Add patched-JDK rollout e2e (tier 18) and fix two provisioner bugs

.github/workflows/e2e.yml

@@ -107,6 +107,11 @@ jobs:
             java: true
             cluster: true
             helm: true
+          - name: "Tier 18: Patched JDK rollout"
+            tiers: --tier 18
+            java: true
+            cluster: true
+            helm: false
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

integration-tests/AGENTS.md

@@ -41,14 +41,14 @@ The harness does not switch branches or modify component sources. It uses
 |---|---|
 | Go | all |
 | Python 3 | 2, 4, 12, 13, 16, 17 |
-| JDK 21+ | 2, 3, 7, 8, 9, 12, 14, 15, 16, 17 |
-| Docker | 3, 6, 7, 8-12, 14-17 |
-| kubectl and a reachable cluster | 4-17 |
+| JDK 21+ | 2, 3, 7, 8, 9, 12, 14-18 |
+| Docker | 3, 6, 7, 8-12, 14-18 |
+| kubectl and a reachable cluster | 4-18 |
 | Helm | 4 (optional), 10, 15, 17 |
 | OpenSSL | 4, 5, 6, 10, 11 |
 
 Host-only tiers 1-3 need no cluster. Tiers 4-7 and 13 exercise API-server
-behavior. Tiers 6, 8-12, and 14-17 require local containerd nodes that
+behavior. Tiers 6, 8-12, and 14-18 require local containerd nodes that
 Docker can enter, such as kind. Managed clusters skip those node-side paths. Tier 13
 also proves the control-plane guard: a NodeProfile that does not set
 `nodePool.includeControlPlane` never counts or schedules onto a control-plane
@@ -78,6 +78,15 @@ that a runnable-image stage survives while its pod runs and while containerd
 still holds the image, then is reclaimed after the image is removed. Once GC is
 active, it may also reclaim unreferenced stages left on the node by earlier
 tiers.
+Tier 18 covers a patched-JDK rollout. It provisions a Temurin 21 digest,
+runs a Brewlet workload on it, then replaces the NodeProfile digest with a
+patched release. It asserts that the node re-advertises the new version for
+the new profile generation, that the DaemonSet and `.brewlet-source` carry the
+new digest, and that the previous root is retired rather than deleted. It also
+checks that the running pod keeps its original JDK and container, and that a
+retired-root sweep keeps the root that pod still uses. Finally, it asserts
+that `kubectl rollout restart` moves the same application image onto the
+patched JDK, after which an idle sweep reclaims the retired root.
 
 **Architecture coverage.** Tiers pick up the node's architecture automatically,
 but hosted runners are amd64, so `.github/workflows/e2e.yml` runs the host-only
@@ -115,7 +124,7 @@ Common environment-specific skips:
 
 - Tier 5 skips when a cluster cannot reach a host-bound webhook; tier 6 covers
   the same assertions in-cluster.
-- Tiers 8, 9, 12, and 14-17 skip if no schedulable local containerd node
+- Tiers 8, 9, 12, and 14-18 skip if no schedulable local containerd node
   can be provisioned.
 - Tier 12 skips when the node's `ctr` supports neither `images unpack` nor
   import-time unpack; tier 16 applies the same rule.

integration-tests/e2e/reset.sh

@@ -31,7 +31,7 @@ fi
 # Fixed namespaces the tiers use for their fixtures. Throwaway per-run
 # namespaces (tiers 5/6/10/11) are random and self-cleaned by their RETURN
 # traps; we only need to sweep the deterministic ones here.
-E2E_FIXED_NS=(brewlet brewlet-e2e brewlet-e2e-app brewlet-custom-jdk brewlet-metrics-e2e brewlet-stagegc-e2e)
+E2E_FIXED_NS=(brewlet brewlet-e2e brewlet-e2e-app brewlet-custom-jdk brewlet-metrics-e2e brewlet-stagegc-e2e brewlet-jdk-patch)
 
