Repository: openshift/cert-manager-operator
Pull request #257: CM-485: migrate Go testing e2e cases to Ginkgo framework
Author: login: lunarwhite
Labels: name: lgtm
description: Indicates that a PR is ready to be merged.
name: qe-approved
description: Signifies that QE has signed off on this PR
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: docs-approved
description: Signifies that Docs has signed off on this PR
name: px-approved
description: Signifies that Product Support has signed off on this PR
name: jira/valid-reference
description: Indicates that this PR references a valid Jira ticket of any type.
Created: 2025-03-19T05:20:30Z | Merged: 2025-04-02T15:06:52Z

Motivation:

Due to historical reasons, this repo currently has two e2e test frameworks: Go testing and the Ginkgo & Gomega. For e2e testing, Ginkgo offers several advantages over raw Go testing in following aspects: structured organization, selective case execution, readability, logging/result tracking. We also recommend using Ginkgo when add new test cases. Maintaining two separate frameworks introduces additional overhead over time.

Reviewing cases utilized Go testing: https://github.com/openshift/cert-manager-operator/blob/master/test/e2e/cert_manager_deployment_test.go

- `TestSelfSignedCerts`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L697-L698
- `TestACMECertsIngress`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L588-L589
- `TestCertRenew`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L736
- `TestContainerOverrides`, partially covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/overrides_test.go#L148-L150

Most test cases that use Go testing are also covered in the Ginkgo, except for [OverrideEnv](https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/cert_manager_deployment_test.go#L398) tests.

Main changes:

- Add e2e cases for `overrideEnv` config into Override tests suite
- Cleanup legacy Go testing cases and associated functions
- Replace [deprecated](https://pkg.go.dev/k8s.io/apimachinery/pkg/util/wait#PollImmediate) `wait.PollImmediate` with `wait.PollUntilContextTimeout`



