🤖 Generated by the Agentic Engineer
Evidence
scripts/tests/test-cilium-homogeneous-devices-autoscaler-gate.sh builds its fixture by copying the
live overlay:
cp "${root_dir}/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml" \
"${fixture_controllers}/kustomization.yaml"Its gate-active scenarios then assert active=true against that copy. So the scenario only holds
while the repository happens to have the homogeneous component referenced. The moment it is not — any
rollback, or simply the period before the next activation — the test fails with
the pre-publish phase must expose an active rollout gate to later steps, and a second copy later in
the file fails gate removal must reject an incoming non-strategy Cilium template change.
Measured 2026-08-09 while preparing a rollback: both assertions failed, and neither failure indicated a
real regression in the guard — the fixture had simply inherited a state its own assertions contradict.
Impact
A test that inherits repository state rather than constructing it does not test the guard; it tests
what the overlay currently says. It is red for a legitimate tree state and gives no signal about the
behaviour it names, which is exactly when a guard test matters most.
The rollback scenarios in the same file already do this correctly — they build their state by deleting
the reference — so the fix is to make the active scenarios symmetrical.
Expected behaviour
Both halves construct the state they assert. Copy the overlay, then normalise it to the active state
before the gate-active scenarios, with a fail-closed check that the normalisation actually applied.
Acceptance criteria
Rough size: small. A working implementation exists in the closed #3030 (an
install_active_controllers_fixture helper used at both copy sites) and can be lifted from there.
Evidence
scripts/tests/test-cilium-homogeneous-devices-autoscaler-gate.shbuilds its fixture by copying thelive overlay:
Its gate-active scenarios then assert
active=trueagainst that copy. So the scenario only holdswhile the repository happens to have the homogeneous component referenced. The moment it is not — any
rollback, or simply the period before the next activation — the test fails with
the pre-publish phase must expose an active rollout gate to later steps, and a second copy later inthe file fails
gate removal must reject an incoming non-strategy Cilium template change.Measured 2026-08-09 while preparing a rollback: both assertions failed, and neither failure indicated a
real regression in the guard — the fixture had simply inherited a state its own assertions contradict.
Impact
A test that inherits repository state rather than constructing it does not test the guard; it tests
what the overlay currently says. It is red for a legitimate tree state and gives no signal about the
behaviour it names, which is exactly when a guard test matters most.
The rollback scenarios in the same file already do this correctly — they build their state by deleting
the reference — so the fix is to make the active scenarios symmetrical.
Expected behaviour
Both halves construct the state they assert. Copy the overlay, then normalise it to the active state
before the gate-active scenarios, with a fail-closed check that the normalisation actually applied.
Acceptance criteria
Rough size: small. A working implementation exists in the closed #3030 (an
install_active_controllers_fixturehelper used at both copy sites) and can be lifted from there.