chore(e2e-next): Migrate e2e_ha to e2e-next framework

[pascalbreuninger]

Summary

• Migrates test/e2e_ha/ (HA cert rotation tests) to the e2e-next/test_ha/ framework
• Consolidates old test into two focused It blocks (CA rotation + leaf rotation) with waitForDeploymentReady helper
• Adds HAVCluster cluster definition with dedicated HA values YAML (3 replicas, external etcd)
• Registers suite in e2e_suite_test.go with proper setup/cleanup wiring

Test plan

• go build ./e2e-next/... compiles cleanly
• go vet ./e2e-next/... passes
• Run HA e2e suite against a kind cluster
• Verify old test/e2e_ha/ files are fully removed

🤖 Generated with Claude Code

---

📋 E2E Migration Validator Notes

Overall: ⚠️ Changes requested

🔴 Must Fix

• Cert rotation assertions do not prove rotation happened. Both It blocks assert cert.NotAfter.After(time.Now()), which passes even without rotation (a freshly installed vCluster already has valid certs). Record the cert's serial number (or NotBefore) before rotation, then assert it changed afterward.

🟡 Should Fix

• No verification that etcd pods recover. The rotation implementation deletes etcd pods after rotation. The test should verify the etcd StatefulSet also reaches full readiness, not just the vCluster Deployment.
• waitForDeploymentReady assumes the vCluster workload is a Deployment. With etcd.deploy.enabled: true and no persistence, the chart renders a Deployment. If the HA config changes, this helper will silently fail. Add a comment documenting this assumption or generalize.

🟢 Nice to Have

• Add one certs check invocation (even just verifying it does not error) to catch regressions in the check command's ability to connect to the HA vCluster.
• haVClusterNamespace uses hardcoded "vcluster-" prefix — consistent with other tests but fragile.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b4eaddf48

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Assert certificate actually changes after rotation

This assertion only checks that NotAfter is in the future, which is already true for a freshly created vCluster certificate, so the test can pass even if vcluster certs rotate-ca (and similarly rotate in the second spec) does nothing. In CI this creates a false-positive signal for cert-rotation regressions because validity alone does not prove rotation happened; capture a pre-rotation fingerprint (for example serial number or NotBefore) and assert it changed after the command.

Useful? React with 👍 / 👎.