Diff:
diff --git a/test/e2e/cert_manager_deployment_test.go b/test/e2e/cert_manager_deployment_test.go
deleted file mode 100644
index 06de87257..000000000
--- a/test/e2e/cert_manager_deployment_test.go
+++ /dev/null
@@ -1,453 +0,0 @@
-//go:build e2e
-// +build e2e
-
-package e2e
-
-import (
-	"context"
-	"embed"
-	"path/filepath"
-	"testing"
-	"time"
-
-	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	k8sresource "k8s.io/apimachinery/pkg/api/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/wait"
-
-	opv1 "github.com/openshift/api/operator/v1"
-	configv1 "github.com/openshift/client-go/config/clientset/versioned/typed/config/v1"
-
-	"github.com/openshift/cert-manager-operator/api/operator/v1alpha1"
-	certmanoperatorclient "github.com/openshift/cert-manager-operator/pkg/operator/clientset/versioned"
-	"github.com/openshift/cert-manager-operator/test/library"
-
-	certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
-	certmanagermetav1 "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
-	certmanagerclientset "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned"
-	"github.com/stretchr/testify/require"
-)
-
-const (
-	PollInterval = 5 * time.Second
-	TestTimeout  = 10 * time.Minute
-)
-
-//go:embed testdata/*
-var testassets embed.FS
-
-func TestSelfSignedCerts(t *testing.T) {
-	ctx := context.Background()
-	loader := library.NewDynamicResourceLoader(ctx, t)
-
-	ns, err := loader.CreateTestingNS("e2e-self-signed-cert", false)
-	require.NoError(t, err)
-	defer loader.DeleteTestingNS(ns.Name, t.Failed)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "cluster_issuer.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "cluster_issuer.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "issuer.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "issuer.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "certificate.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "certificate.yaml"), ns.Name)
-
-	err = wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
-		// TODO: The loader.KubeClient might be worth splitting out. Let's see once we have more tests.
-		secret, err := loader.KubeClient.CoreV1().Secrets(ns.Name).Get(ctx, "root-secret", metav1.GetOptions{})
-		if errors.IsNotFound(err) {
-			t.Logf("Unable to retrieve the root secret: %v", err)
-			return false, nil
-		}
-		if err != nil {
-			return false, err
-		}
-		return library.VerifySecretNotNull(secret)
-	})
-	require.NoError(t, err)
-}
-
-func TestACMECertsIngress(t *testing.T) {
-	ctx := context.Background()
-	loader := library.NewDynamicResourceLoader(ctx, t)
-	config, err := library.GetConfigForTest(t)
-	require.NoError(t, err)
-
-	ns, err := loader.CreateTestingNS("e2e-acme-ingress-cert", false)
-	require.NoError(t, err)
-	defer loader.DeleteTestingNS(ns.Name, t.Failed)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
-
-	configClient, err := configv1.NewForConfig(config)
-	require.NoError(t, err)
-	baseDomain, err := library.GetClusterBaseDomain(ctx, configClient)
-	require.NoError(t, err)
-	appsDomain := "apps." + baseDomain
-
-	ingress_host := "eaic." + appsDomain
-	path_type := networkingv1.PathTypePrefix
-	ingress := &networkingv1.Ingress{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "networking.k8s.io/v1",
-			Kind:       "Ingress",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "ingress-le-prod",
-			Namespace: ns.Name,
-			Annotations: map[string]string{
-				"cert-manager.io/cluster-issuer":            "letsencrypt-prod",
-				"acme.cert-manager.io/http01-ingress-class": "openshift-default",
-			},
-		},
-		Spec: networkingv1.IngressSpec{
-			Rules: []networkingv1.IngressRule{
-				{
-					Host: ingress_host,
-					IngressRuleValue: networkingv1.IngressRuleValue{
-						HTTP: &networkingv1.HTTPIngressRuleValue{
-							Paths: []networkingv1.HTTPIngressPath{
-								{
-									Path:     "/",
-									PathType: &path_type,
-									Backend:  networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "hello-openshift", Port: networkingv1.ServiceBackendPort{Number: 8080}}},
-								},
-							},
-						},
-					},
-				},
-			},
-			TLS: []networkingv1.IngressTLS{{
-				Hosts:      []string{ingress_host},
-				SecretName: "ingress-prod-secret",
-			}},
-		},
-	}
-	ingress, err = loader.KubeClient.NetworkingV1().Ingresses(ingress.ObjectMeta.Namespace).Create(ctx, ingress, metav1.CreateOptions{})
-	require.NoError(t, err)
-	defer loader.KubeClient.NetworkingV1().Ingresses(ingress.ObjectMeta.Namespace).Delete(ctx, ingress.ObjectMeta.Name, metav1.DeleteOptions{})
-
-	err = wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
-		secret, err := loader.KubeClient.CoreV1().Secrets(ingress.ObjectMeta.Namespace).Get(ctx, "ingress-prod-secret", metav1.GetOptions{})
-		tlsConfig, isvalid := library.GetTLSConfig(secret)
-		if !isvalid {
-			t.Logf("Unable to retrieve the TLS config: %v", err)
-			return false, nil
-		}
-		is_host_correct, err := library.VerifyHostname(ingress_host, tlsConfig.Clone())
-		if err != nil {
-			t.Logf("Host: %v", err)
-			return false, nil
-		}
-		is_not_expired, err := library.VerifyExpiry(ingress_host+":443", tlsConfig.Clone())
-		if err != nil {
-			t.Logf("Expired: %v", err)
-			return false, nil
-		}
-		return is_host_correct && is_not_expired, nil
-	})
-	require.NoError(t, err)
-}
-
-func TestCertRenew(t *testing.T) {
-	ctx := context.Background()
-	loader := library.NewDynamicResourceLoader(ctx, t)
-	config, err := library.GetConfigForTest(t)
-	require.NoErrorf(t, err, "failed to fetch host configuration: %v", err)
-
-	ns, err := loader.CreateTestingNS("e2e-cert-renew", false)
-	require.NoErrorf(t, err, "failed to create namespace: %v", err)
-	defer loader.DeleteTestingNS(ns.Name, t.Failed)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "cluster_issuer.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "cluster_issuer.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "issuer.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "issuer.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "certificate.yaml"), ns.Name)
-	defer loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "certificate.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
-	loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
-	defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
-
-	configClient, err := configv1.NewForConfig(config)
-	require.NoErrorf(t, err, "failed to create config client: %v", err)
-	baseDomain, err := library.GetClusterBaseDomain(ctx, configClient)
-	require.NoErrorf(t, err, "failed to fetch cluster base domain: %v", err)
-	appsDomain := "apps." + baseDomain
-
-	ingressHost := "ecr." + appsDomain
-	pathType := networkingv1.PathTypePrefix
-	ingress := &networkingv1.Ingress{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "networking.k8s.io/v1",
-			Kind:       "Ingress",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "frontend",
-			Namespace: ns.Name,
-		},
-		Spec: networkingv1.IngressSpec{
-			Rules: []networkingv1.IngressRule{
-				{
-					Host: ingressHost,
-					IngressRuleValue: networkingv1.IngressRuleValue{
-						HTTP: &networkingv1.HTTPIngressRuleValue{
-							Paths: []networkingv1.HTTPIngressPath{
-								{
-									Path:     "/",
-									PathType: &pathType,
-									Backend:  networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "hello-openshift", Port: networkingv1.ServiceBackendPort{Number: 8080}}},
-								},
-							},
-						},
-					},
-				},
-			},
-			TLS: []networkingv1.IngressTLS{{
-				Hosts:      []string{ingressHost},
-				SecretName: "selfsigned-server-cert-tls",
-			}},
-		},
-	}
-	ingress, err = loader.KubeClient.NetworkingV1().Ingresses(ingress.ObjectMeta.Namespace).Create(ctx, ingress, metav1.CreateOptions{})
-	require.NoErrorf(t, err, "failed to create Ingress: %v", err)
-	defer loader.KubeClient.NetworkingV1().Ingresses(ingress.ObjectMeta.Namespace).Delete(ctx, ingress.ObjectMeta.Name, metav1.DeleteOptions{})
-
-	var (
-		certDuration        = time.Hour
-		renewBeforeDuration = time.Minute * 59
-	)
-	crt := &certmanagerv1.Certificate{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "selfsigned-server-cert",
-			Namespace: ns.Name,
-		},
-		Spec: certmanagerv1.CertificateSpec{
-			DNSNames:    []string{ingressHost, "server"},
-			SecretName:  "selfsigned-server-cert-tls",
