test(e2e): infrastructure provider subprocess suite + CI job for provider suites

.github/workflows/e2e.yaml

@@ -11,6 +11,28 @@ permissions:
   contents: read
 
 jobs:
+  # Subprocess provider suites: hub with embedded kcp + provider binaries as
+  # host processes, driven over HTTP + kcp dynamic clients. No kind, no Helm,
+  # no Docker — the cheapest full-kcp coverage we have.
+  #
+  # NOTE: the older quickstart suite (make e2e-provider) predates the
+  # provider bootstrap refactor (Provider CR + provider-run init) and fails
+  # against the current hub — it is deliberately NOT wired here until it is
+  # modernized onto the same bootstrap the infraprovider suite uses.
+  e2e-providers:
+    name: Provider suites (embedded kcp subprocesses)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: v1.26.1
+
+      - name: Run infrastructure provider e2e
+        run: make e2e-infra-provider
+
   e2e-standalone:
     name: Standalone (embedded kcp + static token)
     runs-on: ubuntu-latest

Makefile

@@ -611,6 +611,21 @@ e2e-provider-flags: build-hub ## Run --providers flag mechanics suite
 ## Run both provider suites back-to-back (sequential — they share port 2380).
 e2e-provider-all: e2e-provider e2e-provider-flags ## Run provider + provider-flags suites sequentially
 
+## Infrastructure provider e2e (embedded kcp + infrastructure-provider
+## init/serve subprocesses). Covers the kcp-side surface the kind/kro
+## template e2e can't: provisioning, init bootstrap + template seeding, the
+## Template controller chain via the stub backend, retired-template
+## enforcement, and the tenant catalog read through an APIBinding. Shares
+## the embedded-kcp etcd port 2380 with the other subprocess suites — do
+## not run them concurrently.
+E2E_INFRA_PROVIDER_TIMEOUT ?= 15m
+e2e-infra-provider: build-hub build-infrastructure-provider ## Run infrastructure provider e2e suite
+	@test -z "$$(lsof -ti :19453 :16453 :18086 :2380 2>/dev/null)" || { \
+		echo "ports 19453/16453/18086/2380 are in use; stop any running kedge-hub/infrastructure-provider first"; \
+		exit 1; \
+	}
+	go test ./test/e2e/suites/infraprovider/... -v -timeout $(E2E_INFRA_PROVIDER_TIMEOUT) $(if $(E2E_FLAGS),-args $(E2E_FLAGS))
+
 ## Tilt-cluster suite: runs against an ALREADY-RUNNING operator-deployed,
 ## multi-shard Tilt stack (start it in another terminal with `make tilt-cluster`).
 ## Unlike the other e2e suites it does NOT spawn its own processes — it connects

providers/infrastructure/install/identity.go

@@ -197,12 +197,15 @@ func ensureClusterRole(ctx context.Context, cs kubernetes.Interface) error {
 	want := &rbacv1.ClusterRole{
 		ObjectMeta: metav1.ObjectMeta{Name: RuntimeRoleName},
 		Rules: []rbacv1.PolicyRule{
-			// Templates — read + status patch. The Template
-			// controller patches status on every reconcile pass.
+			// Templates — read + status patch, plus delete: the
+			// controller enforces retirement of removed platform
+			// templates by deleting them on sight
+			// (controller/template/retired.go). Finalizer add/remove
+			// (update) comes from the wildcard rule below.
 			{
 				APIGroups: []string{"infrastructure.kedge.faros.sh"},
 				Resources: []string{"templates"},
-				Verbs:     []string{"get", "list", "watch"},
+				Verbs:     []string{"get", "list", "watch", "delete"},
 			},
 			{
 				APIGroups: []string{"infrastructure.kedge.faros.sh"},
@@ -250,13 +253,13 @@ func ensureClusterRole(ctx context.Context, cs kubernetes.Interface) error {
 				Resources: []string{"cachedresources"},
 				Verbs:     []string{"get", "list", "watch"},
 			},
-			// CRD reads so the controller can check Established
-			// condition without trying to write CRDs (init owns
-			// CRD writes).
+			// CRDs: the controller authors the per-template CRD on
+			// reconcile and deletes it in the finalize chain when a
+			// Template is removed (deletePerTemplateCRD).
 			{
 				APIGroups: []string{"apiextensions.k8s.io"},
 				Resources: []string{"customresourcedefinitions"},
-				Verbs:     []string{"get", "list", "watch", "create", "update"},
+				Verbs:     []string{"get", "list", "watch", "create", "update", "delete"},
 			},
 		},
 	}