rptest: add skip_in_cdt opt-out for CDT runs

tests/rptest/test_suite_quick.yml

@@ -12,6 +12,7 @@ quick:
   - tests/
   - transactions/
   - cfr_tests/
+  - utils/skip_in_cdt_test.py
 
   excluded:
   - tests/rpk_tuner_test.py

tests/rptest/tests/acls_test.py

@@ -28,6 +28,7 @@
 from rptest.services.redpanda import LoggingConfig, SecurityConfig, TLSProvider
 from rptest.services.redpanda_installer import RedpandaInstaller, wait_for_num_versions
 from rptest.tests.redpanda_test import RedpandaTest
+from rptest.utils.mode_checks import skip_file_in_cdt
 
 
 class MTLSProvider(TLSProvider):
@@ -853,3 +854,9 @@ def test_describe_quotas(self):
         assert resp["ErrorCode"] != KError.CLUSTER_AUTHORIZATION_FAILED.value, (
             f"Response: {resp}"
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="ACL/authz suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/audit_log_test.py

@@ -84,7 +84,7 @@
     schema2_def,
 )
 from rptest.util import expect_exception, wait_until, wait_until_result
-from rptest.utils.mode_checks import skip_fips_mode
+from rptest.utils.mode_checks import skip_fips_mode, skip_file_in_cdt
 from rptest.utils.rpk_config import read_redpanda_cfg
 from rptest.utils.schema_registry_utils import Mode, get_subjects, put_mode
 
@@ -4406,3 +4406,9 @@ def test_audit_log_upgrade_all_nodes(self):
         )
 
         self._test_audit_on_all_nodes("post_upgrade_restart")
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="audit-logging suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/cluster_features_test.py

@@ -29,6 +29,7 @@
 from rptest.util import expect_exception, wait_until_result
 from rptest.utils.node_operations import NodeDecommissionWaiter
 from rptest.utils.rpenv import sample_license, sample_license_v1
+from rptest.utils.mode_checks import skip_file_in_cdt
 
 FEATURE_ALPHA_NAME = "__test_alpha"
 FEATURE_BRAVO_NAME = "__test_bravo"
@@ -2024,3 +2025,9 @@ def cluster_at_steady_state():
                 "feature_manager likely failed to wake on member removal."
             ),
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="feature-flag suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/enterprise_features_license_test.py

@@ -18,7 +18,7 @@
 )
 from rptest.tests.redpanda_test import RedpandaTest
 from rptest.util import expect_exception
-from rptest.utils.mode_checks import skip_fips_mode
+from rptest.utils.mode_checks import skip_fips_mode, skip_file_in_cdt
 
 
 class EnterpriseFeaturesTestBase(RedpandaTest):
@@ -345,3 +345,9 @@ def test_license_violation(self):
         )
 
         self.check_feature(feature, enabled=False, license_valid=False)
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="enterprise-license enforcement suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/gbac_claim_test.py

@@ -26,6 +26,7 @@
     make_redpanda_service,
 )
 from rptest.services.stub_oidc_provider import StubOIDCProvider
+from rptest.utils.mode_checks import skip_file_in_cdt
 
 
 class StubOIDCTestBase(Test):
@@ -1184,3 +1185,9 @@ def test_invalid_group_claim_path(self) -> None:
 
         producer = self.make_producer(client_id)
         self.assert_produce_denied(producer, topic)
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="group-based access-control suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/leadership_transfer_test.py

@@ -27,6 +27,7 @@
 from rptest.services.redpanda import RESTART_LOG_ALLOW_LIST, ResourceSettings
 from rptest.tests.redpanda_test import RedpandaTest
 from rptest.util import wait_until_result
+from rptest.utils.mode_checks import skip_file_in_cdt
 
 
 class ReplicaMetadata(TypedDict):
@@ -1103,3 +1104,9 @@ def get_leaders_preference(topic: str) -> str:
         assert t2r == expected, (
             f"Expected topic-to-rack leaders {expected}. Got {t2r} instead"
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="leadership-transfer suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/maintenance_test.py

@@ -21,6 +21,7 @@
 from rptest.services.cluster import cluster
 from rptest.services.redpanda import RESTART_LOG_ALLOW_LIST
 from rptest.tests.maintenance import MaintenanceTestBase
+from rptest.utils.mode_checks import skip_file_in_cdt
 
 
 class MaintenanceTest(MaintenanceTestBase):
@@ -228,3 +229,9 @@ def test_leader_distribution(self, use_rpk):
             backoff_sec=2,
             err_msg="Leaders distributed very unevenly",
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="maintenance-mode suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/pandaproxy_test.py

