try back the GKE script

Author: Mladen Rusev

hack/e2e/test.sh

@@ -83,6 +83,19 @@ if ! gcloud container clusters get-credentials "${CLUSTER_NAME}"; then
 fi
 kubectl create ns venafi || true
 
+kubectl apply -n venafi -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: coverage-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+EOF
+
 # Pull secret for Venafi OCI registry
 # IMPORTANT: we pick the first team as the owning team for the registry and
 # workload identity service account as it doesn't matter.
@@ -127,6 +140,8 @@ venctl components kubernetes apply \
   --venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
 
 kubectl apply -n venafi -f venafi-components.yaml
+kubectl set env deployments/venafi-kubernetes-agent -n venafi GOCOVERDIR=/coverage
+kubectl rollout status deployment/venafi-kubernetes-agent -n venafi --timeout=2m
 
 subject="system:serviceaccount:venafi:venafi-components"
 audience="https://${VEN_API_HOST}"
@@ -233,3 +248,57 @@ getCertificate() {
 
 # Wait 5 minutes for the certificate to appear.
 for ((i=0;;i++)); do if getCertificate; then exit 0; fi; sleep 30; done | timeout -v -- 5m cat
+
+#export AGENT_POD_NAME=$(kubectl get pods -n venafi -l app.kubernetes.io/name=venafi-kubernetes-agent -o jsonpath="{.items[0].metadata.name}")
+#
+#echo "Sending SIGQUIT to agent pod '${AGENT_POD_NAME}' to trigger graceful shutdown and flush coverage..."
+## Use kubectl debug to attach a busybox container to the running pod.
+## --target specifies the container to share the process space with.
+## --share-processes allows our new container to see and signal the agent process.
+## We then run 'kill -s QUIT 1' to signal PID 1 (the agent) to quit gracefully.
+#kubectl debug -q -n venafi "${AGENT_POD_NAME}" \
+#    --image=busybox:1.36 \
+#    --target=venafi-kubernetes-agent \
+#    --share-processes \
+#    -- sh -c 'kill -s QUIT 1'
+#
+#echo "Waiting for agent pod '${AGENT_POD_NAME}' to terminate gracefully..."
+## The pod will now terminate because its main process is exiting.
+## We wait for Kubernetes to recognize this and delete the pod object.
+#kubectl wait --for=delete pod/${AGENT_POD_NAME} -n venafi --timeout=90s
+#
+#echo "Scaling down deployment to prevent pod from restarting..."
+## Now that the pod is gone and coverage is flushed, we scale the deployment
+## to ensure the ReplicaSet controller doesn't create a new one.
+#kubectl scale deployment venafi-kubernetes-agent -n venafi --replicas=0
+#echo "Waiting for agent pod '${AGENT_POD_NAME}' to terminate as a result of the scale-down..."
+#kubectl wait --for=delete pod/${AGENT_POD_NAME} -n venafi --timeout=90s
+#echo "Starting helper pod to retrieve coverage files from the PVC..."
+#
+#kubectl apply -n venafi -f - <<EOF
+#apiVersion: v1
+#kind: Pod
+#metadata:
+#  name: coverage-helper-pod
+#spec:
+#  containers:
+#  - name: helper
+#    image: alpine:latest
+#    command: ["sleep", "infinity"]
+#    volumeMounts:
+#    - name: coverage-storage
+#      mountPath: /coverage-data
+#  volumes:
+#  - name: coverage-storage
+#    persistentVolumeClaim:
+#      claimName: coverage-pvc
+#EOF
+#
+#echo "Waiting for the helper pod to be ready..."
+#kubectl wait --for=condition=Ready pod/coverage-helper-pod -n venafi --timeout=2m
+#
+#echo "Copying coverage files from the helper pod..."
+#mkdir -p $COVERAGE_HOST_PATH
+#kubectl cp -n venafi "coverage-helper-pod:/coverage-data/." $COVERAGE_HOST_PATH
+#echo "Coverage files retrieved. Listing contents:"
+#ls -la $COVERAGE_HOST_PATH

hack/e2e/values.venafi-kubernetes-agent.yaml

@@ -12,11 +12,12 @@ extraArgs:
 - --logging-format=json
 - --log-level=4
 
-volumeMounts:
-  - name: coverage-volume
-    mountPath: /coverage
+podSecurityContext:
+  fsGroup: 2000
 volumes:
-  - name: coverage-volume
-    hostPath:
-      path: /coverage
-      type: DirectoryOrCreate
+  - name: coverage-storage
+    persistentVolumeClaim:
+      claimName: coverage-pvc
+volumeMounts:
+  - name: coverage-storage
+    mountPath: /coverage