e2e: add acceptance minikube quick e2e smoke gate

Add a lightweight acceptance e2e workflow that runs on every PR via
GitHub Actions using minikube + Rook Ceph. This gates basic
provisioning, snapshot, and clone operations across RBD, CephFS, and
NFS drivers (12 specs total) before the heavier CentOS mini-e2e suite.

The acceptance suite uses ceph-csi-operator deployment mode, where
the operator deploys ceph-csi drivers via CRDs (Driver, OperatorConfig)
instead of manual manifests.

Key changes:
- Add e2e-minikube-acceptance.yaml workflow with operator deployment
- Tag 12 core specs with Label("acceptance") across drivers
- Add skip-vault flag to skip Vault KMS in smoke runs
- Add KUBE_VERSION to build.env as single source of truth
- Add github-action-helper.sh with install_minikube_prereqs,
  prepare_disk, and collect_logs functions
- Tolerate pre-existing KMS configmap in operator mode
- Document acceptance suite in e2e/README.md and AGENTS.md
- Contributors can label new feature specs with acceptance and run
  the gate in their own fork for quick e2e verification loops

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Rakshith R <rar@redhat.com>

Author: Rakshith-R

.github/workflows/e2e-minikube-acceptance.yaml

@@ -0,0 +1,129 @@
+---
+# Acceptance quick e2e: minikube + Rook Ceph smoke on every PR.
+# Complements (does NOT replace) CentOS mini-e2e via ok-to-test.
+name: e2e-minikube-acceptance
+"on":
+  pull_request:
+    branches:
+      - devel
+      - "release-v*"
+    paths-ignore:
+      - "docs/**"
+      - "**/*.md"
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+    github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION_FILE: go.mod
+
+jobs:
+  e2e-acceptance:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ env.GO_VERSION_FILE }}
+
+      - name: Source build.env
+        run: |
+          set -a
+          # shellcheck disable=SC1091
+          source build.env
+          set +a
+          {
+            echo "KUBE_VERSION=${KUBE_VERSION}"
+            echo "MINIKUBE_VERSION=${MINIKUBE_VERSION}"
+            echo "ROOK_VERSION=${ROOK_VERSION}"
+            echo "ROOK_CEPH_CLUSTER_IMAGE=\
+          ${ROOK_CEPH_CLUSTER_IMAGE}"
+            echo "SNAPSHOT_VERSION=${SNAPSHOT_VERSION}"
+            echo "VM_DRIVER=${VM_DRIVER}"
+            echo "CSI_IMAGE_VERSION=\
+          ${CSI_IMAGE_VERSION}"
+          } >> "$GITHUB_ENV"
+
+      - name: Install minikube prerequisites
+        run: >-
+          scripts/github-action-helper.sh
+          install_minikube_prereqs
+
+      - name: Setup minikube
+        run: |
+          sudo sysctl fs.protected_regular=0
+          scripts/minikube.sh up
+        env:
+          MEMORY: "6144"
+
+      - name: Prepare disk for OSD
+        run: >-
+          scripts/github-action-helper.sh prepare_disk
+
+      - name: Pre-pull Ceph image
+        run: >-
+          docker pull "$ROOK_CEPH_CLUSTER_IMAGE"
+
+      - name: Deploy Rook + Ceph
+        run: scripts/minikube.sh deploy-rook
+        env:
+          ROOK_DEPLOY_TIMEOUT: "600"
+          KUBECTL_RETRY_DELAY: "5"
+
+      - name: Install snapshot controller
+        run: >-
+          scripts/minikube.sh install-snapshotter
+
+      - name: Build ceph-csi image
+        run: make image-cephcsi
+        env:
+          CONTAINER_CMD: docker
+
+      - name: Load sidecar images
+        run: scripts/minikube.sh k8s-sidecar
+
+      - name: Deploy ceph-csi-operator
+        run: >-
+          scripts/deploy-ceph-csi-operator.sh deploy
+
+      - name: Build e2e.test
+        run: make e2e.test
+
+      - name: Run acceptance e2e
+        run: |
+          cd e2e && ../e2e.test \
+            -test.v -ginkgo.v \
+            --ginkgo.label-filter=acceptance \
+            --ginkgo.timeout=25m \
+            --deploy-timeout=10 \
+            --test-rbd=true \
+            --test-cephfs=true \
+            --test-nfs=true \
+            --test-nvmeof=false \
+            --deploy-rbd=false \
+            --deploy-cephfs=false \
+            --operator-deployment \
+            --skip-vault=true
+
+      - name: Collect logs on failure
+        if: failure()
+        run: >-
+          scripts/github-action-helper.sh collect_logs
+
+      - name: Upload failure logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: acceptance-e2e-logs
+          path: /tmp/acceptance-e2e-logs/
+          retention-days: 7

AGENTS.md

@@ -92,6 +92,21 @@ make run-e2e E2E_ARGS="--test-cephfs=false"       # Run with specific args
 functional Ceph cluster. Only run these tests when both are available and
 properly configured. See `e2e/` directory for test implementations.
 