@@ -40,7 +40,11 @@
 from rptest.tests.group_membership_test import GroupCoordinatorTransferUtils
 from rptest.tests.redpanda_test import RedpandaTest
 from rptest.util import search_logs_with_timeout
-from rptest.utils.mode_checks import in_fips_environment, skip_debug_mode
+from rptest.utils.mode_checks import (
+    in_fips_environment,
+    skip_debug_mode,
+    skip_file_in_cdt,
+)
 from rptest.utils.utf8 import CONTROL_CHARS_MAP
 
 
@@ -2447,3 +2451,9 @@ def test_fetch_consumer_group(self):
         assert item["offset"] == produced_offset, (
             "Pandaproxy consumer fetch consumed the wrong offset"
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="pandaproxy HTTP-API suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/rbac_test.py

@@ -37,7 +37,7 @@
 from rptest.tests.redpanda_test import RedpandaTest
 from rptest.util import expect_exception, expect_http_error, wait_until_result
 from rptest.utils.log_utils import wait_until_nag_is_set
-from rptest.utils.mode_checks import skip_fips_mode
+from rptest.utils.mode_checks import skip_fips_mode, skip_file_in_cdt
 
 ALICE = SaslCredentials("alice", "itsMeH0nest012", "SCRAM-SHA-256")
 
@@ -1231,3 +1231,9 @@ def test_role_survives_restart(self):
             backoff_sec=1,
             retry_on_exc=True,
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="RBAC suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/redpanda_oauth_test.py

@@ -53,7 +53,7 @@
 from rptest.tests.tls_metrics_test import FaketimeTLSProvider
 from rptest.util import expect_exception, wait_until_result
 from rptest.utils.log_utils import wait_until_nag_is_set
-from rptest.utils.mode_checks import skip_fips_mode
+from rptest.utils.mode_checks import skip_fips_mode, skip_file_in_cdt
 
 CLIENT_ID = "myapp"
 TOKEN_AUDIENCE = "account"
@@ -2331,3 +2331,9 @@ def test_license_nag(self, authn_config):
             timeout_sec=self.LICENSE_CHECK_INTERVAL_SEC * 2,
             err_msg="License nag failed to appear",
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="OAuth/OIDC auth suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/schema_registry_test.py

@@ -68,7 +68,11 @@
     wait_until_result,
 )
 from rptest.utils.log_utils import wait_until_nag_is_set
-from rptest.utils.mode_checks import skip_debug_mode, skip_fips_mode
+from rptest.utils.mode_checks import (
+    skip_debug_mode,
+    skip_file_in_cdt,
+    skip_fips_mode,
+)
 
 Headers: TypeAlias = dict[str, str] | None
 
@@ -11947,3 +11951,13 @@ def test_transport_compatibility(self):
 
         self._flip_transport(use_rpc=False)
         self._verify_phase(after_rpc2, "kafka2", "Kafka2Rec", n)
+
+
+# Opt the entire schema-registry HTTP-API suite out of CDT: it is exhaustive and
+# adds significant runtime on real cloud infra without adding any cloud-infra
+# coverage (the dockerized CI run already exercises it end to end). The test
+# methods live on the base classes above; skip_file_in_cdt marks each module
+# class's own methods, so the thin concrete subclasses inherit the mark.
+skip_file_in_cdt(
+    reason="exhaustive SR HTTP-API suite; no cloud-infra signal (dockerized CI covers it)"
+)

tests/rptest/tests/scram_test.py

@@ -56,7 +56,7 @@
 )
 from rptest.util import expect_exception, expect_http_error
 from rptest.utils.log_utils import wait_until_nag_is_set
-from rptest.utils.mode_checks import in_fips_environment
+from rptest.utils.mode_checks import in_fips_environment, skip_file_in_cdt
 from rptest.utils.utf8 import (
     generate_string_with_control_character,
 )
@@ -1668,3 +1668,9 @@ def test_scram_reauth(self):
         )
         assert REAUTH_METRIC in metrics.keys()
         assert metrics[REAUTH_METRIC] > 0, "Expected client reauth on some broker..."
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="SASL/SCRAM auth suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)

tests/rptest/tests/security_report_test.py

@@ -30,7 +30,7 @@
     AuditLogTestBase,
     AuditLogTestSecurityConfig,
 )
-from rptest.utils.mode_checks import skip_fips_mode
+from rptest.utils.mode_checks import skip_fips_mode, skip_file_in_cdt
 
 
 def make_from_dict(class_name, values):
@@ -1088,3 +1088,9 @@ def test_security_report(self):
             },
             audit_log_expected=audit_log_expected,
         )
+
+
+# No-cloud suite: opt out of CDT (dockerized CI already covers it).
+skip_file_in_cdt(
+    reason="security-report suite: no cloud-infra signal in CDT; dockerized CI covers it"
+)