Fix user-provided namespace ownership e2e assertion

check that the namespace has no owner references after successful
installation instead of asserting that PSA labels are absent.

Signed-off-by: Nader Ziada <nziada@redhat.com>

Author: nader-ziada

test/e2e/features/namespace.feature

@@ -2,7 +2,8 @@ Feature: Namespace PSA Management
 
   As an OLM user, when I install an operator that declares PSA requirements
   via the suggested-namespace-template CSV annotation, operator-controller
-  should create a managed namespace with PSA labels applied.
+  should create a managed namespace with PSA labels applied and leave
+  user-provided namespaces unmanaged.
 
   Background:
     Given OLM is available
@@ -36,7 +37,7 @@ Feature: Namespace PSA Management
       | pod-security.kubernetes.io/audit          | privileged |
       | pod-security.kubernetes.io/warn           | privileged |
 
-  Scenario: User-provided namespace does not get PSA labels
+  Scenario: User-provided namespace remains unmanaged
     Given namespace "${TEST_NAMESPACE}" is available
     And a catalog "test" with packages:
       | package | version | channel | replaces | contents                                           |
@@ -59,4 +60,5 @@ Feature: Namespace PSA Management
       """
     Then ClusterExtension is rolled out
     And ClusterExtension is available
-    And namespace "${TEST_NAMESPACE}" does not have label "pod-security.kubernetes.io/enforce"
+    # Other cluster controllers may apply PSA labels to user-provided namespaces.
+    And namespace "${TEST_NAMESPACE}" has no owner references

test/e2e/steps/steps.go

@@ -187,6 +187,7 @@ func RegisterSteps(sc *godog.ScenarioContext) {
 
 	sc.Step(`^(?i)namespace "([^"]+)" has labels$`, NamespaceHasLabels)
 	sc.Step(`^(?i)namespace "([^"]+)" does not have label "([^"]+)"$`, NamespaceDoesNotHaveLabel)
+	sc.Step(`^(?i)namespace "([^"]+)" has no owner references$`, NamespaceHasNoOwnerReferences)
 
 	sc.Step(`^(?i)operator "([^"]+)" target namespace is "([^"]+)"$`, OperatorTargetNamespace)
 	sc.Step(`^(?i)Prometheus metrics are returned in the response$`, PrometheusMetricsAreReturned)
@@ -2513,6 +2514,25 @@ func NamespaceDoesNotHaveLabel(ctx context.Context, nsName string, labelKey stri
 	return nil
 }
 
+// NamespaceHasNoOwnerReferences verifies a namespace remains unmanaged after installation.
+func NamespaceHasNoOwnerReferences(ctx context.Context, nsName string) error {
+	sc := scenarioCtx(ctx)
+	nsName = substituteScenarioVars(nsName, sc)
+
+	out, err := k8sClient(ctx, "get", "namespace", nsName, "-o", "json")
+	if err != nil {
+		return fmt.Errorf("failed to get namespace %q: %w", nsName, err)
+	}
+	var obj unstructured.Unstructured
+	if err := json.Unmarshal([]byte(out), &obj); err != nil {
+		return fmt.Errorf("failed to unmarshal namespace: %w", err)
+	}
+	if refs := obj.GetOwnerReferences(); len(refs) != 0 {
+		return fmt.Errorf("namespace %q has unexpected owner references: %v", nsName, refs)
+	}
+	return nil
+}
+
 // nestedString traverses a nested map[string]interface{} by the given keys
 // and returns the leaf value as a string.
 func nestedString(obj map[string]interface{}, keys ...string) (string, bool) {