 # scrub_node_labels: remove every brewlet.sh/* label and annotation from every
 # node. These are advertised by the provisioner (or simulated by tiers) and are

integration-tests/e2e/run.sh

@@ -32,7 +32,7 @@ mkdir -p "$WORK"
 for arg in "$@"; do
   case "$arg" in
     --list)
-      printf '1 unit  2 cli  3 runc  4 k8s  5 webhook(host)  6 webhook(in-cluster)  7 petclinic  8 appcds(in-cluster)  9 serving(in-cluster)  10 helm(in-cluster)  11 webhook-resilience  12 runnable-image(in-cluster)  13 nodeprofile  14 custom-jdk(in-cluster)  15 metrics(in-cluster)  16 failure-modes(in-cluster)  17 stage-gc(in-cluster)\n'
+      printf '1 unit  2 cli  3 runc  4 k8s  5 webhook(host)  6 webhook(in-cluster)  7 petclinic  8 appcds(in-cluster)  9 serving(in-cluster)  10 helm(in-cluster)  11 webhook-resilience  12 runnable-image(in-cluster)  13 nodeprofile  14 custom-jdk(in-cluster)  15 metrics(in-cluster)  16 failure-modes(in-cluster)  17 stage-gc(in-cluster)  18 jdk-patch(in-cluster)\n'
       exit 0
       ;;
   esac
@@ -98,6 +98,7 @@ source "$E2E_DIR/tier14-custom-jdk.sh"
 source "$E2E_DIR/tier15-metrics-incluster.sh"
 source "$E2E_DIR/tier16-failure-modes.sh"
 source "$E2E_DIR/tier17-stage-gc.sh"
+source "$E2E_DIR/tier18-jdk-patch.sh"
 
 declare -a TIERS=()
 DO_RESET=0
@@ -107,7 +108,7 @@ while [[ $# -gt 0 ]]; do
   case "$1" in
     --tier) TIERS+=("$2"); shift 2 ;;
     --reset) DO_RESET=1; shift ;;
-    --list) printf '1 unit  2 cli  3 runc  4 k8s  5 webhook(host)  6 webhook(in-cluster)  7 petclinic  8 appcds(in-cluster)  9 serving(in-cluster)  10 helm(in-cluster)  11 webhook-resilience  12 runnable-image(in-cluster)  13 nodeprofile  14 custom-jdk(in-cluster)  15 metrics(in-cluster)  16 failure-modes(in-cluster)  17 stage-gc(in-cluster)\n'; exit 0 ;;
+    --list) printf '1 unit  2 cli  3 runc  4 k8s  5 webhook(host)  6 webhook(in-cluster)  7 petclinic  8 appcds(in-cluster)  9 serving(in-cluster)  10 helm(in-cluster)  11 webhook-resilience  12 runnable-image(in-cluster)  13 nodeprofile  14 custom-jdk(in-cluster)  15 metrics(in-cluster)  16 failure-modes(in-cluster)  17 stage-gc(in-cluster)  18 jdk-patch(in-cluster)\n'; exit 0 ;;
     -h|--help) usage; exit 0 ;;
     *) warn "unknown arg: $1"; usage; exit 2 ;;
   esac
@@ -120,7 +121,7 @@ if [[ "$DO_RESET" -eq 1 ]]; then
   [[ ${#TIERS[@]} -eq 0 ]] && exit 0
 fi
 
-[[ ${#TIERS[@]} -eq 0 ]] && TIERS=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17)
+[[ ${#TIERS[@]} -eq 0 ]] && TIERS=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18)
 
 section "Brewlet E2E — environment"
 info "harness   : $REPO_DIR"
@@ -179,6 +180,7 @@ for t in "${TIERS[@]}"; do
     15) tier15_metrics_incluster ;;
     16) tier16_failure_modes ;;
     17) tier17_stage_gc ;;
+    18) tier18_jdk_patch ;;
     *) warn "no such tier: $t" ;;
   esac
 done