[ezekiel-alexrod]

Component

ci, agent, docs

Problem

The agent e2e suite only ran by hand, and it never pulled an image. agent-ci.yaml runs the lint, the unit tests and a docker-build, but nothing deploys the agent on a cluster. A broken manifest, pull, extraction or synced label shows up late, at best in MetalK8s.

Fix

Start with the third commit, the specs, then the last one, added after your approvals: the adoption spec. I'd mostly like eyes on what they cover and on the version pinning.

• A new e2e job in agent-ci.yaml runs make -C agent test-e2e on every pull request and on pushes to main that touch agent/, with timeout-minutes: 30. No image is pushed: the suite loads it into kind.
• The Makefile downloads kind at a pinned version (v0.33.0, node image Kubernetes 1.37.0). CI takes kubectl v1.37.1 from the registry.k8s.io/kubectl image, pinned by digest.
• The kind cluster now has a control plane and a worker (test/e2e/kind-config.yaml). setup-test-e2e refuses a leftover cluster with another node count instead of reusing it.
• Two specs pull a real image from a registry running in the cluster (registry:3.1.2, pinned by digest), pushed through kubectl port-forward:
  • plain HTTP with --plain-http: an ImageCache selecting the worker gets it synced, with the archive and the sentinel on disk. Nothing lands on the control plane, and deleting the ImageCache removes the directory and the label.
  • TLS signed by a throwaway CA: the agent first logs certificate signed by unknown authority and stays pending, then pulls once the registry-ca ConfigMap and the shipped config/default/manager_registry_ca_patch.yaml are applied.
• A third spec runs the real imagecachectl on the worker, from two docker archives, before any ImageCache exists. The agent then adopts the directory holding the image its resource names (Adopted event, same inode, owner switched) and replaces the one holding another image. Before this, the seeded directory was a hand-written sentinel, so neither the command nor the adoption ran.
• Renovate now tracks kind, kubectl and the registry image. The other tools of the Makefile are annotated in ci(agent): bump golangci-lint to v2.14.0, let Renovate track the tools (MK8S-470) #35.
• test-e2e now deletes the cluster when the suite fails. It did not: .SHELLFLAGS has -e, so a failing go test ended the recipe before the cleanup, and the next run reused the cluster. It also gets -timeout 25m: the 10m default can kill a failing suite before Ginkgo prints which spec failed.

Test

Check	Result
make -C agent test-e2e locally, two nodes, rebased on main	6/6 specs passed, 177 s
same, with --plain-http swapped for a no-op flag	the plain HTTP spec fails waiting for synced, as it should
same, with adopt forced to replace	the adoption spec fails on no Adopted event, as it should
Renovate 41 dry-run on the branch, shared preset	kind, kubectl and registry found
kubectl extracted from the image vs the one from dl.k8s.io	same sha256
make -C agent setup-test-e2e with a 1-node cluster left over	refused, exit 1
make -C agent lint, and golangci-lint --build-tags e2e ./test/...	0 issues, only the // +build lines that were already there
actionlint .github/workflows/agent-ci.yaml	OK
the e2e job on GitHub, first commit only	passed in 4 min 27 s
the e2e job on GitHub, kubectl from the image	6/6 specs passed, 7 min 44 s

Out of scope

• The image job stays: no check is required on main today, and it fails faster than the e2e when only the build breaks.
• Making e2e a required check: to decide once we have its duration with the new specs.
• CA rotation: the agent reads --ca-file once at startup, as documented.

---

• The docs describing this behaviour are updated in the same pull request: README.md, agent/README.md, DESIGN.md, agent/DESIGN.md, CONTRIBUTING.md, whichever owns it.

Relates-to: MK8S-450

[anthony-treuillier-scality]

small comments