a645-4122-ab9c-10a703588219" error="deployment not ready(tsa-server): not available"
2332:  I0511 13:35:39.182004       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority" TimestampAuthority="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="2419c7e3-a645-4122-ab9c-10a703588219"
2333:  I0511 13:35:39.245557       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority" TimestampAuthority="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="bbb0a6ac-c699-4a32-9a6f-fdd747714be2" error="deployment not ready(tsa-server): not available"
2334:  I0511 13:35:39.246044       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="timestampauthority" controllerGroup="rhtas.redhat.com" controllerKind="TimestampAuthority" TimestampAuthority="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="bbb0a6ac-c699-4a32-9a6f-fdd747714be2"
2335:  I0511 13:35:39.671538       1 initialize.go:40] "deployment is not ready" logger="db initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d02e6704-bbe3-45c0-9e37-7c96c204a4fa" error="deployment not ready(trillian-db): not available"
2336:  I0511 13:35:39.671559       1 initialize.go:45] "Waiting for deployment" logger="db initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d02e6704-bbe3-45c0-9e37-7c96c204a4fa"
2337:  I0511 13:35:39.721660       1 initialize.go:40] "deployment is not ready" logger="db initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="0c3f1db1-1b8c-46e1-83b5-b0b9dd8e5be6" error="deployment not ready(trillian-db): not available"
2338:  I0511 13:35:39.721686       1 initialize.go:45] "Waiting for deployment" logger="db initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="0c3f1db1-1b8c-46e1-83b5-b0b9dd8e5be6"
2339:  I0511 13:36:08.077940       1 initialize.go:38] "deployment is not ready" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4c63fb86-3920-424c-b5c5-30c22954f2f4" error="deployment not ready(trillian-logserver): not available"
2340:  I0511 13:36:08.077967       1 initialize.go:43] "Waiting for deployment" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4c63fb86-3920-424c-b5c5-30c22954f2f4"
2341:  I0511 13:36:08.105749       1 initialize.go:38] "deployment is not ready" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="158da523-2177-4516-ad6a-532414823d02" error="deployment not ready(trillian-logserver): not available"
2342:  I0511 13:36:08.105767       1 initialize.go:43] "Waiting for deployment" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="158da523-2177-4516-ad6a-532414823d02"
2343:  I0511 13:36:21.982120       1 initialize.go:38] "deployment is not ready" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d944dc56-e501-4be5-a8ff-28c0b975c4a2" error="deployment not ready(trillian-logserver): not available"
2344:  I0511 13:36:21.982139       1 initialize.go:43] "Waiting for deployment" logger="server initialize" controller="trillian" controllerGroup="rhtas.redhat.com" controllerKind="Trillian" Trillian="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="d944dc56-e501-4be5-a8ff-28c0b975c4a2"
2345:  I0511 13:36:44.293923       1 server_config.go:227] "Server config secret created" logger="server config" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" CTlog="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="9f5cfed2-b365-4b6a-9ced-bcac24cd8701" secret="ctlog-config-securesign-samplebpwtk"
2346:  I0511 13:36:44.397662       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" CTlog="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="55521ba8-5136-41bf-b117-012379952954" error="deployment not ready(ctlog): not available"
2347:  I0511 13:36:44.397688       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" CTlog="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="55521ba8-5136-41bf-b117-012379952954"
2348:  I0511 13:36:44.419008       1 initialize.go:42] "deployment is not ready" logger="initialize" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" CTlog="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ac8d45d3-5d19-429c-b09e-c8d84a628e5f" error="deployment not ready(ctlog): not available"
2349:  I0511 13:36:44.419037       1 initialize.go:47] "Waiting for deployment" logger="initialize" controller="ctlog" controllerGroup="rhtas.redhat.com" controllerKind="CTlog" CTlog="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ac8d45d3-5d19-429c-b09e-c8d84a628e5f"
2350:  I0511 13:36:50.129536       1 initialize.go:44] "deployment is not ready" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="e9ef5111-db85-4342-8316-818e0aa53b78" error="deployment not ready(rekor-server): not available"
2351:  I0511 13:36:50.129566       1 initialize.go:49] "Waiting for deployment" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="e9ef5111-db85-4342-8316-818e0aa53b78"
2352:  I0511 13:36:50.207080       1 initialize.go:44] "deployment is not ready" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="2a95a16d-1e61-4c0f-a129-c9571c88fb3c" error="deployment not ready(rekor-server): not available"
2353:  I0511 13:36:50.207107       1 initialize.go:49] "Waiting for deployment" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="2a95a16d-1e61-4c0f-a129-c9571c88fb3c"
2354:  I0511 13:37:04.172549       1 initialize.go:44] "deployment is not ready" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="8cf30822-e45c-4c5a-bb37-5131c4110ef2" error="deployment not ready(rekor-server): not available"
2355:  I0511 13:37:04.172575       1 initialize.go:49] "Waiting for deployment" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="8cf30822-e45c-4c5a-bb37-5131c4110ef2"
2356:  I0511 13:37:07.167374       1 initialize.go:44] "deployment is not ready" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ae6e3179-220a-42ea-a468-9f1df3f63534" error="deployment not ready(rekor-server): not available"
2357:  I0511 13:37:07.167473       1 initialize.go:49] "Waiting for deployment" logger="initialize" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="ae6e3179-220a-42ea-a468-9f1df3f63534"