-			IsCA:        false,
-			Duration:    &metav1.Duration{Duration: certDuration},
-			RenewBefore: &metav1.Duration{Duration: renewBeforeDuration},
-			Usages:      []certmanagerv1.KeyUsage{certmanagerv1.UsageServerAuth},
-			IssuerRef: certmanagermetav1.ObjectReference{
-				Name:  "my-ca-issuer",
-				Kind:  "Issuer",
-				Group: "cert-manager.io",
-			},
-		},
-	}
-
-	certmanagerv1Client, err := certmanagerclientset.NewForConfig(config)
-	require.NoErrorf(t, err, "failed to create cert manager client: %v", err)
-	_, err = certmanagerv1Client.CertmanagerV1().Certificates(crt.Namespace).Create(ctx, crt, metav1.CreateOptions{})
-	require.NoError(t, err, "failed to create certificate: %v", err)
-	defer certmanagerv1Client.CertmanagerV1().Certificates(crt.Namespace).Delete(ctx, crt.Name, metav1.DeleteOptions{})
-
-	err = waitForCertificateReadinessWithClient(ctx, certmanagerv1Client, crt.Name, crt.Namespace)
-	require.NoError(t, err, "failed while waiting for certificate to be ready: %v", err)
-	err = waitForIngressReadiness(ctx, loader.KubeClient, *ingress, appsDomain)
-	require.NoErrorf(t, err, "failed while waiting for ingress to be ready: %v", err)
-
-	secret, err := loader.KubeClient.CoreV1().Secrets(ns.Name).Get(ctx, crt.Spec.SecretName, metav1.GetOptions{})
-	require.NoError(t, err, "failed to fetch secret containing the certificate: %v", err)
-	tlsConfig, isValid := library.GetTLSConfig(secret)
-	require.Truef(t, isValid, "failed to validate certificate stored in the secret")
-
-	expiryTime, err := library.GetCertExpiry(ingressHost+":443", tlsConfig.Clone())
-	require.NoError(t, err, "failed to establish a test connection: %v", err)
-	t.Logf("newly created Certificate's NotAfter: %v", expiryTime)
-
-	err = wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
-		secret, _ = loader.KubeClient.CoreV1().Secrets(ns.Name).Get(ctx, crt.Spec.SecretName, metav1.GetOptions{})
-		tlsConfig, isValid = library.GetTLSConfig(secret)
-		if !isValid {
-			return false, nil
-		}
-
-		isHostCorrect, err := library.VerifyHostname(ingressHost, tlsConfig.Clone())
-		if err != nil {
-			t.Errorf("Host %v", err)
-			return false, nil
-		}
-
-		isNotExpired, err := library.VerifyExpiry(ingressHost+":443", tlsConfig.Clone())
-		if err != nil {
-			t.Errorf("Expiry %v", err)
-			return false, nil
-		}
-
-		// include grace time for certificate rotation and for secret change propagation to
-		// the pod, to the sleep time.
-		timeUntil := (time.Until(expiryTime) - renewBeforeDuration) + time.Second*30
-		time.Sleep(timeUntil)
-
-		secret, _ = loader.KubeClient.CoreV1().Secrets(ns.Name).Get(ctx, crt.Spec.SecretName, metav1.GetOptions{})
-		tlsConfig, isValid = library.GetTLSConfig(secret)
-		if !isValid {
-			return false, nil
-		}
-
-		expiryTimeNew, err := library.GetCertExpiry(ingressHost+":443", tlsConfig.Clone())
-		t.Logf("expected to be renewed Certificate's NotAfter: %v", expiryTimeNew)
-		if err != nil {
-			return false, nil
-		}
-
-		isCertRenewed := expiryTimeNew.After(expiryTime)
-		if !isCertRenewed {
-			t.Logf("certificate's NotAfter unchanged, old: %v, new: %v", expiryTime, expiryTimeNew)
-		}
-		return isHostCorrect && isNotExpired && isCertRenewed, nil
-	})
-	require.NoErrorf(t, err, "TestCertRenew failed with err: %v", err)
-}
-
-func TestContainerOverrides(t *testing.T) {
-	ctx := context.Background()
-	config, err := library.GetConfigForTest(t)
-	require.NoError(t, err)
-
-	certmanageroperatorclient, err := certmanoperatorclient.NewForConfig(config)
-	require.NoError(t, err)
-
-	operator, err := certmanageroperatorclient.OperatorV1alpha1().CertManagers().Get(ctx, "cluster", metav1.GetOptions{})
-	require.NoError(t, err)
-	defer func() {
-		err := resetCertManagerState(ctx, certmanageroperatorclient, library.NewDynamicResourceLoader(ctx, t))
-		require.NoError(t, err)
-	}()
-
-	verifyValidControllerOperatorStatus(t, certmanageroperatorclient)
-	updatedOperator := operator.DeepCopy()
-
-	addValidControlleDeploymentConfig(updatedOperator)
-	_, err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Update(ctx, updatedOperator, metav1.UpdateOptions{})
-	require.NoError(t, err)
-
-	verifyValidControllerOperatorStatus(t, certmanageroperatorclient)
-
-	err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Delete(ctx, "cluster", metav1.DeleteOptions{})
-	require.NoError(t, err)
-
-	verifyValidControllerOperatorStatus(t, certmanageroperatorclient)
-
-	operator, err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Get(ctx, "cluster", metav1.GetOptions{})
-	require.NoError(t, err)
-
-	updatedOperator = operator.DeepCopy()
-	addInvalidControlleOverrideEnv(updatedOperator)
-	_, err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Update(ctx, updatedOperator, metav1.UpdateOptions{})
-	require.NoError(t, err)
-
-	verifyInvalidControllerOperatorStatus(t, certmanageroperatorclient)
-
-	// reset operator spec
-	operator, err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Get(ctx, "cluster", metav1.GetOptions{})
-	require.NoError(t, err)
-
-	updatedOperator = operator.DeepCopy()
-	updatedOperator.Spec = v1alpha1.CertManagerSpec{
-		OperatorSpec: opv1.OperatorSpec{
-			ManagementState: opv1.Managed,
-		},
-	}
-	_, err = certmanageroperatorclient.OperatorV1alpha1().CertManagers().Update(ctx, updatedOperator, metav1.UpdateOptions{})
-	require.NoError(t, err)
-}
-
-func verifyValidControllerOperatorStatus(t *testing.T, client *certmanoperatorclient.Clientset) {
-
-	t.Log("verifying valid controller operator status")
-	err := wait.PollImmediate(time.Second*5, time.Minute*5, func() (done bool, err error) {
-		operator, err := client.OperatorV1alpha1().CertManagers().Get(context.TODO(), "cluster", metav1.GetOptions{})
-		if err != nil {
-			return false, err
-		}
-
-		if operator.DeletionTimestamp != nil {
-			return false, nil
-		}
-
-		flag := false
-		for _, cond := range operator.Status.Conditions {
-			if cond.Type == "cert-manager-controller-deploymentAvailable" {
-				flag = cond.Status == opv1.ConditionTrue
-			}
-
-			if cond.Type == "cert-manager-controller-deploymentDegraded" {
-				flag = cond.Status == opv1.ConditionFalse
-			}
-
-			if cond.Type == "cert-manager-controller-deploymentProgressing" {
-				flag = cond.Status == opv1.ConditionFalse
-			}
-		}
-
-		t.Logf("Current poll status: %v", flag)
-		return flag, nil
-	})
-	require.NoError(t, err)
-}
-
-func addValidControlleDeploymentConfig(operator *v1alpha1.CertManager) {
-	operator.Spec.ControllerConfig = &v1alpha1.DeploymentConfig{
-		OverrideEnv: []corev1.EnvVar{
-			{
-				Name:  "HTTP_PROXY",
-				Value: "172.0.0.10:8080",
-			},
-		},
-		OverrideResources: v1alpha1.CertManagerResourceRequirements{
-			Limits: corev1.ResourceList{
-				corev1.ResourceCPU:    k8sresource.MustParse("500m"),
-				corev1.ResourceMemory: k8sresource.MustParse("128Mi"),
-			},
-			Requests: corev1.ResourceList{
-				corev1.ResourceCPU:    k8sresource.MustParse("10m"),
-				corev1.ResourceMemory: k8sresource.MustParse("32Mi"),
-			},
-		},
-	}
-}
-
-func addInvalidControlleOverrideEnv(operator *v1alpha1.CertManager) {
-	operator.Spec.ControllerConfig = &v1alpha1.DeploymentConfig{
-		OverrideEnv: []corev1.EnvVar{
-			{
-				Name:  "FOO",
-				Value: "BAR",
-			},
-		},
-	}
-}
-
-func verifyInvalidControllerOperatorStatus(t *testing.T, client *certmanoperatorclient.Clientset) {
-	t.Log("verifying invalid controller operator status")
-	err := wait.PollImmediate(time.Second*5, time.Minute*5, func() (done bool, err error) {
-
-		operator, err := client.OperatorV1alpha1().CertManagers().Get(context.TODO(), "cluster", metav1.GetOptions{})
-		if err != nil {
-			return false, err
-		}
-
-		if operator.DeletionTimestamp != nil {
-			return false, nil
-		}
-
-		flag := false
-		for _, cond := range operator.Status.Conditions {
-			if cond.Type == "cert-manager-controller-deploymentDegraded" {
-				flag = cond.Status == opv1.ConditionTrue
-			}
-		}
-
-		t.Logf("Current poll status: %v", flag)
-		return flag, nil
-	})
-	require.NoError(t, err)
-
-}
diff --git a/test/e2e/certificates_test.go b/test/e2e/certificates_test.go
index 3dcc6d0fb..3e0809ea1 100644
--- a/test/e2e/certificates_test.go
+++ b/test/e2e/certificates_test.go
@@ -195,7 +195,7 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "credentials", "credentialsrequest_aws.yaml"), "")
 
