e2e: remove dead helpers and the broken verify-egress-demo.sh

hack/cleanup-e2e.sh

@@ -41,12 +41,12 @@ fi
 # The label CreateNamespace stamps on every namespace the suites create.
 selector="ate.dev/e2e"
 
-leftover="$(kubectl "${kubectl_args[@]}" get namespaces -l "${selector}" -o name)"
+leftover="$(kubectl ${kubectl_args[@]+"${kubectl_args[@]}"} get namespaces -l "${selector}" -o name)"
 if [[ -z "${leftover}" ]]; then
   echo "No leftover e2e namespaces."
   exit 0
 fi
 
 echo "Deleting leftover e2e namespaces:"
 echo "${leftover}"
-kubectl "${kubectl_args[@]}" delete namespaces -l "${selector}" --ignore-not-found
+kubectl ${kubectl_args[@]+"${kubectl_args[@]}"} delete namespaces -l "${selector}" --ignore-not-found

internal/e2e/README.md

@@ -29,7 +29,7 @@ what CI installs on the envoy lane; see `internal/e2e/suites/egresscredinject`.
 The suites are runtime-agnostic: the same tests run against gVisor and against
 the micro-VM (kata + cloud-hypervisor) sandbox class. `E2E_SANDBOX_CLASS`
 selects which, by repointing every fixture at its variant --- see
-`e2e.CounterFixture`, `e2e.EgressFixture` and `e2e.RenderFixtureManifest` in
+`e2e.SubstrateCounterFixture`, `e2e.EgressFixture` and `e2e.RenderFixtureManifest` in
 [sandbox.go](sandbox.go). Unset means gVisor.
 
 ```shell

internal/e2e/env_test.go

@@ -15,33 +15,14 @@
 package e2e
 
 import (
-	"os"
 	"reflect"
 	"testing"
 )
 
 func TestCheckEnv(t *testing.T) {
-	// Preserve original env for clean testing environment, and restore it afterwards.
-	// Since CheckEnv reads actual environment variables, we will back up and restore any keys we modify.
-	testKeys := []string{"TEST_ENV_FOO", "TEST_ENV_BAR", "TEST_ENV_EMPTY"}
-	originalVals := make(map[string]string)
-	for _, key := range testKeys {
-		if val, ok := os.LookupEnv(key); ok {
-			originalVals[key] = val
-		}
-		defer func(k string) {
-			if val, ok := originalVals[k]; ok {
-				os.Setenv(k, val)
-			} else {
-				os.Unsetenv(k)
-			}
-		}(key)
-	}
-
-	// Set up our test environment
-	os.Setenv("TEST_ENV_FOO", "value_foo")
-	os.Setenv("TEST_ENV_BAR", "value_bar")
-	os.Setenv("TEST_ENV_EMPTY", "")
+	t.Setenv("TEST_ENV_FOO", "value_foo")
+	t.Setenv("TEST_ENV_BAR", "value_bar")
+	t.Setenv("TEST_ENV_EMPTY", "")
 
 	tests := []struct {
 		name    string

internal/e2e/fixtures/probe/probe.yaml.tmpl

@@ -26,8 +26,8 @@ kind: Namespace
 metadata:
   name: ate-e2e-probe${FIXTURE_SUFFIX}
   labels:
-    # Lets hack/cleanup-e2e.sh find and delete this namespace when a failed
-    # test leaves the fixture behind for debugging.
+    # Lets hack/cleanup-e2e.sh find and delete this namespace when an
+    # interrupted run leaves the fixture behind.
     ate.dev/e2e: "true"
 
 ---

internal/e2e/namespace.go

@@ -41,7 +41,7 @@ var (
 	rnd                 = rand.New(rand.NewSource(time.Now().UnixNano()))
 )
 
-// randomnamepaceName returns a random namespace name.
+// randomNamespaceName returns a random namespace name.
 // Format is "aaaa-ddd" where a is a random letter and d is a random digit.
 func randomNamespaceName() string {
 	const letters = "abcdefghijklmnopqrstuvwxyz"

internal/e2e/pretty.go

@@ -22,8 +22,8 @@ import (
 	"regexp"
 )
 