2358:  I0511 13:37:07.237753       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="3706c802-7963-4f78-9746-f61104c1a546"
2359:  E0511 13:37:07.237834       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="3706c802-7963-4f78-9746-f61104c1a546"
2360:  E0511 13:37:07.244421       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="3706c802-7963-4f78-9746-f61104c1a546"
2361:  I0511 13:37:07.291510       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="f16ddfad-519f-4667-8e13-40414c1b333c"
2362:  E0511 13:37:07.291540       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="f16ddfad-519f-4667-8e13-40414c1b333c"
2363:  E0511 13:37:07.297653       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="f16ddfad-519f-4667-8e13-40414c1b333c"
2364:  I0511 13:37:07.341189       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="0ed91680-6800-4df9-94b0-128f7d8b0c82"
2365:  E0511 13:37:07.341275       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="0ed91680-6800-4df9-94b0-128f7d8b0c82"
2366:  E0511 13:37:07.349358       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="0ed91680-6800-4df9-94b0-128f7d8b0c82"
2367:  I0511 13:37:07.409660       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="da377f2a-13ad-41a2-b350-7734293a95c4"
2368:  E0511 13:37:07.409789       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="da377f2a-13ad-41a2-b350-7734293a95c4"
2369:  E0511 13:37:07.417528       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="da377f2a-13ad-41a2-b350-7734293a95c4"
2370:  I0511 13:37:07.521939       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="85dd1d91-7991-418e-b1ca-1230bbda8854"
2371:  E0511 13:37:07.522607       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="85dd1d91-7991-418e-b1ca-1230bbda8854"
2372:  E0511 13:37:07.541898       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="85dd1d91-7991-418e-b1ca-1230bbda8854"
2373:  I0511 13:37:07.600466       1 resolve_pub_key.go:152] "retrying to get rekor public key" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4edef30c-fc4f-46bf-a201-82970951c0c4"
2374:  E0511 13:37:07.600514       1 base_action.go:74] "error during action execution" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" logger="resolve public key" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4edef30c-fc4f-46bf-a201-82970951c0c4"
2375:  E0511 13:37:07.606322       1 controller.go:495] "Reconciler error" err="ResolvePubKey: unable to resolve public key: Get \"http://rekor-server.test.svc/api/v1/log/publicKey\": dial tcp 10.96.169.80:80: connect: connection refused" controller="rekor" controllerGroup="rhtas.redhat.com" controllerKind="Rekor" Rekor="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4edef30c-fc4f-46bf-a201-82970951c0c4"
2376:  I0511 13:37:14.033916       1 tuf_init_job.go:64] "Tuf tuf-repository-init is present." logger="controller.tuf.tuf-init job" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="c28ccd2d-2a7a-49a0-8cef-9c1e87c72bfa" Succeeded=0 Failures=0
2377:  I0511 13:37:19.041131       1 tuf_init_job.go:64] "Tuf tuf-repository-init is present." logger="controller.tuf.tuf-init job" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="149d5459-fe9f-47bd-9ba7-e1ad94ebfb73" Succeeded=0 Failures=0
2378:  I0511 13:37:24.046966       1 tuf_init_job.go:64] "Tuf tuf-repository-init is present." logger="controller.tuf.tuf-init job" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="48ba1150-4eca-4b48-9bc9-f1b48f777cb3" Succeeded=1 Failures=0
2379:  I0511 13:37:24.078480       1 tuf_init_job.go:64] "Tuf tuf-repository-init is present." logger="controller.tuf.tuf-init job" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="49f2cef6-9d52-4df0-bb14-1f649ffa1e95" Succeeded=1 Failures=0
2380:  I0511 13:37:24.242578       1 initialize.go:43] "deployment is not ready" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4089d8a4-0008-4d03-9841-1d5aaeb549dc" error="deployment not ready(tuf): not available"
2381:  I0511 13:37:24.242598       1 initialize.go:48] "Waiting for deployment" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="4089d8a4-0008-4d03-9841-1d5aaeb549dc"
2382:  I0511 13:37:24.253737       1 initialize.go:43] "deployment is not ready" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="5f305621-9547-4c0d-bb48-c54cd0c34f3b" error="deployment not ready(tuf): not available"
2383:  I0511 13:37:24.253759       1 initialize.go:48] "Waiting for deployment" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="5f305621-9547-4c0d-bb48-c54cd0c34f3b"
2384:  I0511 13:37:31.529978       1 initialize.go:43] "deployment is not ready" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="3e189858-bfbb-44ef-ae73-61780c959622" error="deployment not ready(tuf): not available"
2385:  I0511 13:37:31.530007       1 initialize.go:48] "Waiting for deployment" logger="controller.tuf.initialize" controller="tuf" controllerGroup="rhtas.redhat.com" controllerKind="Tuf" Tuf="test/securesign-sample" namespace="test" name="securesign-sample" reconcileID="3e189858-bfbb-44ef-ae73-61780c959622"
2386:  Post job cleanup.
2387:  Post job cleanup.
2388:  Error response from daemon: No such container: kind-registry
2389:  Deleting cluster "kind" ...

…usters

Introduces --ingress-host-template flag (INGRESS_HOST_TEMPLATE env var) to control
default Ingress hostnames on non-OpenShift clusters. The default "%[1]s.local" preserves
existing behavior. CI is configured with "%[1]s.%[2]s.127.0.0.1.nip.io" to produce
namespace-unique hostnames, eliminating Ingress hostname collisions between e2e test
namespaces that caused Konflux pipeline timeouts.

Refs: SECURESIGN-3862
Signed-off-by: Tomas Turek <tturek@redhat.com>
@osmman osmman force-pushed the tturek/SECURESIGN-3862 branch from 4e3f148 to 9fd8d69 Compare May 12, 2026 13:50
@osmman
Copy link
Copy Markdown
Collaborator Author

osmman commented May 12, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants