e2e: add NFS test for modifying clients via VolumeAttributesClass

Add comprehensive e2e test that verifies the clients parameter can be
modified using VolumeAttributesClass. The test:
- Creates a volume with restrictive clients (1.1.1.1)
- Verifies that an app fails to mount with restrictive settings
- Updates the clients parameter via VolumeAttributesClass to allow all
  clients (0.0.0.0/0)
- Verifies that the app successfully mounts after the update

The test runs just before the cleanup phase to ensure proper test
sequencing.

Assisted-by: AskBob <askbob@ibm.com>
Signed-off-by: Niels de Vos <ndevos@ibm.com>

Author: nixpanic

e2e/nfs.go

@@ -1249,6 +1249,103 @@ var _ = Describe("nfs", func() {
 			validateOmapCount(f, 0, cephfsType, metadataPool, volumesType)
 		})
 
+		It("create a storageclass with clients restriction and modify it with VolumeAttributesClass", func() {
+			if !k8sVersionGreaterEquals(c, 1, 34) {
+				framework.Logf("skipping VolumeAttributesClass test, needs Kubernetes >= 1.34")
+
+				return
+			}
+
+			// Initial clients list - restrictive (Cloudflare DNS, should fail to mount)
+			initialClients := "1.1.1.1"
+			// Updated clients list - permissive (allow all clients)
+			updatedClients := "0.0.0.0/0"
+
+			err := createNFSStorageClass(f.ClientSet, f, false, map[string]string{
+				"clients": initialClients,
+			})
+			if err != nil {
+				logAndFail("failed to create NFS storageclass: %v", err)
+			}
+			err = createNFSVolumeAttributesClass(f.ClientSet, f, map[string]string{
+				"clients": updatedClients,
+			})
+			if err != nil {
+				logAndFail("failed to create NFS volumeattributesclass: %v", err)
+			}
+
+			pvc, err := loadPVC(pvcPath)
+			if err != nil {
+				logAndFail("Could not load PVC: %v", err)
+			}
+			pvc.Namespace = f.UniqueName
+
+			// Create PVC first without VolumeAttributesClass
+			err = createPVCAndvalidatePV(f.ClientSet, pvc, deployTimeout)
+			if err != nil {
+				logAndFail("failed to create PVC: %v", err)
+			}
+
+			// Verify initial restrictive clients parameter
+			if !checkExports(f, "my-nfs", initialClients) {
+				logAndFail("failed to verify initial clients in exports")
+			}
+
+			app, err := loadApp(appPath)
+			if err != nil {
+				logAndFail("failed to load application: %v", err)
+			}
+			app.Namespace = f.UniqueName
+			app.Spec.Volumes[0].PersistentVolumeClaim.ClaimName = pvc.Name
+
+			// Try to create app with restrictive clients - should fail to reach running state
+			err = createApp(f.ClientSet, app, deployTimeout)
+			if err == nil {
+				logAndFail("app should have failed to start with restrictive clients, but succeeded")
+			}
+			framework.Logf("app correctly failed to start with restrictive clients: %v", err)
+
+			// Delete the failed app
+			err = deletePod(app.Name, app.Namespace, f.ClientSet, deployTimeout)
+			if err != nil {
+				logAndFail("failed to delete app: %v", err)
+			}
+
+			// Apply VolumeAttributesClass to PVC to update clients
+			vacName := "updated-parameters"
+			pvc.Spec.VolumeAttributesClassName = &vacName
+			_, err = f.ClientSet.CoreV1().PersistentVolumeClaims(pvc.Namespace).Update(
+				context.TODO(), pvc, metav1.UpdateOptions{})
+			if err != nil {
+				logAndFail("failed to update PVC with VolumeAttributesClass: %v", err)
+			}
+
+			// Now create app again - VolumeAttributesClass should update clients to 0.0.0.0/0
+			err = createApp(f.ClientSet, app, deployTimeout)
+			if err != nil {
+				logAndFail("failed to create application with updated clients: %v", err)
+			}
+
+			// Verify the updated clients parameter is applied
+			if !checkExports(f, "my-nfs", updatedClients) {
+				logAndFail("failed to verify updated clients in exports")
+			}
+
+			// delete PVC and app
+			err = deletePVCAndApp("", f, pvc, app)
+			if err != nil {
+				logAndFail("failed to delete PVC or application: %v", err)
+			}
+			err = deleteResource(nfsExamplePath + "storageclass.yaml")
+			if err != nil {
+				logAndFail("failed to delete NFS storageclass: %v", err)
+			}
+			err = deleteNFSVolumeAttributesClass(f.ClientSet, f)
+			if err != nil {
+				logAndFail("failed to delete NFS volumeattributesclass: %v", err)
+			}
+		})
+
 		It("delete NFS provisioner and plugin secret", func() {
 			// delete nfs provisioner secret
 			err := deleteCephUser(f, keyringCephFSProvisionerUsername)