-// noColor() disables colors for tests running in environments without colored output.
 var (
+	// NoColor disables colored output, for environments that cannot show it.
 	NoColor bool
 	// envNoColor (see https://no-color.org/)
 	envNoColor bool
@@ -71,6 +71,8 @@ func init() {
 	envNoColor = os.Getenv("NO_COLOR") != ""
 }
 
+// noColor reports whether to disable colors, for tests running in
+// environments without colored output.
 func noColor() bool {
 	return NoColor || envNoColor
 }
@@ -93,17 +95,6 @@ func Colorf(format string, a ...any) string {
 	return str
 }
 
-// FColorf writes a formatted string with color directives to the given writer.
-func FColorf(f io.Writer, format string, a ...any) error {
-	_, err := fmt.Fprint(f, Colorf(format, a...))
-	return err
-}
-
-// FColorfln writes a formatted string with color directives to the given writer, followed by a newline.
-func FColorfln(f io.Writer, format string, a ...any) error {
-	return FColorf(f, format+"\n", a...)
-}
-
 // ColorWriter wraps an io.Writer and forces all writes to be colored with the given ANSI code.
 // It respects noColor().
 type ColorWriter struct {

internal/e2e/pretty_test.go

@@ -109,48 +109,6 @@ func TestColorf(t *testing.T) {
 	}
 }
 
-func TestFColorfAndFColorfln(t *testing.T) {
-	t.Run("FColorf", func(t *testing.T) {
-		var buf bytes.Buffer
-		NoColor = false
-		err := FColorf(&buf, "Hello <green>%s</green>", "world")
-		if err != nil {
-			t.Fatalf("FColorf failed: %v", err)
-		}
-		want := "Hello \033[32mworld\033[0m"
-		if buf.String() != want {
-			t.Errorf("FColorf output = %q, want %q", buf.String(), want)
-		}
-	})
-
-	t.Run("FColorfln", func(t *testing.T) {
-		var buf bytes.Buffer
-		NoColor = false
-		err := FColorfln(&buf, "Hello <green>%s</green>", "world")
-		if err != nil {
-			t.Fatalf("FColorfln failed: %v", err)
-		}
-		want := "Hello \033[32mworld\033[0m\n"
-		if buf.String() != want {
-			t.Errorf("FColorfln output = %q, want %q", buf.String(), want)
-		}
-	})
-
-	t.Run("FColorf no color", func(t *testing.T) {
-		var buf bytes.Buffer
-		NoColor = true
-		defer func() { NoColor = false }()
-		err := FColorf(&buf, "Hello <green>%s</green>", "world")
-		if err != nil {
-			t.Fatalf("FColorf failed: %v", err)
-		}
-		want := "Hello world"
-		if buf.String() != want {
-			t.Errorf("FColorf output = %q, want %q", buf.String(), want)
-		}
-	})
-}
-
 func TestColorWriter(t *testing.T) {
 	tests := []struct {
 		name    string

internal/e2e/sandbox.go

@@ -39,8 +39,7 @@ func SandboxClass() string { return os.Getenv(sandboxClassEnv) }
 func IsMicroVM() bool { return SandboxClass() == SandboxClassMicroVM }
 
 // Fixture identifies an installed WorkerPool + ActorTemplate pair (both carry
-// the same name) that suites either create Actors from directly or copy the
-// resolved runtime — sandbox class, worker image, container images — out of.
+// the same name) that suites create Actors from.
 type Fixture struct {
 	Namespace string
 	Name      string
@@ -185,8 +184,6 @@ func fixtureSubstitutions(bucket, name string) (inline, blocks map[string]string
 	}
 	blocks = map[string]string{
 		"${WORKERPOOL_RUNTIME}": "  sandboxClasses:\n  - name: gvisor",
-		// Off unless the caller opts in; see WithTrustBundle.
-		"${TEMPLATE_TRUST_BUNDLE}": "",
 	}
 	if !IsMicroVM() {
 		return inline, blocks

internal/e2e/suites/egressauthz/testmain_test.go

@@ -21,21 +21,4 @@ import (
 	"go.ate.dev/substrate/internal/e2e"
 )
 
-// Setup runs before the suite. The probe is created on first use, in the
-// randomized namespace the suite creates, so there is nothing to do here.
-func Setup() {}
-
-// Teardown runs after the suite.
-func Teardown() {}
-
-func run(m *testing.M) int {
-	Setup()
-	defer Teardown()
-
-	// return allows the deferred Teardown to run.
-	return e2e.RunTestMain(m)
-}
-
-func TestMain(m *testing.M) {
-	os.Exit(run(m))
-}
+func TestMain(m *testing.M) { os.Exit(e2e.RunTestMain(m)) }

internal/e2e/suites/networkpolicy/testmain_test.go

@@ -21,8 +21,4 @@ import (
 	"go.ate.dev/substrate/internal/e2e"
 )
 
-func run(m *testing.M) int {
-	return e2e.RunTestMain(m)
-}
-
-func TestMain(m *testing.M) { os.Exit(run(m)) }
+func TestMain(m *testing.M) { os.Exit(e2e.RunTestMain(m)) }

internal/e2e/suites/security/README.md

@@ -37,12 +37,8 @@ hack/run-e2e-kind.sh ./internal/e2e/suites/security -v \
 
 Note the setup (victim run/write/suspend, attacker reuse) runs regardless — the subtest filter only selects which assertions execute.
 
-4. On failure, a failed suite keeps its namespaces so you can read the worker logs:
-
-
-kubectl get ns -l ate.dev/e2e
-kubectl -n <ns> logs <worker-pod> -c ateworker
-KIND_CLUSTER_NAME=kind hack/cleanup-e2e.sh   # reclaim when done
+4. The suite deletes its namespaces when it ends, pass or fail, so read the
+worker logs while it runs (see below).
 
 
 
@@ -84,7 +80,7 @@ run with `E2E_SANDBOX_CLASS=microvm`. Neither matters for this suite.
 Watch the lifecycle (start these first, before/at test launch)
 
 # The two atespace namespaces appear and vanish — this is the run's heartbeat
-kubectl get ns -l ate.dev/e2e -w
+kubectl get ns -w | grep ate-e2e-sec
 
 # The one shared worker pod: watch the victim's pod get reused, not replaced
 kubectl get pods -n ate-e2e-sec-a -w
@@ -106,14 +102,14 @@ The shared worker pod on the host
 kubectl get pods -n ate-e2e-sec-a -o wide
 
 # worker logs — the sandbox lifecycle, checkpoints, resumes
-kubectl logs -n ate-e2e-sec-a -l app=ateworker -c ateworker -f
+kubectl logs -n ate-e2e-sec-a -l ate.dev/worker-pool=shared -c worker -f
 
 # The on-host per-actor layout the host-state probes assert against.
 # Two UID-keyed durable dirs (victim's + attacker's) live side by side here:
-POD=$(kubectl get pods -n ate-e2e-sec-a -l app=ateworker -o name | head -1)
-kubectl exec -n ate-e2e-sec-a "$POD" -c ateworker -- ls -la /var/lib/ateworker-gvisor/actors
+POD=$(kubectl get pods -n ate-e2e-sec-a -l ate.dev/worker-pool=shared -o name | head -1)
+kubectl exec -n ate-e2e-sec-a "$POD" -c worker -- ls -la /var/lib/ate/actors
 Control plane / snapshots (for the tag-scope subtest)
 
 kubectl ate get tags -a ate-e2e-sec-a          # atespace-a-tag appears during the last subtest
 kubectl ate get atespaces                       # ate-e2e-sec-a / -b listed while live
-kubectl logs -n ate-system -l app=ateapi -f     # Create
+kubectl logs -n ate-system -l app=ate-api-server -f     # Create