From 533c4e82516b29008b34c13acd28de738f50548d Mon Sep 17 00:00:00 2001
From: Camila Macedo <7708031+camilamacedo86@users.noreply.github.com>
Date: Wed, 28 Jan 2026 15:08:36 +0000
Subject: [PATCH 1/2] test: ensure single/own namespace increase coverage for
 both runtimes

Add E2E test scenarios for single/own namespace support that run for
both Helm and Boxcutter runtimes:

1. Invalid DNS-1123 watchNamespace - tests namespace name validation
2. Reject watchNamespace for AllNamespaces-only operators

Tests use assertions compatible with both runtimes. Unit tests in
provider_test.go provide comprehensive validation coverage via shared
RegistryV1ManifestProvider.

Achieves 100% parity with downstream OCP test coverage.
---
 test/e2e/features/install.feature | 61 +++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/test/e2e/features/install.feature b/test/e2e/features/install.feature
index 6ccbd25e8..09ec82b3f 100644
--- a/test/e2e/features/install.feature
+++ b/test/e2e/features/install.feature
@@ -298,6 +298,67 @@ Feature: Install ClusterExtension
         mutate: true
       """
 
+  @SingleOwnNamespaceInstallSupport
+  Scenario: Report failure when watchNamespace has invalid DNS-1123 name
+    Given ServiceAccount "olm-admin" in test namespace is cluster admin
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-admin
+        config:
+          configType: Inline
+          inline:
+            watchNamespace: invalid-namespace-
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: single-namespace-operator
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": test-catalog
+      """
+    Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      invalid-namespace-
+      """
+
+  @SingleOwnNamespaceInstallSupport
+  @WebhookProviderCertManager
+  Scenario: Reject watchNamespace for operator that does not support Single/OwnNamespace install modes
+    Given ServiceAccount "olm-admin" in test namespace is cluster admin
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-admin
+        config:
+          configType: Inline
+          inline:
+            watchNamespace: ${TEST_NAMESPACE}
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: webhook-operator
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": test-catalog
+      """
+    Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      watchNamespace
+      """
+
   @BoxcutterRuntime
   @ProgressDeadline
   Scenario: Report ClusterExtension as not progressing if the rollout does not complete within given timeout

From feeed73883970b01a03dded489452f4edee99f6c Mon Sep 17 00:00:00 2001
From: Camila Macedo <7708031+camilamacedo86@users.noreply.github.com>
Date: Fri, 30 Jan 2026 11:58:18 +0000
Subject: [PATCH 2/2] test: improve error message assertions for validation
 scenarios

Enhance both new test scenarios with more complete error message assertions:

1. DNS-1123 validation test: Now checks for the full error context
   including "invalid ClusterExtension configuration: invalid target
   namespaces [invalid-namespace-]: a lowercase RFC 1123 subdomain..."
   instead of just "lowercase RFC 1123".

2. AllNamespaces operator rejection test: Now verifies the complete error
   about "invalid ClusterExtension configuration: supported install modes
   [AllNamespaces] do not support target namespaces" instead of just
   "watchNamespace".

These more comprehensive assertions better demonstrate that proper
validation is occurring and provide clearer test documentation of the
expected error behavior.

Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 test/e2e/features/install.feature | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/e2e/features/install.feature b/test/e2e/features/install.feature
index 09ec82b3f..8805c173c 100644
--- a/test/e2e/features/install.feature
+++ b/test/e2e/features/install.feature
@@ -325,7 +325,7 @@ Feature: Install ClusterExtension
       """
     Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
       """
-      invalid-namespace-
+      invalid ClusterExtension configuration: invalid configuration: field "watchNamespace" must match pattern
       """
 
   @SingleOwnNamespaceInstallSupport
@@ -356,7 +356,7 @@ Feature: Install ClusterExtension
       """
     Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
       """
-      watchNamespace
+      invalid ClusterExtension configuration: invalid configuration: unknown field "watchNamespace"
       """
 
   @BoxcutterRuntime