 			By("waiting for cloud secret to be available")
-			err := wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+			err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 				_, err := loader.KubeClient.CoreV1().Secrets("cert-manager").Get(ctx, "aws-creds", metav1.GetOptions{})
 				if err != nil {
 					return false, nil
@@ -288,7 +288,7 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "credentials", "credentialsrequest_aws.yaml"), "")
 
 			By("waiting for cloud secret to be available")
-			err := wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+			err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 				_, err := loader.KubeClient.CoreV1().Secrets("cert-manager").Get(ctx, "aws-creds", metav1.GetOptions{})
 				if err != nil {
 					return false, nil
@@ -488,7 +488,7 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			By("Waiting for cloud secret to be available")
 			// The name is defined cloud credential by the testdata YAML file.
 			credentialSecret := "gcp-credentials"
-			err := wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+			err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 				_, err := loader.KubeClient.CoreV1().Secrets("cert-manager").Get(ctx, credentialSecret, metav1.GetOptions{})
 				if err != nil {
 					return false, nil
@@ -592,11 +592,11 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
 			defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
 
-			By("creating an openshift-hello deployment")
+			By("creating an hello-openshift deployment")
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
 			defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "deployment.yaml"), ns.Name)
 
-			By("creating a service for the deployment openshift-hello")
+			By("creating a service for the deployment hello-openshift")
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
 			defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "service.yaml"), ns.Name)
 
@@ -645,7 +645,7 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			defer loader.KubeClient.NetworkingV1().Ingresses(ingress.ObjectMeta.Namespace).Delete(ctx, ingress.ObjectMeta.Name, metav1.DeleteOptions{})
 
 			By("checking TLS certificate contents")
-			err = wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+			err = wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 				secret, err := loader.KubeClient.CoreV1().Secrets(ingress.ObjectMeta.Namespace).Get(ctx, secretName, metav1.GetOptions{})
 				tlsConfig, isvalid := library.GetTLSConfig(secret)
 				if !isvalid {
@@ -740,14 +740,15 @@ var _ = Describe("Self-signed Certificate", Ordered, func() {
 			defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "issuer.yaml"), ns.Name)
 
 			By("creating a certificate using the CA Issuer")
+			certName := "renewable-ca-issued-cert"
 			cert := &certmanagerv1.Certificate{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "renewable-ca-issued-cert",
+					Name:      certName,
 					Namespace: ns.Name,
 				},
 				Spec: certmanagerv1.CertificateSpec{
 					DNSNames:    []string{"sample-renewable-cert"},
-					SecretName:  "renewable-ca-issued-cert",
+					SecretName:  certName,
 					IsCA:        false,
 					Duration:    &metav1.Duration{Duration: time.Hour},
 					RenewBefore: &metav1.Duration{Duration: time.Minute * 59}, // essentially becomes a renewal loop of 1min
@@ -760,10 +761,10 @@ var _ = Describe("Self-signed Certificate", Ordered, func() {
 			}
 			cert, err := certmanagerClient.CertmanagerV1().Certificates(ns.Name).Create(ctx, cert, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
-			defer certmanagerClient.CertmanagerV1().Certificates(ns.Name).Delete(ctx, cert.Name, metav1.DeleteOptions{})
+			defer certmanagerClient.CertmanagerV1().Certificates(ns.Name).Delete(ctx, certName, metav1.DeleteOptions{})
 
 			By("waiting for certificate to get ready")
-			err = waitForCertificateReadiness(ctx, "renewable-ca-issued-cert", ns.Name)
+			err = waitForCertificateReadiness(ctx, certName, ns.Name)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("certificate was renewed atleast once")
diff --git a/test/e2e/overrides_test.go b/test/e2e/overrides_test.go
index 000d36c86..f577c7bd8 100644
--- a/test/e2e/overrides_test.go
+++ b/test/e2e/overrides_test.go
@@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", func() {
+
+		It("should add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "HTTP_PROXY", Value: "http://proxy.example.com:8080"}, {Name: "HTTPS_PROXY", Value: "http://proxy.example.com:8088"}, {Name: "NO_PROXY", Value: "localhost"}}
+			err := addOverrideEnv(certmanageroperatorclient, certmanagerControllerDeployment, env)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Waiting for cert-manager controller status to become available")
+			err = verifyOperatorStatusCondition(certmanageroperatorclient, []string{certManagerControllerDeploymentControllerName}, validOperatorStatusConditions)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Waiting for the env to be added to the cert-manager controller deployment")
+			err = verifyDeploymentEnv(k8sClientSet, certmanagerControllerDeployment, env, true)
+			Expect(err).NotTo(HaveOccurred())
+		})
+	})
+
+	Context("When adding invalid cert-manager controller override env", func() {
+
+		It("should not add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "FOO", Value: "BAR"}}
+			err := addOverrideEnv(certmanageroperatorclient, certmanagerControllerDeployment, env)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Waiting for cert-manager controller status to become degraded")
+			err = verifyOperatorStatusCondition(certmanageroperatorclient, []string{certManagerControllerDeploymentControllerName}, invalidOperatorStatusConditions)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Checking if the env are not added to the cert-manager controller deployment")
+			err = verifyDeploymentEnv(k8sClientSet, certmanagerControllerDeployment, env, false)
+			Expect(err).NotTo(HaveOccurred())
+		})
+	})
+
 	AfterAll(func() {
 		By("Reset cert-manager state")
 		err := resetCertManagerState(context.Background(), certmanageroperatorclient, loader)
diff --git a/test/e2e/utils_test.go b/test/e2e/utils_test.go
index 438fae25d..fe378758d 100644
--- a/test/e2e/utils_test.go
+++ b/test/e2e/utils_test.go
@@ -6,17 +6,16 @@ package e2e
 import (
 	"bytes"
 	"context"
+	"embed"
 	"encoding/json"
 	"fmt"
 	"math/rand"
-	"regexp"
 	"strings"
 	"sync"
 	"time"
 
 	cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 	cmmetav1 "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
-	certmanagerclientset "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	opv1 "github.com/openshift/api/operator/v1"
@@ -28,7 +27,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -45,6 +43,14 @@ import (
 	"k8s.io/client-go/util/retry"
 )
 
+const (
+	PollInterval = 5 * time.Second
+	TestTimeout  = 10 * time.Minute
+)
+
+//go:embed testdata/*
+var testassets embed.FS
+
 var subscriptionSchema = schema.GroupVersionResource{
 	Group:    "operators.coreos.com",
 	Version:  "v1alpha1",
@@ -62,7 +68,7 @@ func verifyOperatorStatusCondition(client *certmanoperatorclient.Clientset, cont
 		wg.Add(1)
 		go func(index int) {
 			defer wg.Done()
-			err := wait.PollImmediate(time.Second*1, time.Minute*5, func() (done bool, err error) {
+			err := wait.PollUntilContextTimeout(context.TODO(), time.Second*1, time.Minute*5, true, func(context.Context) (bool, error) {
 				operator, err := client.OperatorV1alpha1().CertManagers().Get(context.TODO(), "cluster", metav1.GetOptions{})
 				if err != nil {
 					if apierrors.IsNotFound(err) {
@@ -98,7 +104,7 @@ func resetCertManagerState(ctx context.Context, client *certmanoperatorclient.Cl
 	// update operator spec to empty *Config and set operatorSpec to default values
 	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		var operatorState *v1alpha1.CertManager
-		err := wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+		err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 			operator, err := client.OperatorV1alpha1().CertManagers().Get(ctx, "cluster", metav1.GetOptions{})
 			if err != nil {
 				if apierrors.IsNotFound(err) {
@@ -189,7 +195,7 @@ func addOverrideArgs(client *certmanoperatorclient.Clientset, deploymentName str
 // the deployment args list.
 func verifyDeploymentArgs(k8sclient *kubernetes.Clientset, deploymentName string, args []string, added bool) error {
 
-	return wait.PollImmediate(time.Second*1, time.Minute*5, func() (done bool, err error) {
+	return wait.PollUntilContextTimeout(context.TODO(), time.Second*1, time.Minute*5, true, func(context.Context) (bool, error) {
 		controllerDeployment, err := k8sclient.AppsV1().Deployments(operandNamespace).Get(context.TODO(), deploymentName, metav1.GetOptions{})
 		if err != nil {
 			if apierrors.IsNotFound(err) {
@@ -202,7 +208,7 @@ func verifyDeploymentArgs(k8sclient *kubernetes.Clientset, deploymentName string
 			return false, fmt.Errorf("%s deployment spec does not have container information", deploymentName)
 		}
 
-		containerArgsSet := sets.New[string](controllerDeployment.Spec.Template.Spec.Containers[0].Args...)
+		containerArgsSet := sets.New(controllerDeployment.Spec.Template.Spec.Containers[0].Args...)
 
 		if added {
 			if !containerArgsSet.HasAll(args...) {
@@ -218,6 +224,73 @@ func verifyDeploymentArgs(k8sclient *kubernetes.Clientset, deploymentName string
 	})
 }
 
+// addOverrideEnv adds the override environment variables to specific the cert-manager operand. The update process
+// is retried if a conflict error is encountered.
+func addOverrideEnv(client *certmanoperatorclient.Clientset, deploymentName string, env []corev1.EnvVar) error {
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		operator, err := client.OperatorV1alpha1().CertManagers().Get(context.TODO(), "cluster", metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+
+		updatedOperator := operator.DeepCopy()
+
+		switch deploymentName {
+		case certmanagerControllerDeployment:
+			updatedOperator.Spec.ControllerConfig = &v1alpha1.DeploymentConfig{
+				OverrideEnv: env,
+			}
+		case certmanagerWebhookDeployment:
+			updatedOperator.Spec.WebhookConfig = &v1alpha1.DeploymentConfig{
+				OverrideEnv: env,
+			}
+		case certmanagerCAinjectorDeployment:
+			updatedOperator.Spec.CAInjectorConfig = &v1alpha1.DeploymentConfig{
+				OverrideEnv: env,
+			}
+		default:
+			return fmt.Errorf("unsupported deployment name: %s", deploymentName)
+		}
+
+		_, err = client.OperatorV1alpha1().CertManagers().Update(context.TODO(), updatedOperator, metav1.UpdateOptions{})
+		return err
+	})
+}
+
+// verifyDeploymentEnv polls every 1 second to check if the deployment env list is updated to contain the
+// passed env. It returns an error if a timeout (5 mins) occurs or an error was encountered while polling
+// the deployment env list.
+func verifyDeploymentEnv(k8sclient *kubernetes.Clientset, deploymentName string, env []corev1.EnvVar, added bool) error {
+
+	return wait.PollUntilContextTimeout(context.TODO(), time.Second*1, time.Minute*5, true, func(context.Context) (bool, error) {
+		controllerDeployment, err := k8sclient.AppsV1().Deployments(operandNamespace).Get(context.TODO(), deploymentName, metav1.GetOptions{})
+		if err != nil {
+			if apierrors.IsNotFound(err) {
+				return false, nil
+			}
+			return false, err
+		}
+
+		if len(controllerDeployment.Spec.Template.Spec.Containers) == 0 {
+			return false, fmt.Errorf("%s deployment spec does not have container information", deploymentName)
+		}
+
+		containerEnvList := sets.New(controllerDeployment.Spec.Template.Spec.Containers[0].Env...)
+
+		if added {
+			if !containerEnvList.HasAll(env...) {
+				return false, nil
+			}
+		} else {
+			if containerEnvList.HasAll(env...) {
+				return false, nil
+			}
+		}
+
+		return true, nil
+	})
+}
+
 // addOverrideResources adds the override resources to the specific cert-manager operand. The update process
 // is retried if a conflict error is encountered.
 func addOverrideResources(client *certmanoperatorclient.Clientset, deploymentName string, res v1alpha1.CertManagerResourceRequirements) error {
@@ -256,7 +329,7 @@ func addOverrideResources(client *certmanoperatorclient.Clientset, deploymentNam
 // polling the deployment resources.
 func verifyDeploymentResources(k8sclient *kubernetes.Clientset, deploymentName string, res v1alpha1.CertManagerResourceRequirements, added bool) error {
 
-	return wait.PollImmediate(time.Second*10, time.Minute*5, func() (done bool, err error) {
+	return wait.PollUntilContextTimeout(context.TODO(), time.Second*10, time.Minute*5, true, func(context.Context) (bool, error) {
 		controllerDeployment, err := k8sclient.AppsV1().Deployments(operandNamespace).Get(context.TODO(), deploymentName, metav1.GetOptions{})
 		if err != nil {
 			if apierrors.IsNotFound(err) {
@@ -327,7 +400,7 @@ func addOverrideScheduling(client *certmanoperatorclient.Clientset, deploymentNa
 // polling the deployment scheduling.
 func verifyDeploymentScheduling(k8sclient *kubernetes.Clientset, deploymentName string, res v1alpha1.CertManagerScheduling, added bool) error {
 