+### Acceptance E2E (Quick Smoke Gate)
+
+The `e2e-minikube-acceptance` workflow (`.github/workflows/e2e-minikube-acceptance.yaml`)
+runs 12 core specs (RBD, CephFS, NFS) on a minikube cluster with Rook Ceph.
+It triggers on every `pull_request` to `devel` or `release-v*` branches — no
+secrets or `ok-to-test` label needed.
+
+**Fork users:** Add `Label("acceptance")` to new feature specs and open a PR
+within your fork for quick e2e verification loops before submitting upstream.
+Check your fork's Actions tab for results.
+
+Specs are tagged with `Label("acceptance")` in the e2e Go files. To add a
+spec to the acceptance suite, add the label to its `It()` declaration. See
+`e2e/README.md` for details.
+
 ### Module Checks
 
 ```bash

build.env

@@ -56,6 +56,7 @@ HELM_SCRIPT=https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
 HELM_VERSION=v3.19.0
 
 # minikube settings
+KUBE_VERSION=v1.35.1
 MINIKUBE_VERSION=v1.38.1
 VM_DRIVER=none
 CHANGE_MINIKUBE_NONE_USER=true

e2e/README.md

@@ -126,6 +126,74 @@ follow these steps before running e2e.
     ./scripts/install-snapshot.sh cleanup
     ```
 
+## Acceptance E2E (Minikube)
+
+The acceptance suite is a lightweight smoke gate that runs on **every PR** via
+GitHub Actions (`.github/workflows/e2e-minikube-acceptance.yaml`). It deploys
+ceph-csi on a minikube cluster with Rook Ceph and runs only specs labeled
+`Label("acceptance")`.
+
+**Scope (12 specs):**
+
+| Driver | Specs |
+|--------|-------|
+| RBD    | PVC→app, snapshot→clone, PVC-PVC clone, block PVC |
+| CephFS | health check, PVC→app, snapshot→clone, PVC-PVC clone |
+| NFS    | health check, PVC→app, snapshot→clone, PVC-PVC clone |
+
+**Relationship to CentOS mini-e2e:** The acceptance suite does **not** replace
+CentOS `ci/centos/mini-e2e/k8s-*`. CentOS jobs run the full suite (~85 RBD +
+~48 CephFS + NFS + more) after `ok-to-test`. Acceptance catches "drivers won't
+deploy / basic provision broken" before that.
+
+### Running acceptance specs locally
+
+```console
+# Run acceptance specs on an existing cluster
+cd e2e && ../e2e.test -test.v -ginkgo.v \
+  --ginkgo.label-filter=acceptance \
+  --ginkgo.timeout=15m \
+  --deploy-timeout=10 \
+  --test-rbd=true --test-cephfs=true \
+  --test-nfs=true --test-nvmeof=false \
+  --deploy-rbd=true --deploy-cephfs=true \
+  --skip-vault=true
+```
+
+### Adding specs to acceptance
+
+Add `Label("acceptance")` to the `It()` declaration:
+
+```go
+It("my new smoke test", Label("acceptance"), func() {
+    // ...
+})
+```
+
+### Running acceptance e2e in your fork
+
+Contributors can run the acceptance gate in their own fork before
+opening a PR upstream:
+
+1. Fork `ceph/ceph-csi` on GitHub.
+1. Push your branch to **your fork**.
+1. Open a PR **within your fork** (base: your fork's `devel`, head: your
+   branch). The `e2e-minikube-acceptance` workflow triggers automatically on
+   `pull_request` — no secrets or `ok-to-test` label required.
+1. Check the Actions tab for results. Failed runs upload logs as the
+   `acceptance-e2e-logs` artifact.
+
+This gives you a quick signal that basic provisioning, snapshots, and clones
+work before submitting upstream. When adding new features, tag their specs
+with `Label("acceptance")` to include them in the gate — this enables fast
+e2e verification loops entirely within your fork.
+
+### Test parameters for acceptance
+
+| flag       | description                                       |
+|------------|---------------------------------------------------|
+| skip-vault | Skip Vault KMS deployment for faster runs (default: false) |
+
 ## Running E2E
 
 `

e2e/cephfs.go

@@ -241,7 +241,14 @@ var _ = Describe(cephfsType, func() {
 		if err != nil {
 			logAndFail("failed to create node secret: %v", err)
 		}
-		deployVault(f.ClientSet, deployTimeout)
+		if !skipVault {
+			deployVault(f.ClientSet, deployTimeout)
