test: e2e for the four payload kinds that had never met an API server

[kfeofantov]

Closes finding 3 from the review. job_runs, deployment_revisions, workload_policy and cluster_policy had unit tests and golden bytes and no contact with a real cluster. One suite covers all four — they come from the same flush and the same fixtures. Runs in 64 seconds: make policy-e2e.

The assertion that earns the test

workload_policy records can only be built if the ClusterRole actually grants the six resources ADR 0032 added. And since ADR 0033 a missing grant no longer stops the agent — so a mistake there would now be silent in every other test. Here it surfaces as an unavailable_sources line the test requires to be absent.

Verified by breaking it. Removing the storageclasses rule from deploy/controller.yaml and running the suite:

policy_test.go:85: unavailable sources = [storage_classes]; the deployed
    ClusterRole does not grant what ADR 0032 says it does
--- FAIL: TestPolicyAndJournalsEndToEnd (63.88s)

That run doubles as the first real-cluster confirmation of ADR 0033: revisions and workload policy still arrived while a grant was missing, and the agent kept running. That is the whole point of the change, and it had only ever been tested against a fake client.

Readiness conditions are part of the assertion

The first arrangement caught the missing grant too — as a six-minute timeout waiting for the storage-class catalog to appear. Awaiting the catalog is the wrong condition: a missing grant is then reported as "something never showed up" instead of the one-line cause it is. The wait is now on the fixture namespace, and the grants are asserted where the failure can name itself. Same detection, 64 seconds instead of 426, with a message that says what to fix.

Two details that turned into decisions

Fixtures live in their own namespace. A ResourceQuota or LimitRange in the controller's namespace would apply to the controller's own pod, and the test would be measuring its own interference.

Job-run windows decode as a stream. A run near an hour boundary leaves two files and cat over the glob concatenates them; a single Unmarshal would fail on the second document.

The first run failed, usefully

The inner metric struct had no JSON tags, and Go's case-insensitive field matching does not reach target_type — so TargetType and TargetValue came back empty. Exactly the class of mismatch this suite exists to catch, even though it lived in the test rather than in the agent.

What it asserts

• deployment_revisions — revision 1 of the fixture Deployment with its image.
• workload_policy — the budget (minAvailable: 100% → disruptions_allowed: 0, the node cannot be drained) and the autoscaler, with the utilization target travelling beside its type.
• cluster_policy — the namespace's LimitRange default request, the quota's hard limit, and kind's own standard storage class in the catalog.
• job_runs — a Job that finished on its own, with both instants read from the object rather than baselined (ADR 0029 §3).

make test (16 packages) and make lint (0 issues) green; make policy-e2e green against kind.

🤖 Generated with Claude Code