🧪 Update ocp golden manifests

.github/workflows/e2e-pr-tester.yaml

@@ -174,7 +174,7 @@ jobs:
           python-version: "3.11"
 
       - name: Clone k8s-apps-deployer
-        run: git clone https://github.com/stillalearner/k8s-apps-deployer.git
+        run: git clone --branch conditional-ocp-resources --single-branch https://github.com/stillalearner/k8s-apps-deployer.git
 
       - name: Create venv and install package
         run: |

e2e-tests/golden-manifests-ocp/simple-nginx-nopv/export/resources/simple-nginx-nopv/Route_route.openshift.io_v1_simple-nginx-nopv_my-simple-nginx-nopv.yaml

@@ -0,0 +1,32 @@
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  annotations:
+    openshift.io/host.generated: "true"
+  creationTimestamp: "2026-07-08T11:53:19Z"
+  generation: 1
+  labels:
+    app: simple-nginx-nopv
+  name: my-simple-nginx-nopv
+  namespace: simple-nginx-nopv
+  resourceVersion: "140464"
+  uid: 845eb523-3590-4071-9161-16e13b294be1
+spec:
+  host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+  port:
+    targetPort: 8080
+  to:
+    kind: Service
+    name: my-simple-nginx-nopv
+    weight: 100
+  wildcardPolicy: None
+status:
+  ingress:
+  - conditions:
+    - lastTransitionTime: "2026-07-08T11:53:19Z"
+      status: "True"
+      type: Admitted
+    host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+    routerCanonicalHostname: router-default.apps.migqe-57431.qe.devcluster.openshift.com
+    routerName: default
+    wildcardPolicy: None

e2e-tests/golden-manifests-ocp/simple-nginx-nopv/output/output.yaml

@@ -1,91 +1,4 @@
 apiVersion: v1
-imagePullSecrets:
-- name: builder-dockercfg-n5zzt
-kind: ServiceAccount
-metadata:
-  annotations:
-    openshift.io/internal-registry-pull-secret-ref: builder-dockercfg-n5zzt
-  name: builder
-  namespace: simple-nginx-nopv
-secrets:
-- name: builder-dockercfg-n5zzt
----
-apiVersion: v1
-imagePullSecrets:
-- name: deployer-dockercfg-rgp2c
-kind: ServiceAccount
-metadata:
-  annotations:
-    openshift.io/internal-registry-pull-secret-ref: deployer-dockercfg-rgp2c
-  name: deployer
-  namespace: simple-nginx-nopv
-secrets:
-- name: deployer-dockercfg-rgp2c
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    openshift.io/description: Allows deploymentconfigs in this namespace to rollout
-      pods in this namespace.  It is auto-managed by a controller; remove subjects
-      to disable.
-  name: system:deployers
-  namespace: simple-nginx-nopv
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:deployer
-subjects:
-- kind: ServiceAccount
-  name: deployer
-  namespace: simple-nginx-nopv
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    openshift.io/description: Allows builds in this namespace to push images to this
-      namespace.  It is auto-managed by a controller; remove subjects to disable.
-  name: system:image-builders
-  namespace: simple-nginx-nopv
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:image-builder
-subjects:
-- kind: ServiceAccount
-  name: builder
-  namespace: simple-nginx-nopv
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    openshift.io/description: Allows all pods in this namespace to pull images from
-      this namespace.  It is auto-managed by a controller; remove subjects to disable.
-  name: system:image-pullers
-  namespace: simple-nginx-nopv
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:image-puller
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:serviceaccounts:simple-nginx-nopv
----
-apiVersion: v1
-data:
-  service-ca.crt: |
-    REDACTED
-kind: ConfigMap
-metadata:
-  annotations:
-    service.beta.openshift.io/inject-cabundle: "true"
-  name: openshift-service-ca.crt
-  namespace: simple-nginx-nopv
----
-apiVersion: v1
 kind: Service
 metadata:
   labels:
@@ -148,3 +61,36 @@ spec:
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 30
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  annotations:
+    openshift.io/host.generated: "true"
+  creationTimestamp: "2026-07-08T11:53:19Z"
+  generation: 1
+  labels:
+    app: simple-nginx-nopv
+  name: my-simple-nginx-nopv
+  namespace: simple-nginx-nopv
+  resourceVersion: "140464"
+  uid: 845eb523-3590-4071-9161-16e13b294be1
+spec:
+  host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+  port:
+    targetPort: 8080
+  to:
+    kind: Service
+    name: my-simple-nginx-nopv
+    weight: 100
+  wildcardPolicy: None
+status:
+  ingress:
+  - conditions:
+    - lastTransitionTime: "2026-07-08T11:53:19Z"
+      status: "True"
+      type: Admitted
+    host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+    routerCanonicalHostname: router-default.apps.migqe-57431.qe.devcluster.openshift.com
+    routerName: default
+    wildcardPolicy: None

e2e-tests/golden-manifests-ocp/simple-nginx-nopv/output/resources/simple-nginx-nopv/Route_route.openshift.io_v1_simple-nginx-nopv_my-simple-nginx-nopv.yaml

@@ -0,0 +1,32 @@
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  annotations:
+    openshift.io/host.generated: "true"
+  creationTimestamp: "2026-07-08T11:53:19Z"
+  generation: 1
+  labels:
+    app: simple-nginx-nopv
+  name: my-simple-nginx-nopv
+  namespace: simple-nginx-nopv
+  resourceVersion: "140464"
+  uid: 845eb523-3590-4071-9161-16e13b294be1
+spec:
+  host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+  port:
+    targetPort: 8080
+  to:
+    kind: Service
+    name: my-simple-nginx-nopv
+    weight: 100
+  wildcardPolicy: None
+status:
+  ingress:
+  - conditions:
+    - lastTransitionTime: "2026-07-08T11:53:19Z"
+      status: "True"
+      type: Admitted
+    host: my-simple-nginx-nopv-simple-nginx-nopv.apps.migqe-57431.qe.devcluster.openshift.com
+    routerCanonicalHostname: router-default.apps.migqe-57431.qe.devcluster.openshift.com
+    routerName: default
+    wildcardPolicy: None

e2e-tests/tests/tier0/mta_839_networkpolicy_migration_test.go

@@ -55,6 +55,16 @@ var _ = Describe("NetworkPolicy migration", func() {
 		Expect(PrepareSourceApp(srcApp, kubectlSrcNonAdmin)).NotTo(HaveOccurred())
 		log.Printf("Source app %s prepared successfully\n", srcApp.Name)
 
+		ingressFrom := `        - podSelector: {}`
+		if kubectlTgtNonAdmin.IsOpenShift() {
+			// OpenShift router pods run in openshift-ingress namespace and must be
+			// allowed to reach backend pods through this NetworkPolicy.
+			ingressFrom += `
+        - namespaceSelector:
+            matchLabels:
+              network.openshift.io/policy-group: ingress`
+		}
+
 		networkPolicyManifest := fmt.Sprintf(`apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -69,7 +79,7 @@ spec:
     - Egress
   ingress:
     - from:
-        - podSelector: {}
+%s
       ports:
         - protocol: TCP
           port: 8080
@@ -81,7 +91,7 @@ spec:
           port: 53
         - protocol: TCP
           port: 53
-`, networkPolicyName, namespace, appName)
+`, networkPolicyName, namespace, appName, ingressFrom)
 
 		By("Create NetworkPolicy on source cluster")
 		Expect(kubectlSrcNonAdmin.ApplyYAMLSpec(networkPolicyManifest, namespace)).NotTo(HaveOccurred())