abays · Oct 31, 2026
diff --git a/test/kuttl/common/osp_check_cert_issuer.sh b/test/kuttl/common/osp_check_cert_issuer.sh
@@ -6,6 +6,25 @@ EXPECTED_ISSUER="$1"
 ENDPOINT_TYPE="$2"
 ISSUER_MISMATCHES=""
 ALL_MATCHED=1
+KEYSTONE_NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
+KEYSTONE_AUTH_URL="https://keystone-internal.${KEYSTONE_NAMESPACE}.svc:5000/v3"
+KEYSTONE_SOURCE_CONFIG="${OS_CLIENT_CONFIG_FILE:-/home/cloud-admin/.config/openstack/clouds.yaml}"
+KEYSTONE_SECURE_CONFIG="${OS_CLIENT_SECURE_FILE:-/home/cloud-admin/.config/openstack/secure.yaml}"
+KEYSTONE_CLIENT_CONFIG="$(mktemp)"
+cp "$KEYSTONE_SOURCE_CONFIG" "$KEYSTONE_CLIENT_CONFIG"
+sed -i -E "s|(^[[:space:]]*auth_url:[[:space:]]*).*|\1${KEYSTONE_AUTH_URL}|" "$KEYSTONE_CLIENT_CONFIG"
+trap 'rm -f "$KEYSTONE_CLIENT_CONFIG"' EXIT
+
+openstack_with_internal_auth() {
+    OS_CLOUD=default \
+    OS_CLIENT_CONFIG_FILE="$KEYSTONE_CLIENT_CONFIG" \
+    OS_CLIENT_SECURE_FILE="$KEYSTONE_SECURE_CONFIG" \
+    OS_IDENTITY_API_VERSION=3 \
+    OS_INTERFACE=internal \
+    OS_ENDPOINT_TYPE=internal \
+    OS_AUTH_URL="$KEYSTONE_AUTH_URL" \
+        openstack "$@"
+}
 
 function extract_host_port {
     local endpoint_url=$1
@@ -31,7 +50,14 @@ function check_keystone_endpoint {
     local endpoint_url=$1
 
     echo "Checking Keystone endpoint $endpoint_url ..."
-    http_status=$(curl -s -o /dev/null -w "%{http_code}" "$endpoint_url")
+    # Route hosts are not reliably resolvable from CRC client pods. Keep the
+    # route hostname for Host/SNI, but connect through the in-cluster router.
+    local host_port
+    host_port=$(extract_host_port "$endpoint_url")
+    local host="${host_port%:*}"
+    local port="${host_port##*:}"
+    http_status=$(curl --connect-to "${host}:${port}:router-internal-default.openshift-ingress.svc.cluster.local.:${port}" \
+        -s -o /dev/null -w "%{http_code}" "$endpoint_url")
 
     if [[ "$http_status" -ge 200 && "$http_status" -lt 400 ]]; then
         return 0
@@ -44,13 +70,22 @@ get_issuer_cn() {
     local host_port="$1"
     local output
 
-    output=$(openssl s_client -connect "$host_port" </dev/null 2>/dev/null |
-        openssl x509 -noout -issuer 2>/dev/null)
+    if [[ "$ENDPOINT_TYPE" == "public" ]]; then
+        local host="${host_port%:*}"
+        local port="${host_port##*:}"
+        output=$(openssl s_client \
+            -connect "router-internal-default.openshift-ingress.svc.cluster.local.:${port}" \
+            -servername "$host" </dev/null 2>/dev/null |
+            openssl x509 -noout -issuer 2>/dev/null)
+    else
+        output=$(openssl s_client -connect "$host_port" </dev/null 2>/dev/null |
+            openssl x509 -noout -issuer 2>/dev/null)
+    fi
 
     echo "$output" | sed -n 's/^.*CN[[:space:]]*=[[:space:]]*\([^,]*\).*$/\1/p'
 }
 
-keystone_url=$(openstack endpoint list -c URL -f value | grep 'keystone-public')
+keystone_url=$(openstack_with_internal_auth endpoint list -c URL -f value | grep 'keystone-public')
 keystone_host_port=$(extract_host_port "$keystone_url")
 
 if ! check_keystone_endpoint "$keystone_url"; then
@@ -66,7 +101,7 @@ else
 fi
 
 # Check endpoints for the expected issuer
-for url in $(openstack endpoint list -c URL -f value | grep "$endpoint_filter"); do
+for url in $(openstack_with_internal_auth endpoint list -c URL -f value | grep "$endpoint_filter"); do
     host_port=$(extract_host_port "$url")
 
     echo "Checking $host_port ..."

diff --git a/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml b/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml
@@ -1,6 +1,6 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
-timeout: 60
+timeout: 180
 commands:
   - script: |
       echo "Checking rotation of non API service certificates..."

diff --git a/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml b/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml
@@ -1,3 +1,14 @@
+apiVersion: v1
+data:
+  internal-ca-bundle.pem: ""
+  tls-ca-bundle.pem: ""
+kind: Secret
+metadata:
+  labels:
+    combined-ca-bundle: ""
+  name: combined-ca-bundle
+type: Opaque
+---
 apiVersion: dataplane.openstack.org/v1beta1
 kind: OpenStackDataPlaneService
 metadata:

diff --git a/test/kuttl/tests/dataplane-service-config/00-create.yaml b/test/kuttl/tests/dataplane-service-config/00-create.yaml
@@ -1,3 +1,13 @@
+apiVersion: v1
+data:
+  internal-ca-bundle.pem: ""
+  tls-ca-bundle.pem: ""
+kind: Secret
+metadata:
+  labels:
+    combined-ca-bundle: ""
+  name: combined-ca-bundle
+type: Opaque
 ---
 apiVersion: v1
 kind: ConfigMap

diff --git a/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml b/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml
@@ -1,3 +1,14 @@
+apiVersion: v1
+data:
+  internal-ca-bundle.pem: ""
+  tls-ca-bundle.pem: ""
+kind: Secret
+metadata:
+  labels:
+    combined-ca-bundle: ""
+  name: combined-ca-bundle
+type: Opaque
+---
 apiVersion: dataplane.openstack.org/v1beta1
 kind: OpenStackDataPlaneService
 metadata:

diff --git a/test/kuttl/tests/dataplane-service-failure/00-create.yaml b/test/kuttl/tests/dataplane-service-failure/00-create.yaml
@@ -1,3 +1,14 @@
+apiVersion: v1
+data:
+  internal-ca-bundle.pem: ""
+  tls-ca-bundle.pem: ""
+kind: Secret
+metadata:
+  labels:
+    combined-ca-bundle: ""
+  name: combined-ca-bundle
+type: Opaque
+---
 apiVersion: dataplane.openstack.org/v1beta1
 kind: OpenStackDataPlaneService
 metadata: