Fix Boxcutter to show Failed (not Absent) for config errors

Boxcutter now consistently shows 'Installed: False, Reason: Failed'
for configuration validation errors, matching Helm behavior.

Detects "invalid configuration:" errors in rolling revisions and
uses Failed reason instead of Absent for semantic correctness.

Assisted-by: Cursor

Author: camilamacedo86

internal/operator-controller/controllers/common_controller.go

@@ -19,6 +19,7 @@ package controllers
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -56,11 +57,8 @@ func setInstalledStatusFromRevisionStates(ext *ocv1.ClusterExtension, revisionSt
 	// Nothing is installed
 	if revisionStates.Installed == nil {
 		setInstallStatus(ext, nil)
-		if len(revisionStates.RollingOut) == 0 {
-			setInstalledStatusConditionFalse(ext, ocv1.ReasonFailed, "No bundle installed")
-		} else {
-			setInstalledStatusConditionFalse(ext, ocv1.ReasonAbsent, "No bundle installed")
-		}
+		reason := determineFailureReason(revisionStates.RollingOut)
+		setInstalledStatusConditionFalse(ext, reason, "No bundle installed")
 		return
 	}
 	// Something is installed
@@ -71,6 +69,23 @@ func setInstalledStatusFromRevisionStates(ext *ocv1.ClusterExtension, revisionSt
 	setInstalledStatusConditionSuccess(ext, fmt.Sprintf("Installed bundle %s successfully", revisionStates.Installed.Image))
 }
 
+// determineFailureReason determines the appropriate reason for installation failure.
+// Returns Failed if there are no rolling revisions or if rolling revisions have config validation errors.
+// Returns Absent if there are rolling revisions without config errors (e.g., normal rollout in progress).
+func determineFailureReason(rollingRevisions []*RevisionMetadata) string {
+	if len(rollingRevisions) == 0 {
+		return ocv1.ReasonFailed
+	}
+
+	// Check if rolling revisions have config validation errors
+	// If so, use Failed instead of Absent for consistency across runtimes
+	if hasConfigValidationError(rollingRevisions) {
+		return ocv1.ReasonFailed
+	}
+
+	return ocv1.ReasonAbsent
+}
+
 // setInstalledStatusConditionSuccess sets the installed status condition to success.
 func setInstalledStatusConditionSuccess(ext *ocv1.ClusterExtension, message string) {
 	SetStatusCondition(&ext.Status.Conditions, metav1.Condition{
@@ -108,6 +123,25 @@ func setInstallStatus(ext *ocv1.ClusterExtension, installStatus *ocv1.ClusterExt
 	ext.Status.Install = installStatus
 }
 
+// hasConfigValidationError checks if any rolling revision has a config validation error.
+// Config validation errors contain "invalid configuration:" or "invalid ClusterExtension configuration:"
+// in their condition messages. This helps maintain consistency across runtimes:
+// - Helm validates config early (before creating resources), so no rolling revisions exist, resulting in Failed
+// - Boxcutter creates revision first then validates later, so rolling revision exists but should still be Failed
+func hasConfigValidationError(rollingRevisions []*RevisionMetadata) bool {
+	for _, rev := range rollingRevisions {
+		// Check Progressing condition for config validation errors
+		progressingCond := apimeta.FindStatusCondition(rev.Conditions, ocv1.ClusterExtensionRevisionTypeProgressing)
+		if progressingCond != nil && strings.Contains(progressingCond.Message, "invalid configuration:") {
+			return true
+		}
+		if progressingCond != nil && strings.Contains(progressingCond.Message, "invalid ClusterExtension configuration:") {
+			return true
+		}
+	}
+	return false
+}
+
 func setStatusProgressing(ext *ocv1.ClusterExtension, err error) {
 	progressingCond := metav1.Condition{
 		Type:               ocv1.TypeProgressing,

internal/operator-controller/controllers/common_controller_test.go

@@ -240,3 +240,114 @@ func TestSetStatusConditionWrapper(t *testing.T) {
 		})
 	}
 }
+
+func TestSetInstalledStatusFromRevisionStates_ConfigValidationError(t *testing.T) {
+	tests := []struct {
+		name                  string
+		revisionStates        *RevisionStates
+		expectedInstalledCond metav1.Condition
+	}{
+		{
+			name: "no revisions at all - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed:  nil,
+				RollingOut: nil,
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+		{
+			name: "rolling revision without config error - uses Absent",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "some other error",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonAbsent,
+			},
+		},
+		{
+			name: "rolling revision with 'invalid configuration:' error - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "error for resolved bundle: invalid configuration: required field 'watchNamespace' is missing",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+		{
+			name: "rolling revision with 'invalid ClusterExtension configuration:' error - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "invalid ClusterExtension configuration: watchNamespace must be 'test-ns'",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ext := &ocv1.ClusterExtension{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-ext",
+					Generation: 1,
+				},
+			}
+
+			setInstalledStatusFromRevisionStates(ext, tt.revisionStates)
+
+			cond := meta.FindStatusCondition(ext.Status.Conditions, ocv1.TypeInstalled)
+			require.NotNil(t, cond)
+			require.Equal(t, tt.expectedInstalledCond.Status, cond.Status)
+			require.Equal(t, tt.expectedInstalledCond.Reason, cond.Reason)
+		})
+	}
+}

test/e2e/features/install.feature

@@ -122,6 +122,7 @@ Feature: Install ClusterExtension
       error for resolved bundle "single-namespace-operator.1.0.0" with version "1.0.0":
       invalid ClusterExtension configuration: invalid configuration: required field "watchNamespace" is missing
       """
+    And ClusterExtension reports Installed as False with Reason Failed
     When ClusterExtension is updated to set config.watchNamespace field
       """
       apiVersion: olm.operatorframework.io/v1
@@ -205,6 +206,7 @@ Feature: Install ClusterExtension
       must be "${TEST_NAMESPACE}" (the namespace where the operator is installed) because this
       operator only supports OwnNamespace install mode
       """
+    And ClusterExtension reports Installed as False with Reason Failed
     When ClusterExtension is updated to set watchNamespace to own namespace value
       """
       apiVersion: olm.operatorframework.io/v1