test(infra): prod-fidelity edge test env + e2e suite

[ecv]

Supersedes #226 in the #247 five-PR stack (the #226 env slot). Combines the rebased prod-fidelity environment with the e2e suite lifted onto it (#275), as a single working PR. Not closing #226 here — @scotwells's to close.

What

1. Env, rebased onto main — @scotwells's prod-fidelity two-cluster environment (was ~70 commits behind), replayed on current main so it carries Gateway: hostname-less tenant listeners rejected with misleading 'must be unique' (default-listener injection collision) #219 (clear hostname message) and TrafficProtectionPolicy CRD rejected: paranoiaLevels default {} violates detection>=blocking CEL rule #257/fix: reject inverted TrafficProtectionPolicy paranoia levels at admission #251/fix: flag inverted TrafficProtectionPolicy paranoia levels via status condition #252 (TPP paranoia default + CEL validation).
2. e2e suite on the env (Lift the e2e suite onto the prod-fidelity two-cluster env (#226) #275) — a test-infra:test-e2e task mapping the chainsaw aliases onto the env's kubeconfigs, with a persisted JSON report; the full test/e2e suite adapted to the shared prod-fidelity data plane.

Suite: 8/8 green on the live env

gateway-accepted · gateway-invalid-certificate · gateway-listener-hostname-collision · ready-when-context-is-ready · trafficprotectionpolicy-enforce-serves-traffic · trafficprotectionpolicy-enforce-blocks-attack · trafficprotectionpolicy-neutralize-inverted · trafficprotectionpolicy-paranoia-validation

Env-specific adjustments (and why)

• GatewayClass name — the env installs datum-downstream-gateway-e2e; tests that hardcoded the bare datum-downstream-gateway (enforce, enforce-blocks-attack, neutralize-inverted) never bound a class and timed out. Aligned.
• Shared data plane — gateway-accepted and gateway-invalid-certificate self-provisioned a per-test EnvoyProxy + GatewayClass in envoy-gateway-system (the single-stack bridge topology this env retires). Reworked to ride the env's shared class and assert the cert-health behavior (Expired/abandoned customer certs can freeze an entire edge — health-gate cert propagation + isolate per-cert failures #212) at the gateway-status level; dropped the bespoke-proxy backend-re-encrypt wire checks (shared-plane serving is covered by the WAF enforce test).
• Downstream CRD has no paranoia CEL — neutralize-inverted stripped the CEL to inject a grandfathered inverted policy, but it runs against the downstream cluster whose replicated CRD carries no such validation. Guarded the strip/restore on the CEL being present.

Related

• Catch silent edge misconfiguration before it reaches customers #247 — the arc (catch silent edge misconfiguration before customers)
• Stand up a test environment that mirrors how the edge really runs #226 — env slot this supersedes
• Lift the e2e suite onto the prod-fidelity two-cluster env (#226) #275 — lift the e2e suite onto the env (delivered here)

[ecv]

doin the last two

[ecv]

now deleting interim env & pointing CI at new env

[ecv]

CI on the env: 9/9 green from cold ✅

E2E Tests now runs the prod-fidelity env and passes the full suite on a fresh dispatch — run 29362000531:

gateway-accepted · gateway-invalid-certificate · gateway-listener-hostname-collision
ready-when-context-is-ready · trafficprotectionpolicy-{enforce-serves-traffic,
enforce-blocks-attack, neutralize-inverted, paranoia-validation} · billing-http-metering
→ Passed 9 / Failed 0

Getting there (cold-start hardening, Fixes #279)

• wait-ready now blocks until the NSO webhook admits a server-side dry-run (killed the Domain: context deadline exceeded flake) and the downstream GatewayClass is Accepted.
• Manager Available budget 240s→360s for loaded runners.
• Billing's first-gateway Programmed assert given the 3m budget the other gateway tests use.
• Suite runs --parallel 1 (as the retired bridge did) so the shared merged proxy warms progressively — fixed billing's access-log scrape racing a cold proxy.

Billing metering verified end-to-end on the shared data plane: access log → project_name (ext-server injected) → 4 CloudEvents to the mock gateway.

Note on the PR check

The required E2E Tests status is the pull_request-triggered run, which GitHub holds pending approval because this PR edits the workflow file. The green evidence above is a workflow_dispatch run of the same workflow on this branch; the pull_request run will execute + pass once a maintainer approves it.

[scotwells]

@ecv something I started on the compute project that we should replicate here is switching over to this new federation architecture test environment datum-cloud/test-infra#32