e2e: support @serial tag for scenarios that modify shared state

Add E2E_GODOG_TAGS and E2E_GODOG_CONCURRENCY env vars to control godog
options from CI. Tag TLS scenarios as @serial since they modify shared
deployment manifests. Add serial-e2e and experimental-serial-e2e CI
workflow entries that run @serial scenarios with concurrency 1.

Author: joelanford

.github/workflows/e2e.yaml

@@ -21,10 +21,22 @@ jobs:
             use-codecov: false
           - name: e2e
             make-target: test-e2e
+            e2e-flags: '--godog.tags=~@Serial'
+            use-artifacts: true
+            use-codecov: true
+          - name: serial-e2e
+            make-target: test-e2e
+            e2e-flags: '--godog.tags=@Serial'
             use-artifacts: true
             use-codecov: true
           - name: experimental-e2e
             make-target: test-experimental-e2e
+            e2e-flags: '--godog.tags=~@Serial'
+            use-artifacts: true
+            use-codecov: true
+          - name: experimental-serial-e2e
+            make-target: test-experimental-e2e
+            e2e-flags: '--godog.tags=@Serial'
             use-artifacts: true
             use-codecov: true
           - name: upgrade-st2st-e2e
@@ -50,9 +62,9 @@ jobs:
       - name: Run e2e test
         run: |
           if [[ "${{ matrix.test.use-artifacts }}" == "true" ]]; then
-            ARTIFACT_PATH=/tmp/artifacts E2E_SUMMARY_OUTPUT=$GITHUB_STEP_SUMMARY make ${{ matrix.test.make-target }}
+            ARTIFACT_PATH=/tmp/artifacts E2E_SUMMARY_OUTPUT=$GITHUB_STEP_SUMMARY E2E_FLAGS="${{ matrix.test.e2e-flags }}" make ${{ matrix.test.make-target }}
           else
-            make ${{ matrix.test.make-target }}
+            E2E_FLAGS="${{ matrix.test.e2e-flags }}" make ${{ matrix.test.make-target }}
           fi
 
       - uses: actions/upload-artifact@v7
@@ -68,4 +80,3 @@ jobs:
           files: coverage/${{ matrix.test.name }}.out
           flags: ${{ matrix.test.name }}
           token: ${{ secrets.CODECOV_TOKEN }}
-

Makefile

@@ -255,9 +255,10 @@ $(eval $(call install-sh,standard,operator-controller-standard.yaml))
 test: manifests generate fmt lint test-unit test-e2e test-regression #HELP Run all tests.
 
 E2E_TIMEOUT ?= 10m
+E2E_FLAGS ?=
 .PHONY: e2e
 e2e: #EXHELP Run the e2e tests.
-	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(E2E_TIMEOUT)
+	go test -count=1 -v ./test/e2e/features_test.go -timeout=$(E2E_TIMEOUT) $(E2E_FLAGS)
 
 export CLUSTER_REGISTRY_HOST := docker-registry.operator-controller-e2e.svc:5000
 .PHONY: extension-developer-e2e

test/e2e/features/tls.feature

@@ -11,19 +11,19 @@ Feature: TLS profile enforcement on metrics endpoints
   # and curve enforcement because Go's crypto/tls does not allow the server to restrict
   # TLS 1.3 cipher suites — CipherSuites config only applies to TLS 1.2. The e2e cert
   # uses ECDSA, so ECDHE_ECDSA cipher families are required.
-  @TLSProfile
+  @TLSProfile @Serial
   Scenario: catalogd metrics endpoint enforces configured minimum TLS version
     Given the "catalogd" deployment is configured with custom TLS minimum version "TLSv1.3"
     Then the "catalogd" metrics endpoint accepts a TLS 1.3 connection
     And the "catalogd" metrics endpoint rejects a TLS 1.2 connection
 
-  @TLSProfile
+  @TLSProfile @Serial
   Scenario: catalogd metrics endpoint negotiates and enforces configured cipher suite
     Given the "catalogd" deployment is configured with custom TLS version "TLSv1.2", ciphers "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", and curves "prime256v1"
     Then the "catalogd" metrics endpoint negotiates cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" over TLS 1.2
     And the "catalogd" metrics endpoint rejects a TLS 1.2 connection offering only cipher "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
 
-  @TLSProfile
+  @TLSProfile @Serial
   Scenario: catalogd metrics endpoint enforces configured curve preferences
     Given the "catalogd" deployment is configured with custom TLS version "TLSv1.2", ciphers "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", and curves "prime256v1"
     Then the "catalogd" metrics endpoint accepts a TLS 1.2 connection with cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" and curve "prime256v1"

test/e2e/features_test.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/cucumber/godog"
@@ -27,41 +29,69 @@ func init() {
 }
 
 func TestMain(m *testing.M) {
-	// parse CLI arguments
 	pflag.Parse()
 	opts.Paths = pflag.Args()
 
-	// run tests
+	fmt.Println("")
+	fmt.Println("========================================")
+	fmt.Println("  PARALLEL scenarios (~@Serial)")
+	fmt.Println("========================================")
+	fmt.Println("")
+	parallelOpts := opts
+	parallelOpts.Paths = slices.Clone(opts.Paths)
+	parallelOpts.Tags = andTags(opts.Tags, "~@Serial")
+	parallelOpts.Concurrency = 100
 	sc := godog.TestSuite{
 		TestSuiteInitializer: InitializeSuite,
 		ScenarioInitializer:  InitializeScenario,
-		Options:              &opts,
+		Options:              &parallelOpts,
 	}.Run()
 
+	if sc == 0 {
+		fmt.Println("")
+		fmt.Println("========================================")
+		fmt.Println("  SERIAL scenarios (@Serial)")
+		fmt.Println("========================================")
+		fmt.Println("")
+		serialOpts := opts
+		serialOpts.Paths = slices.Clone(opts.Paths)
+		serialOpts.Tags = andTags(opts.Tags, "@Serial")
+		serialOpts.Concurrency = 1
+		sc = godog.TestSuite{
+			TestSuiteInitializer: InitializeSuite,
+			ScenarioInitializer:  InitializeScenario,
+			Options:              &serialOpts,
+		}.Run()
+	}
+
 	switch sc {
-	//	0 - success
 	case 0:
-
 		path := os.Getenv("E2E_SUMMARY_OUTPUT")
 		if path == "" {
 			fmt.Println("Note: E2E_SUMMARY_OUTPUT is unset; skipping summary generation")
 		} else {
 			if err := testutil.PrintSummary(path); err != nil {
-				// Fail the run if alerts are found
 				fmt.Printf("%v", err)
 				os.Exit(1)
 			}
 		}
 		return
-
-	//	1 - failed
-	//	2 - command line usage error
-	// 128 - or higher, os signal related error exit codes
 	default:
 		log.Fatalf("non-zero status returned (%d), failed to run feature tests", sc)
 	}
 }
 
+func andTags(base string, extra ...string) string {
+	parts := append([]string{base}, extra...)
+	var nonEmpty []string
+	for _, p := range parts {
+		if p != "" {
+			nonEmpty = append(nonEmpty, p)
+		}
+	}
+	return strings.Join(nonEmpty, " && ")
+}
+
 func InitializeSuite(tc *godog.TestSuiteContext) {
 	tc.BeforeSuite(steps.BeforeSuite)
 }