[evan-cz]

Problem

Command-based KUTTL steps across the pre-existing tests/kuttl suites have been silently no-op'ing, so their e2e assertions never actually ran — the suites reported PASS without executing any of their kubectl/helm/curl logic. Two independent bugs cause this:

1. command: + args: — kuttl's Command has no args field and command is a single string, so only the bare first word (kubectl, sh, sleep) ran.
2. spec: wrapper — kuttl's TestStep has a top-level commands field and no spec, so nesting commands: under spec: made the whole step a no-op. Confirmed empirically with a marker probe against the pinned kuttl v0.25.0.

So make kind-test / helm-test-kuttl has been false-green for anything relying on commands.

Fix

Converts the 11 affected step files across alloy-clustered-test, collector-test, collector-comprehensive-test, webhook-test, and webhook-comprehensive-test to valid kuttl, preserving each step's original intent:

• Drop spec:; put commands: at the top level; use script: / single-string command: instead of command:+args:.
• Reference shared agent components by label (app.kubernetes.io/name=aggregator|webhook-server|ksm) and discover the install namespace, instead of the stale hardcoded cz-agent-* names that don't exist in the current chart (<release>-cz-*). Discovery excludes the alloy co-install (instance!=cz-alloy-ct).
• Background kubectl port-forward (a foreground one would hang the step) and land the curl body to a file before head so a failed fetch fails the step.
• Walk up to the repo root before the alloy helm calls (kuttl runs scripts with CWD = the step dir), with a loop-termination guard; pre-poll selector-based kubectl waits.
• Set explicit per-command timeout: on long-running commands (sleeps, helm --wait, and every kubectl wait): these suites' kuttl-test.yaml put timeout under spec:, which kuttl ignores, so the 30s per-command default otherwise applied and clamped them.
• Consolidate webhook-comprehensive/03 into one script: so $WEBHOOK_METRICS survives across the curl→grep→count chain (kuttl runs each entry in its own shell).

CI: make the built image usable by the matrix kind tests

Once the suites genuinely run they need a working agent image, which exposed a pre-existing gap: the test-matrix-k8s path installed an unpullable image (kind-overrides.yaml pins an intentionally-invalid-tag and the freshly-built untested image was never wired in), so agent pods never reached Ready — invisible while the suites were hollow. Fixed:

• New kind-load Makefile target.
• Both test-matrix-k8s.yaml jobs now log in to ghcr, pull the freshly-built untested image for the matrix arch, retag it as the tag the chart installs (dev-<sha>), kind load it into the node (chart imagePullPolicy: IfNotPresent), and run the kind phases explicitly (up → load → install/wait → helm-test-kuttl → teardown) so the image is present before install.

Verification

All five suites verified to genuinely execute and PASS against a local kind cluster using the exact up → kind-load → install/wait → helm-test-kuttl sequence CI now uses (5 PASS / 0 FAIL). A negative control (breaking an assertion / the curl target) confirms the now-live checks go red on a real regression.

Scope

• The CP-43292 webhookserver-disabled-test / webhookserver-upgrade-test suites share bug Bump anothrNick/github-tag-action from 1.69.0 to 1.70.0 #2 and are handled on that branch.

Refs CP-43356.

🤖 Generated with Claude Code