CNTRLPLANE-2544: Add ExternalOIDCWithUpstreamParity e2e tests

go.mod

@@ -61,7 +61,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/openshift-eng/openshift-tests-extension v0.0.0-20251218142942-7ecc8801b9df
 	github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f
-	github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368
+	github.com/openshift/api v0.0.0-20260304122341-cf5d8996109f
 	github.com/openshift/apiserver-library-go v0.0.0-20251015164739-79d04067059d
 	github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
 	github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13

go.sum

@@ -828,8 +828,8 @@ github.com/openshift-eng/openshift-tests-extension v0.0.0-20251218142942-7ecc880
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20251218142942-7ecc8801b9df/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
 github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f h1:E72Zoc+JImPehBrXkgaCbIDbSFuItvyX6RCaZ0FQE5k=
 github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f/go.mod h1:cDVdp0eda7EHE6tLuSeo4IqPWdAX/KJK+ogBirIGtsI=
-github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368 h1:kSr3DOlq0NCrHd65HB2o/pBsks7AfRm+fkpf9RLUPoc=
-github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
+github.com/openshift/api v0.0.0-20260304122341-cf5d8996109f h1:M8y0oBq/KRkuSNFlUMQRAn2MrXJh1mzTCFgbLpPWQbM=
+github.com/openshift/api v0.0.0-20260304122341-cf5d8996109f/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
 github.com/openshift/apiserver-library-go v0.0.0-20251015164739-79d04067059d h1:Mfya3RxHWvidOrKyHj3bmFn5x2B89DLZIvDAhwm+C2s=
 github.com/openshift/apiserver-library-go v0.0.0-20251015164739-79d04067059d/go.mod h1:zm2/rIUp0p83pz0/1kkSoKTqhTr3uUKSKQ9fP7Z3g7Y=
 github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee h1:+Sp5GGnjHDhT/a/nQ1xdp43UscBMr7G5wxsYotyhzJ4=

test/extended/authentication/keycloak_client.go

@@ -66,6 +66,10 @@ func (kc *keycloakClient) CreateGroup(name string) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusCreated {
+		// If the group already exists (409 Conflict), that's fine - we can reuse it
+		if resp.StatusCode == http.StatusConflict {
+			return nil
+		}
 		respBytes, _ := io.ReadAll(resp.Body)
 		return fmt.Errorf("failed creating group %q: %s - %s", name, resp.Status, respBytes)
 	}
@@ -131,6 +135,43 @@ func (kc *keycloakClient) CreateUser(username, password string, groups ...string
 	return nil
 }
 
+func (kc *keycloakClient) CreateUserWithEmail(username, email, password string, groups ...string) error {
+	userURL := kc.adminURL.JoinPath("users")
+
+	user := user{
+		Username:      username,
+		Email:         email,
+		Enabled:       true,
+		EmailVerified: true,
+		Groups:        groups,
+		Credentials: []credential{
+			{
+				Temporary: false,
+				Type:      credentialTypePassword,
+				Value:     password,
+			},
+		},
+	}
+
+	userBytes, err := json.Marshal(user)
+	if err != nil {
+		return fmt.Errorf("marshalling user configuration %v", user)
+	}
+
+	resp, err := kc.DoRequest(http.MethodPost, userURL.String(), runtime.ContentTypeJSON, true, bytes.NewBuffer(userBytes))
+	if err != nil {
+		return fmt.Errorf("sending POST request to %q to create user %v", userURL.String(), user)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusCreated {
+		respBytes, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("failed creating user %v: %s - %s", user, resp.Status, respBytes)
+	}
+
+	return nil
+}
+
 type authenticationResponse struct {
 	AccessToken      string `json:"access_token"`
 	IDToken          string `json:"id_token"`

test/extended/util/operator/settle.go

@@ -56,6 +56,10 @@ func WaitForOperatorsToSettle(ctx context.Context, configClient clientconfigv1.I
 func unsettledOperators(operators []configv1.ClusterOperator) []string {
 	unsettledOperatorStatus := []string{}
 	for _, co := range operators {
+		// TODO: remove this "if" when console bug https://redhat.atlassian.net/browse/OCPBUGS-78477 is fixed
+		if co.Name == "console" {
+			continue
+		}
 		available := findCondition(co.Status.Conditions, configv1.OperatorAvailable)
 		degraded := findCondition(co.Status.Conditions, configv1.OperatorDegraded)
 		progressing := findCondition(co.Status.Conditions, configv1.OperatorProgressing)