+		} else {
+			err = createEmptyKMSConfigMap(f.ClientSet, cephCSINamespace)
+			if err != nil {
+				logAndFail("failed to create empty KMS configmap: %v", err)
+			}
+		}
 
 		err = cephFSDeployment.setClusterName(defaultClusterName)
 		if err != nil {
@@ -300,7 +307,9 @@ var _ = Describe(cephfsType, func() {
 		if err != nil {
 			logAndFail("failed to delete storageclass: %v", err)
 		}
-		deleteVault()
+		if !skipVault {
+			deleteVault()
+		}
 
 		err = deleteSubvolumegroup(f, fileSystemName, subvolumegroup)
 		if err != nil {
@@ -336,7 +345,7 @@ var _ = Describe(cephfsType, func() {
 		appEphemeralPath := cephFSExamplePath + "pod-ephemeral.yaml"
 		pvcRWOPPath := cephFSExamplePath + "pvc-rwop.yaml"
 
-		It("checking provisioner and nodeplugin are running", func() {
+		It("checking provisioner and nodeplugin are running", Label("acceptance"), func() {
 			Expect(waitForCSI(
 				f.ClientSet,
 				cephFSDeployment.getDeploymentName(),
@@ -940,7 +949,7 @@ var _ = Describe(cephfsType, func() {
 			}
 		})
 
-		It("create a PVC and bind it to an app", func() {
+		It("create a PVC and bind it to an app", Label("acceptance"), func() {
 			err := createCephfsStorageClass(f.ClientSet, f, false, nil)
 			if err != nil {
 				logAndFail("failed to create CephFS storageclass: %v", err)
@@ -1502,7 +1511,7 @@ var _ = Describe(cephfsType, func() {
 			}
 		})
 
-		It("create a PVC clone and bind it to an app", func() {
+		It("create a PVC clone and bind it to an app", Label("acceptance"), func() {
 			var wg sync.WaitGroup
 			totalCount := 3
 			wgErrs := make([]error, totalCount)
@@ -2401,7 +2410,7 @@ var _ = Describe(cephfsType, func() {
 			}
 		}
 
-		It("create a PVC-PVC clone and bind it to an app", func() {
+		It("create a PVC-PVC clone and bind it to an app", Label("acceptance"), func() {
 			var wg sync.WaitGroup
 			totalCount := 3
 			wgErrs := make([]error, totalCount)

e2e/e2e_test.go

@@ -53,6 +53,7 @@ func init() {
 	flag.StringVar(&clusterID, "clusterid", "", "Ceph cluster ID to use (defaults to `ceph fsid` detection)")
 	flag.StringVar(&nfsDriverName, "nfs-driver", "nfs.csi.ceph.com", "name of the driver for NFS-volumes")
 	flag.BoolVar(&operatorDeployment, "operator-deployment", false, "test running on deployment via operator")
+	flag.BoolVar(&skipVault, "skip-vault", false, "skip Vault KMS deployment (e.g. for acceptance smoke tests)")
 	setDefaultKubeconfig()
 
 	// Register framework flags, then handle flags

e2e/nfs.go

@@ -493,7 +493,7 @@ var _ = Describe("nfs", func() {
 		appClonePath := nfsExamplePath + "pod-restore.yaml"
 		snapshotPath := nfsExamplePath + "snapshot.yaml"
 
-		It("checking provisioner and nodeplugin are running", func() {
+		It("checking provisioner and nodeplugin are running", Label("acceptance"), func() {
 			Expect(waitForCSI(
 				f.ClientSet,
 				nfsDeployment.getDeploymentName(),
@@ -659,7 +659,7 @@ var _ = Describe("nfs", func() {
 			}
 		})
 
-		It("create a PVC and bind it to an app", func() {
+		It("create a PVC and bind it to an app", Label("acceptance"), func() {
 			err := createNFSStorageClass(f.ClientSet, f, false, nil)
 			if err != nil {
 				logAndFail("failed to create NFS storageclass: %v", err)
@@ -813,7 +813,7 @@ var _ = Describe("nfs", func() {
 			}
 		})
 
-		It("create a PVC clone and bind it to an app", func() {
+		It("create a PVC clone and bind it to an app", Label("acceptance"), func() {
 			var wg sync.WaitGroup
 			totalCount := 3
 			wgErrs := make([]error, totalCount)
@@ -1103,7 +1103,7 @@ var _ = Describe("nfs", func() {
 			validateOmapCount(f, 0, cephfsType, metadataPool, snapsType)
 		})
 
-		It("create a PVC-PVC clone and bind it to an app", func() {
+		It("create a PVC-PVC clone and bind it to an app", Label("acceptance"), func() {
 			var wg sync.WaitGroup
 			totalCount := 3
 			wgErrs := make([]error, totalCount)