test: skip TLS profile e2e tests when APIServer is not writable

[unsortedhashsets]

What type of PR is this?

• Enhancement / New Feature
• Bug Fix
• Refactor
• Optimization
• Test
• Documentation Update

What this PR does / why we need it:

The TLS profile tests update the cluster-scoped APIServer resource, which managed clusters (e.g. ROSA/OSD) reject via Red Hat SRE admission webhooks with a Forbidden error. Instead of enumerating cluster types, the tls-profile BeforeAll now probes writability directly with a no-op server-side dry-run update and skips on Forbidden, persisting nothing. This generalises the existing hosted-cluster guard and covers any cluster where the resource is not manageable, while self-managed OpenShift continues to run the tests.

Which issue(s) this PR fixes:

Fixes #

Related Issue/PR #

Additional information:

Verified on a live ROSA cluster: a no-op server-side dry-run PUT of the APIServer resource returns admission webhook "regular-user-validation.managed.openshift.io" denied the request (HTTP 403), so the probe hits the Skip branch. On self-managed OpenShift the same dry-run succeeds and the tests run as before. Only Forbidden triggers the skip — any other error still fails the test.

[istio-testing]

Hi @unsortedhashsets. Thanks for your PR.

I'm waiting for a istio-ecosystem or istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.10%. Comparing base (bd58e15) to head (5f5bc8f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2313      +/-   ##
==========================================
+ Coverage   87.91%   88.10%   +0.18%     
==========================================
  Files          56       56              
  Lines        2665     2665              
==========================================
+ Hits         2343     2348       +5     
+ Misses        322      317       -5     

Flag	Coverage Δ
integration-tests	74.34% <ø> (+0.23%)	⬆️
unit-tests	65.10% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.