try a different fix

test/framework/ownerreference_helpers.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"reflect"
 	"sort"
+	"strings"
 	"time"
 
 	. "github.com/onsi/gomega"
@@ -103,10 +104,20 @@ func AssertOwnerReferences(namespace, kubeconfigPath string, assertFuncs ...map[
 			allAssertFuncs[k] = v
 		}
 	}
+	var graph clusterctlcluster.OwnerGraph
+	Eventually(func() error {
+		var err error
+		graph, err = clusterctlcluster.GetOwnerGraph(namespace, kubeconfigPath)
+		// Sometimes the conversion-webhooks are not ready yet / cert-managers ca-injector
+		// may not yet have injected the new ca bundle after the upgrade.
+		// If this is not the case we fail fast.
+		if err != nil && !strings.Contains(err.Error(), "x509: certificate signed by unknown authority") {
+			Expect(err).ToNot(HaveOccurred())
+		}
+		return err
+	}).WithTimeout(3 * time.Minute).WithPolling(2 * time.Second).Should(Succeed())
 	Eventually(func() error {
 		allErrs := []error{}
-		graph, err := clusterctlcluster.GetOwnerGraph(namespace, kubeconfigPath)
-		Expect(err).ToNot(HaveOccurred())
 		for _, v := range graph {
 			if _, ok := allAssertFuncs[v.Object.Kind]; !ok {
 				allErrs = append(allErrs, fmt.Errorf("kind %s does not have an associated ownerRef assertion function", v.Object.Kind))