fix(runtime status) Fix config validation errors to show Failed status

Config validation errors are permanent errors requiring user action,
not transient errors that should be retried. This commit ensures
config errors are treated as TerminalErrors.

Changes:
1. Wrap config validation errors as reconcile.TerminalError in provider.go
   - Config errors now set Progressing: False, Reason: Blocked
   - Signals manual intervention required (not automatic retry)

2. Keep existing determineFailureReason() logic in common_controller.go
   - No revisions → Installed: False, Reason: Failed ✓
   - Revision with Retrying → Installed: False, Reason: Failed ✓
   - Revision with RollingOut → Installed: False, Reason: Absent ✓

Result: Config errors now correctly show:
- Progressing: False, Reason: Blocked (terminal error)
- Installed: False, Reason: Failed (installation failed)

This fixes the downstream OpenShift test failure where config errors
were showing Reason: Retrying instead of Blocked, and Installed was
using Absent instead of Failed.

IMPORTANT FIX: Only check the latest rolling revision for errors, not all revisions.

Problem:
- Revisions are sorted ascending by Spec.Revision (oldest to newest)
- Previous logic checked ALL revisions for Retrying reason
- Old revision errors superseded by newer healthy revisions incorrectly caused Failed

Fixed Logic:
- Check only the LATEST revision (last element in array)
- Old errors that have been superseded by healthy revisions no longer cause Failed
- Matches BOXCUTTER behavior in ApplyBundleWithBoxcutter which mirrors only the latest revision

This ensures the Installed condition reflects the current state (latest revision), not historical states (old revisions).

Author: camilamacedo86

internal/operator-controller/applier/provider.go

@@ -9,6 +9,7 @@ import (
 	"helm.sh/helm/v3/pkg/chart"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
 
@@ -77,7 +78,7 @@ func (r *RegistryV1ManifestProvider) Get(bundleFS fs.FS, ext *ocv1.ClusterExtens
 		bundleConfigBytes := extensionConfigBytes(ext)
 		bundleConfig, err := config.UnmarshalConfig(bundleConfigBytes, schema, ext.Spec.Namespace)
 		if err != nil {
-			return nil, fmt.Errorf("invalid ClusterExtension configuration: %w", err)
+			return nil, reconcile.TerminalError(fmt.Errorf("invalid ClusterExtension configuration: %w", err))
 		}
 
 		if watchNS := bundleConfig.GetWatchNamespace(); watchNS != nil {

internal/operator-controller/controllers/clusterextension_reconcile_steps.go

@@ -158,11 +158,11 @@ func ResolveBundle(r resolve.Resolver, c client.Client) ReconcileStepFunc {
 // handleResolutionError handles the case when bundle resolution fails.
 //
 // Decision logic (evaluated in order):
-//  1. No installed bundle → Retry (cannot proceed without any bundle)
-//  2. Version change requested → Retry (cannot upgrade without catalog)
-//  3. Cannot check catalog existence → Retry (API error, cannot safely decide)
-//  4. Catalogs exist → Retry (transient error, catalog may be updating)
-//  5. Catalogs deleted → Fallback to installed bundle (maintain current state)
+//  1. No installed bundle: Retry (cannot proceed without any bundle)
+//  2. Version change requested: Retry (cannot upgrade without catalog)
+//  3. Cannot check catalog existence: Retry (API error, cannot safely decide)
+//  4. Catalogs exist: Retry (transient error, catalog may be updating)
+//  5. Catalogs deleted: Fallback to installed bundle (maintain current state)
 //
 // When falling back (case 5), we set the resolved bundle to the installed bundle and return
 // no error, allowing the Apply step to run and maintain resources using the existing installation.

internal/operator-controller/controllers/common_controller.go

@@ -56,11 +56,8 @@ func setInstalledStatusFromRevisionStates(ext *ocv1.ClusterExtension, revisionSt
 	// Nothing is installed
 	if revisionStates.Installed == nil {
 		setInstallStatus(ext, nil)
-		if len(revisionStates.RollingOut) == 0 {
-			setInstalledStatusConditionFalse(ext, ocv1.ReasonFailed, "No bundle installed")
-		} else {
-			setInstalledStatusConditionFalse(ext, ocv1.ReasonAbsent, "No bundle installed")
-		}
+		reason := determineFailureReason(revisionStates.RollingOut)
+		setInstalledStatusConditionFalse(ext, reason, "No bundle installed")
 		return
 	}
 	// Something is installed
@@ -71,6 +68,45 @@ func setInstalledStatusFromRevisionStates(ext *ocv1.ClusterExtension, revisionSt
 	setInstalledStatusConditionSuccess(ext, fmt.Sprintf("Installed bundle %s successfully", revisionStates.Installed.Image))
 }
 