-	return wait.PollUntilContextTimeout(context.Background(), time.Second*10, time.Minute*5, true, func(context.Context) (done bool, err error) {
+	return wait.PollUntilContextTimeout(context.TODO(), time.Second*10, time.Minute*5, true, func(context.Context) (bool, error) {
 		controllerDeployment, err := k8sclient.AppsV1().Deployments(operandNamespace).Get(context.TODO(), deploymentName, metav1.GetOptions{})
 		if err != nil {
 			if apierrors.IsNotFound(err) {
@@ -438,7 +511,7 @@ func patchSubscriptionWithEnvVars(ctx context.Context, loader library.DynamicRes
 // waitForCertificateReadiness polls the status of the Certificate object and returns non-nil error
 // once the Ready condition is true, otherwise should return a time-out error
 func waitForCertificateReadiness(ctx context.Context, certName, namespace string) error {
-	return wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+	return wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		cert, err := certmanagerClient.CertmanagerV1().Certificates(namespace).Get(ctx, certName, metav1.GetOptions{})
 		if err != nil {
 			return false, nil
@@ -458,7 +531,7 @@ func waitForCertificateReadiness(ctx context.Context, certName, namespace string
 // - certificate hasn't expired
 // - certificate has subject CN matching provided hostname
 func verifyCertificate(ctx context.Context, secretName, namespace, hostname string) error {
-	return wait.PollImmediate(PollInterval, TestTimeout, func() (bool, error) {
+	return wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		secret, err := loader.KubeClient.CoreV1().Secrets(namespace).Get(ctx, secretName, metav1.GetOptions{})
 		if err != nil {
 			return false, nil
@@ -476,7 +549,7 @@ func verifyCertificate(ctx context.Context, secretName, namespace, hostname stri
 // and returns no error if certificate was renewed at least once
 func verifyCertificateRenewed(ctx context.Context, secretName, namespace string, pollDuration time.Duration) error {
 	var initExpiryTime *time.Time
-	return wait.PollImmediate(pollDuration, TestTimeout, func() (bool, error) {
+	return wait.PollUntilContextTimeout(context.TODO(), pollDuration, TestTimeout, true, func(context.Context) (bool, error) {
 		secret, err := loader.KubeClient.CoreV1().Secrets(namespace).Get(ctx, secretName, metav1.GetOptions{})
 		if err != nil {
 			return false, nil
@@ -519,65 +592,10 @@ func randomStr(size int) string {
 	return s.String()
 }
 
-// replace string in bytes of ReadFile
-func replaceStrInFile(replaceStrMap map[string]string, fileName string) ([]byte, error) {
-	bytes, err := testassets.ReadFile(fileName)
-	if err != nil {
-		return nil, err
-	}
-	fileContentsStr := string(bytes)
-	for k, v := range replaceStrMap {
-		fileContentsStr = strings.ReplaceAll(fileContentsStr, k, v)
-	}
-	return []byte(fileContentsStr), nil
-}
-
-// waitForCertificateReadinessWithClient polls the status of the Certificate object and returns non-nil error
-// once the Ready condition is true, otherwise should return a time-out error.
-func waitForCertificateReadinessWithClient(ctx context.Context, client *certmanagerclientset.Clientset, certName, namespace string) error {
-	return wait.PollUntilContextTimeout(ctx, PollInterval, 3*time.Minute, true, func(ctx context.Context) (bool, error) {
-		cert, err := client.CertmanagerV1().Certificates(namespace).Get(ctx, certName, metav1.GetOptions{})
-		if err != nil {
-			return false, nil
-		}
-
-		for _, cond := range cert.Status.Conditions {
-			if cond.Type == cmv1.CertificateConditionReady {
-				return cond.Status == cmmetav1.ConditionTrue, nil
-			}
-		}
-		return false, nil
-	})
-}
-
-// waitForIngressReadiness polls the status of the Ingress object and returns non-nil error
-// once the ingress endpoint is available, otherwise should return a time-out error.
-func waitForIngressReadiness(ctx context.Context, client kubernetes.Interface, ingressObj networkingv1.Ingress, domainName string) error {
-	return wait.PollUntilContextTimeout(ctx, PollInterval, 3*time.Minute, true, func(ctx context.Context) (bool, error) {
-		ingress, err := client.NetworkingV1().Ingresses(ingressObj.Namespace).Get(ctx, ingressObj.Name, metav1.GetOptions{})
-		if err != nil {
-			return false, nil
-		}
-
-		endpoints := ingress.Status.LoadBalancer.Ingress
-		if endpoints == nil {
-			return false, nil
-		}
-		for _, endpoint := range endpoints {
-			matched, err := regexp.MatchString(fmt.Sprintf(".%s$", domainName), endpoint.Hostname)
-			if err != nil {
-				return false, nil
-			}
-			return matched, nil
-		}
-		return false, nil
-	})
-}
-
 // pollTillJobCompleted poll the job object and returns non-nil error
 // once the job is completed, otherwise should return a time-out error
 func pollTillJobCompleted(ctx context.Context, clientset *kubernetes.Clientset, namespace, jobName string) error {
-	err := wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
+	err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		job, err := clientset.BatchV1().Jobs(namespace).Get(ctx, jobName, metav1.GetOptions{})
 
 		if err != nil {
@@ -602,7 +620,7 @@ func pollTillJobCompleted(ctx context.Context, clientset *kubernetes.Clientset,
 // pollTillServiceAccountAvailable poll the service account object and returns non-nil error
 // once the service account is available, otherwise should return a time-out error
 func pollTillServiceAccountAvailable(ctx context.Context, clientset *kubernetes.Clientset, namespace, serviceAccountName string) error {
-	err := wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
+	err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		_, err := clientset.CoreV1().ServiceAccounts(namespace).Get(ctx, serviceAccountName, metav1.GetOptions{})
 		if err != nil {
 			if apierrors.IsNotFound(err) {
@@ -621,7 +639,7 @@ func pollTillServiceAccountAvailable(ctx context.Context, clientset *kubernetes.
 // once the istiocsr is available, otherwise should return a time-out error
 func pollTillIstioCSRAvailable(ctx context.Context, dynamicClient *dynamic.DynamicClient, namespace, istioCsrName string) (v1alpha1.IstioCSRStatus, error) {
 	var istioCSRStatus v1alpha1.IstioCSRStatus
-	err := wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
+	err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		gvr := schema.GroupVersionResource{
 			Group:    "operator.openshift.io",
 			Version:  "v1alpha1",
@@ -662,8 +680,10 @@ func pollTillIstioCSRAvailable(ctx context.Context, dynamicClient *dynamic.Dynam
 	return istioCSRStatus, err
 }
 
+// pollTillDeploymentAvailable poll the deployment object and returns non-nil error
+// once the deployment is available, otherwise should return a time-out error
 func pollTillDeploymentAvailable(ctx context.Context, clientSet *kubernetes.Clientset, namespace, deploymentName string) error {
-	err := wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
+	err := wait.PollUntilContextTimeout(context.TODO(), PollInterval, TestTimeout, true, func(context.Context) (bool, error) {
 		deployment, err := clientSet.AppsV1().Deployments(namespace).Get(ctx, deploymentName, metav1.GetOptions{})
 		if err != nil {
 			return false, nil
diff --git a/test/library/cert_utils.go b/test/library/cert_utils.go
index ba5e1a77f..b7e91be9c 100644
--- a/test/library/cert_utils.go
+++ b/test/library/cert_utils.go
@@ -6,7 +6,6 @@ package library
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
 	"time"
@@ -74,30 +73,10 @@ func GetCertExpiry(hostname string, tlsConfig *tls.Config) (time.Time, error) {
 	return conn.ConnectionState().PeerCertificates[0].NotAfter, err
 }
 
