From 59bcbb0f5bf40d9714b09f79054d3a802c627055 Mon Sep 17 00:00:00 2001
From: Haseeb Tariq <hasbro17@gmail.com>
Date: Mon, 20 Jul 2026 21:22:21 -0700
Subject: [PATCH] ci(pki): Fix etcd-metric-signer secret name and improve
 failure diagnostics

The etcd metrics signer secret is named "etcd-metric-signer" in the
cluster-etcd-operator (pkg/tlshelpers/tlshelpers.go:40), not
"etcd-metrics-signer". The name mismatch caused the PKI verification
step to fail with "Could not find certificate from <stdin>".

Also surface expected-vs-actual mismatch details in the summary table
for failed checks instead of only showing the secret path, so failures
can be diagnosed from the summary without scrolling through the full log.

Assisted-by: Claude Code (Opus 4.6)
---
 .../openshift-installer-pki-verify-commands.sh  | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh b/ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh
index f351e8c209f48..e1293ab503ce1 100755
--- a/ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh
+++ b/ci-operator/step-registry/openshift/installer/pki/verify/openshift-installer-pki-verify-commands.sh
@@ -18,7 +18,7 @@ declare -a SIGNERS=(
   "kube-control-plane-signer|kube-control-plane-signer|openshift-kube-apiserver-operator|tls.crt"
   "aggregator-signer|aggregator-client-signer|openshift-kube-apiserver-operator|tls.crt"
   "etcd-signer|etcd-signer|openshift-etcd|tls.crt"
-  "etcd-metrics-signer|etcd-metrics-signer|openshift-etcd|tls.crt"
+  "etcd-metrics-signer|etcd-metric-signer|openshift-etcd|tls.crt"
 )
 
 # Map expected algorithm to openssl output strings
@@ -50,6 +50,7 @@ for signer in "${SIGNERS[@]}"; do
   IFS='|' read -r description secret_name namespace cert_key <<< "${signer}"
   total=$((total + 1))
   status="PASS"
+  fail_details=""
 
   echo "--- Checking: ${description} (${namespace}/${secret_name}) ---" | tee -a "${ARTIFACT_LOG}"
 
@@ -85,6 +86,7 @@ for signer in "${SIGNERS[@]}"; do
     actual_algo=$(echo "${cert_text}" | grep -F "Public Key Algorithm:" | head -1 | xargs) || true
     echo "  FAIL: Expected algorithm '${expected_algo_str}', got '${actual_algo}'" | tee -a "${ARTIFACT_LOG}"
     status="FAIL"
+    fail_details="algo: expected ${expected_algo_str}, got ${actual_algo:-unknown}"
   fi
 
   # Check key parameter
@@ -102,12 +104,17 @@ for signer in "${SIGNERS[@]}"; do
     fi
     echo "  FAIL: Expected '${expected_param_str}', got '${actual_param:-not found}'" | tee -a "${ARTIFACT_LOG}"
     status="FAIL"
+    fail_details="${fail_details:+${fail_details}; }key: expected ${expected_param_str}, got ${actual_param:-unknown}"
   fi
 
   if [[ "${status}" == "FAIL" ]]; then
     failures=$((failures + 1))
   fi
-  results+=("${status}|${description}|${namespace}/${secret_name}")
+  if [[ "${status}" == "PASS" ]]; then
+    results+=("${status}|${description}|${namespace}/${secret_name}")
+  else
+    results+=("${status}|${description}|${fail_details}")
+  fi
 done
 
 # Verify PKI CR
@@ -138,7 +145,11 @@ else
   if [[ "${pki_status}" == "FAIL" ]]; then
     failures=$((failures + 1))
   fi
-  results+=("${pki_status}|PKI CR|mode=${mode:-unknown}")
+  if [[ "${pki_status}" == "PASS" ]]; then
+    results+=("${pki_status}|PKI CR|mode=${mode}")
+  else
+    results+=("${pki_status}|PKI CR|expected mode ${EXPECTED_PKI_MODE}, got ${mode:-not set}")
+  fi
 fi
 
 # Print summary table