+// determineFailureReason determines the appropriate reason for the Installed condition
+// when no bundle is installed (Installed: False).
+//
+// Returns Failed when:
+//   - No rolling revisions exist (nothing to install)
+//   - The latest rolling revision has Reason: Retrying (indicates an error occurred)
+//
+// Returns Absent when:
+//   - Rolling revisions exist with the latest having Reason: RollingOut (healthy phased rollout in progress)
+//
+// Rationale:
+//   - Failed: Semantically indicates an error prevented installation
+//   - Absent: Semantically indicates "not there yet" (neutral state, e.g., during healthy rollout)
+//   - Retrying reason indicates an error (config validation, apply failure, etc.)
+//   - RollingOut reason indicates healthy progress (not an error)
+//   - Only the LATEST revision matters - old errors superseded by newer healthy revisions should not cause Failed
+//
+// Note: rollingRevisions are sorted in ascending order by Spec.Revision (oldest to newest),
+// so the latest revision is the LAST element in the array.
+func determineFailureReason(rollingRevisions []*RevisionMetadata) string {
+	if len(rollingRevisions) == 0 {
+		return ocv1.ReasonFailed
+	}
+
+	// Check if the LATEST rolling revision indicates an error (Retrying reason)
+	// Latest revision is the last element in the array (sorted ascending by Spec.Revision)
+	latestRevision := rollingRevisions[len(rollingRevisions)-1]
+	progressingCond := apimeta.FindStatusCondition(latestRevision.Conditions, ocv1.ClusterExtensionRevisionTypeProgressing)
+	if progressingCond != nil && progressingCond.Reason == string(ocv1.ClusterExtensionRevisionReasonRetrying) {
+		// Retrying indicates an error occurred (config, apply, validation, etc.)
+		// Use Failed for semantic correctness: installation failed due to error
+		return ocv1.ReasonFailed
+	}
+
+	// No error detected in latest revision - it's progressing healthily (RollingOut) or no conditions set
+	// Use Absent for neutral "not installed yet" state
+	return ocv1.ReasonAbsent
+}
+
 // setInstalledStatusConditionSuccess sets the installed status condition to success.
 func setInstalledStatusConditionSuccess(ext *ocv1.ClusterExtension, message string) {
 	SetStatusCondition(&ext.Status.Conditions, metav1.Condition{

internal/operator-controller/controllers/common_controller_test.go

@@ -240,3 +240,160 @@ func TestSetStatusConditionWrapper(t *testing.T) {
 		})
 	}
 }
+
+func TestSetInstalledStatusFromRevisionStates_ConfigValidationError(t *testing.T) {
+	tests := []struct {
+		name                  string
+		revisionStates        *RevisionStates
+		expectedInstalledCond metav1.Condition
+	}{
+		{
+			name: "no revisions at all - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed:  nil,
+				RollingOut: nil,
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+		{
+			name: "rolling revision with error (Retrying) - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "some error occurred",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+		{
+			name: "multiple rolling revisions with one Retrying - uses Failed",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ReasonRollingOut,
+								Message: "Revision is rolling out",
+							},
+						},
+					},
+					{
+						RevisionName: "rev-2",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "validation error occurred",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonFailed,
+			},
+		},
+		{
+			name: "rolling revision with RollingOut reason - uses Absent",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ReasonRollingOut,
+								Message: "Revision is rolling out",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonAbsent,
+			},
+		},
+		{
+			name: "old revision with Retrying superseded by latest healthy - uses Absent",
+			revisionStates: &RevisionStates{
+				Installed: nil,
+				RollingOut: []*RevisionMetadata{
+					{
+						RevisionName: "rev-1",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ClusterExtensionRevisionReasonRetrying,
+								Message: "old error that was superseded",
+							},
+						},
+					},
+					{
+						RevisionName: "rev-2",
+						Conditions: []metav1.Condition{
+							{
+								Type:    ocv1.ClusterExtensionRevisionTypeProgressing,
+								Status:  metav1.ConditionTrue,
+								Reason:  ocv1.ReasonRollingOut,
+								Message: "Latest revision is rolling out healthy",
+							},
+						},
+					},
+				},
+			},
+			expectedInstalledCond: metav1.Condition{
+				Type:   ocv1.TypeInstalled,
+				Status: metav1.ConditionFalse,
+				Reason: ocv1.ReasonAbsent,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ext := &ocv1.ClusterExtension{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-ext",
+					Generation: 1,
+				},
+			}
+
+			setInstalledStatusFromRevisionStates(ext, tt.revisionStates)
+
+			cond := meta.FindStatusCondition(ext.Status.Conditions, ocv1.TypeInstalled)
+			require.NotNil(t, cond)
+			require.Equal(t, tt.expectedInstalledCond.Status, cond.Status)
+			require.Equal(t, tt.expectedInstalledCond.Reason, cond.Reason)
+		})
+	}
+}