-func GetCertIssuer(hostname string) (pkix.Name, error) {
-	conn, err := tls.Dial("tcp", hostname, nil)
-	conn.Close()
-	return conn.ConnectionState().PeerCertificates[0].Issuer, err
-}
-
 func VerifySecretNotNull(secret *corev1.Secret) (bool, error) {
 	return len(secret.Data["tls.crt"]) != 0 && len(secret.Data["tls.key"]) != 0, nil
 }
 
-func VerifyHostx509Cert(secret *corev1.Secret, hostname string) (bool, error) {
-	// TODO: verify cert using the x509 package WIP
-	cert, err := x509.ParseCertificates((secret.Data["tls.crt"]))
-	if err != nil {
-		return false, err
-	}
-	if cert[0].Verify(x509.VerifyOptions{
-		DNSName: hostname,
-	}); err != nil {
-		return false, err
-	}
-	return true, err
-}
-
 func VerifyCertificate(secret *corev1.Secret, commonName string) (bool, error) {
 	// check certificate is not null
 	isNotNull, err := VerifySecretNotNull(secret)
diff --git a/test/library/utils.go b/test/library/utils.go
index 989f140ed..83193a1ee 100644
--- a/test/library/utils.go
+++ b/test/library/utils.go
@@ -41,7 +41,7 @@ func (d DynamicResourceLoader) CreateTestingNS(namespacePrefix string, noSuffix
 	}
 
 	var got *corev1.Namespace
-	if err := wait.PollImmediate(1*time.Second, 30*time.Second, func() (bool, error) {
+	if err := wait.PollUntilContextTimeout(context.TODO(), 1*time.Second, 30*time.Second, true, func(context.Context) (bool, error) {
 		var err error
 		got, err = d.KubeClient.CoreV1().Namespaces().Create(context.Background(), namespace, metav1.CreateOptions{})
 		if err != nil {
@@ -66,7 +66,7 @@ func (d DynamicResourceLoader) DeleteTestingNS(name string, shouldDumpEvents fun
 		log.Printf("Error deleting namespace %v, err: %v", name, err)
 	}
 
-	if err := wait.PollImmediate(1*time.Second, 30*time.Second, func() (bool, error) {
+	if err := wait.PollUntilContextTimeout(context.TODO(), 1*time.Second, 30*time.Second, true, func(context.Context) (bool, error) {
 		// Poll until namespace is deleted
 		_, err := d.KubeClient.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
 		if err != nil && k8serrors.IsNotFound(err) {


Reviews:
user: login: swghosh
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-01T09:50:24Z
user: login: swghosh
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-02T12:05:35Z
user: login: swghosh
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-02T12:24:05Z
user: login: lunarwhite
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T12:37:03Z

Review comments:
diff_hunk: @@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", Label("Debug:Yes"), func() {
path: test/e2e/overrides_test.go
user: login: swghosh
body: Can you remove the `Label("Debug:Yes")` or we can look at adding that label for every other test case?
created_at: 2025-04-01T06:41:26Z
author_association: MEMBER
diff_hunk: @@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", Label("Debug:Yes"), func() {
+
+		It("should add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "HTTP_PROXY", Value: "172.0.0.10:8080"}, {Name: "HTTPS_PROXY", Value: "172.0.0.10:8088"}, {Name: "NO_PROXY", Value: "localhost"}}
path: test/e2e/overrides_test.go
user: login: swghosh
body: What is the significance of the 172.0.0.10 IP?
My understanding would be that certain clusters brought up in the proxy-flavor would use that IP as the upstream proxy host. But seems like we should atleast have the ability to customize it.

How about using a environment variable / flag?
And, default the value to a well known HTTP proxy on the internet (that works on regular clusters)?
created_at: 2025-04-01T06:43:46Z
author_association: MEMBER
diff_hunk: @@ -509,7 +509,7 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
-	Context("When adding invalid cert-manager controller override env", Label("Debug:Yes"), func() {
+	Context("When adding invalid cert-manager controller override env", func() {
path: test/e2e/overrides_test.go
user: login: swghosh
body: Similar here, regarding `Label("Debug:Yes")`.
created_at: 2025-04-01T09:48:51Z
author_association: MEMBER
diff_hunk: @@ -592,11 +592,11 @@ var _ = Describe("ACME Certificate", Ordered, func() {
 			loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
 			defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "acme", "clusterissuer.yaml"), ns.Name)
 
-			By("creating an openshift-hello deployment")
+			By("creating an hello-openshift deployment")
path: test/e2e/certificates_test.go
user: login: swghosh
body: This is good, but let's add all the non-`PollUntilContextTimeout` changes in a separate commit please.
created_at: 2025-04-01T09:49:59Z
author_association: MEMBER
diff_hunk: @@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", Label("Debug:Yes"), func() {
+
+		It("should add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "HTTP_PROXY", Value: "172.0.0.10:8080"}, {Name: "HTTPS_PROXY", Value: "172.0.0.10:8088"}, {Name: "NO_PROXY", Value: "localhost"}}
path: test/e2e/overrides_test.go
user: login: swghosh
body: Since the scope of testing here doesn't include running cases with the proxy setting enabled, and only validating the environment variables' key: any value should be fine.

Got confused seeing the 172.x.x.x local IP tbh,
Please disregard my earlier comment about the well known proxy field value, that's out of scope atleast today.
created_at: 2025-04-02T12:05:35Z
author_association: MEMBER
diff_hunk: @@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", Label("Debug:Yes"), func() {
+
+		It("should add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "HTTP_PROXY", Value: "172.0.0.10:8080"}, {Name: "HTTPS_PROXY", Value: "172.0.0.10:8088"}, {Name: "NO_PROXY", Value: "localhost"}}
path: test/e2e/overrides_test.go
user: login: swghosh
body: As discussed, to avoid confusion the value may be updated to "dummy.proxy.com".
created_at: 2025-04-02T12:24:05Z
author_association: MEMBER
diff_hunk: @@ -490,6 +490,44 @@ var _ = Describe("Overrides test", Ordered, func() {
 		})
 	})
 
