ci: install Gateway-API CRDs on the upstream cluster before cert-manager

cert-manager runs with enableGatewayAPI:true, so it crashloops at startup
when the Gateway-API CRDs are absent. The downstream cluster gets them
from eg-crds first; the upstream only got them later via prepare-upstream
(config/e2e). The resulting crashloop delayed issuance of the manager's
webhook serving cert by ~2.5min, so the manager sat in ContainerCreating
waiting on the secret and bring-up timed out.

Add an upstream-gateway-crds task (same chart-bundled CRDs as eg-crds) and
run it before cert-manager-upstream. Also bump the manager readiness wait
to 300s and fix the diagnostics describe loop so pod events are captured.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JbCy8vy66RdNYzGSgqH6P6

Author: scotwells

.github/workflows/test-e2e-federated.yml

@@ -95,9 +95,11 @@ jobs:
           for ctx in kind-nso-upstream kind-nso-downstream; do
             echo "### $ctx"
             kubectl --context "$ctx" get pods -A \
-              --field-selector=status.phase!=Running,status.phase!=Succeeded -o name | while read -r p; do
-              ns=$(kubectl --context "$ctx" get "$p" -A -o jsonpath='{..metadata.namespace}' 2>/dev/null)
-              kubectl --context "$ctx" -n "$ns" describe "${p#*/}" 2>/dev/null | tail -30
+              --field-selector=status.phase!=Running,status.phase!=Succeeded \
+              -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}' \
+              | while read -r ns name; do
+              [ -n "$name" ] || continue
+              kubectl --context "$ctx" -n "$ns" describe pod "$name" 2>/dev/null | tail -30
             done
           done
           echo "::endgroup::"

Taskfile.test-infra.yml

@@ -105,6 +105,11 @@ tasks:
       - task: eg-crds
       - task: downstream-crds
       - task: downstream-namespaces
+      # cert-manager runs with enableGatewayAPI:true and crashloops at startup if
+      # the Gateway-API CRDs are absent. The downstream gets them from eg-crds; the
+      # upstream otherwise wouldn't until prepare-upstream (config/e2e), far too
+      # late — the crashloop delays the manager's webhook cert and stalls bring-up.
+      - task: upstream-gateway-crds
       - task: cert-manager-upstream
       - task: cert-manager-downstream
       - task: nso-image
@@ -208,6 +213,13 @@ tasks:
       - kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/gatewayapi-crds.yaml
       - kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/generated/
 
+  upstream-gateway-crds:
+    desc: "Install the Gateway-API CRDs on the upstream cluster so cert-manager (enableGatewayAPI:true) starts cleanly instead of crashlooping until config/e2e lands them. Uses the same chart-bundled CRDs as eg-crds; requires eg-chart to have pulled the chart."
+    vars:
+      EG_CRD_DIR: config/tools/envoy-gateway-downstream/charts/gateway-helm-{{.ENVOY_GATEWAY_VERSION}}/gateway-helm/crds
+    cmds:
+      - kubectl --context {{.UPSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/gatewayapi-crds.yaml
+
   downstream-namespaces:
     desc: "Create the downstream gateway + hostname-accounting namespaces, plus the EG-watched e2e-direct namespace for hand-delivered fixtures (D1/D2). Runs BEFORE eg-downstream so e2e-direct carries its watch label before EG establishes its informer."
     cmds:
@@ -323,7 +335,7 @@ tasks:
     desc: "Wait for the core components (NSO manager, downstream EG, ext-server) to be Available."
     cmds:
       - echo "⏳ waiting for NSO manager (upstream)"
-      - kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system wait deploy network-services-operator-controller-manager --for=condition=Available --timeout=240s
+      - kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system wait deploy network-services-operator-controller-manager --for=condition=Available --timeout=300s
       - echo "⏳ waiting for downstream EG"
       # The gateway control-plane Deployment is named `envoy-gateway` by its chart,
       # not after the release name.