+	Context("When adding valid cert-manager controller override env", Label("Debug:Yes"), func() {
+
+		It("should add the env to the cert-manager controller deployment", func() {
+
+			By("Adding cert-manager controller override env to the cert-managaer operator object")
+			env := []corev1.EnvVar{{Name: "HTTP_PROXY", Value: "172.0.0.10:8080"}, {Name: "HTTPS_PROXY", Value: "172.0.0.10:8088"}, {Name: "NO_PROXY", Value: "localhost"}}
path: test/e2e/overrides_test.go
user: login: lunarwhite
body: Updated with https://github.com/openshift/cert-manager-operator/compare/f85474f01d12ad781a7af67c789a3c8340c95c50..e22f21c33e0b6ff753d7f9a6ecc81ae9c8d4c1fb
created_at: 2025-04-02T12:37:03Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci-robot
created_at: 2025-03-19T05:20:34Z
body: @lunarwhite: This pull request references [CM-485](https://issues.redhat.com//browse/CM-485) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/cert-manager-operator/pull/257):

>Main changes:
>
>- Add e2e cases for `overrideEnv` config into Override tests suite
>- Cleanup legacy Go testing cases and associated functions
>- Replace deprecated `wait.PollImmediate` with `wait.PollUntilContextTimeout`
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcert-manager-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-03-19T06:17:36Z
body: @lunarwhite: This pull request references [CM-485](https://issues.redhat.com//browse/CM-485) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/cert-manager-operator/pull/257):

>Motivation:
>
>Due to historical reasons, this repo currently has two e2e test frameworks: Go testing and the Ginkgo & Gomega. For e2e testing, Ginkgo offers several advantages over raw Go testing in following aspects: structured organization, selective case execution, readability, logging/result tracking. We also recommend using Ginkgo when add new test cases. Maintaining two separate frameworks introduces additional overhead over time.
>
>Reviewing cases utilized Go testing: https://github.com/openshift/cert-manager-operator/blob/master/test/e2e/cert_manager_deployment_test.go
>
>- `TestSelfSignedCerts`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L697-L698
>- `TestACMECertsIngress`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L588-L589
>- `TestCertRenew`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L736
>- `TestContainerOverrides`, partially covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/overrides_test.go#L148-L150
>
>Most test cases that use Go testing are also covered in the Ginkgo, except for [OverrideEnv](https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/cert_manager_deployment_test.go#L398) tests.
>
>Main changes:
>
>- Add e2e cases for `overrideEnv` config into Override tests suite
>- Cleanup legacy Go testing cases and associated functions
>- Replace [deprecated](https://pkg.go.dev/k8s.io/apimachinery/pkg/util/wait#PollImmediate) `wait.PollImmediate` with `wait.PollUntilContextTimeout`
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcert-manager-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: swghosh
created_at: 2025-04-02T12:21:35Z
body: /lgtm
author_association: MEMBER
user: login: swghosh
created_at: 2025-04-02T12:37:40Z
body: /label docs-approved
/label px-approved
Non-user facing changes only.

We've enough confidence in this PR, because for a very long time we've been running the e2e(s) with ginkgo as well as the old test suite simultaneously. This helps reduce test time and helps avoid duplicate redundant test run on pre-submits.
author_association: MEMBER
user: login: openshift-ci[bot]
created_at: 2025-04-02T14:14:31Z
body: @lunarwhite: all tests **passed!**


[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=cert-manager-operator&pr=257). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:lunarwhite).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: CONTRIBUTOR
user: login: lunarwhite
created_at: 2025-04-02T14:50:24Z
body: /label qe-approved

/cherry-pick cert-manager-1.15
To maintain e2e tests consistent across at least two active branches
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-04-02T14:50:33Z
body: @lunarwhite: once the present PR merges, I will cherry-pick it on top of `cert-manager-1.15` in a new PR and assign it to you.

<details>

In response to [this](https://github.com/openshift/cert-manager-operator/pull/257#issuecomment-2772813148):

>/label qe-approved
>
>/cherry-pick cert-manager-1.15
>To maintain e2e tests consistent across at least two active branches


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-04-02T14:50:41Z
body: @lunarwhite: This pull request references [CM-485](https://issues.redhat.com//browse/CM-485) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/cert-manager-operator/pull/257):

>Motivation:
>
>Due to historical reasons, this repo currently has two e2e test frameworks: Go testing and the Ginkgo & Gomega. For e2e testing, Ginkgo offers several advantages over raw Go testing in following aspects: structured organization, selective case execution, readability, logging/result tracking. We also recommend using Ginkgo when add new test cases. Maintaining two separate frameworks introduces additional overhead over time.
>
>Reviewing cases utilized Go testing: https://github.com/openshift/cert-manager-operator/blob/master/test/e2e/cert_manager_deployment_test.go
>
>- `TestSelfSignedCerts`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L697-L698
>- `TestACMECertsIngress`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L588-L589
>- `TestCertRenew`, covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/certificates_test.go#L736
>- `TestContainerOverrides`, partially covered by https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/overrides_test.go#L148-L150
>
>Most test cases that use Go testing are also covered in the Ginkgo, except for [OverrideEnv](https://github.com/openshift/cert-manager-operator/blob/0431e1878087c139b41051e8add803e06ec72efe/test/e2e/cert_manager_deployment_test.go#L398) tests.
>
>Main changes:
>
>- Add e2e cases for `overrideEnv` config into Override tests suite
>- Cleanup legacy Go testing cases and associated functions
>- Replace [deprecated](https://pkg.go.dev/k8s.io/apimachinery/pkg/util/wait#PollImmediate) `wait.PollImmediate` with `wait.PollUntilContextTimeout`
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcert-manager-operator).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: lunarwhite
created_at: 2025-04-02T15:01:19Z
body: /cc @swghosh for labeling lgtm when you're around
author_association: CONTRIBUTOR
user: login: swghosh
created_at: 2025-04-02T15:02:20Z
body: /lgtm
author_association: MEMBER
user: login: openshift-ci[bot]
created_at: 2025-04-02T15:03:32Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/openshift/cert-manager-operator/pull/257#" title="Author self-approved">lunarwhite</a>*, *<a href="https://github.com/openshift/cert-manager-operator/pull/257#issuecomment-2772879446" title="LGTM">swghosh</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=openshift%2Fcert-manager-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/openshift/cert-manager-operator/blob/master/OWNERS)~~ [swghosh]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-04-02T15:07:41Z
body: @lunarwhite: #257 failed to apply on top of branch "cert-manager-1.15":
```
Applying: add e2e cases for overrideEnv config
Applying: cleanup legacy go testing cases
Using index info to reconstruct a base tree...
M	test/library/cert_utils.go
Falling back to patching base and 3-way merge...
Auto-merging test/library/cert_utils.go
CONFLICT (content): Merge conflict in test/library/cert_utils.go
Removing test/e2e/cert_manager_deployment_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0002 cleanup legacy go testing cases

```

<details>

In response to [this](https://github.com/openshift/cert-manager-operator/pull/257#issuecomment-2772813148):

>/label qe-approved
>
>/cherry-pick cert-manager-1.15
>To maintain e2e tests consistent across at least two active branches


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE