[e2e-scan] Test: Add e2e scenario for control-plane `groups` apply UPDATE lifecycle (unused overlay)

[github-actions]

Gap Summary

The test/e2e/scenarios/control-plane/groups/ scenario only exercises the CREATE action for control-plane group membership. An overlay directory overlays/002-update-members/control-plane.yaml already exists that replaces one group member with a different control plane, but no scenario step references it. The UPDATE path for group membership changes via apply is never exercised end-to-end.

A regression in group membership reconciliation (e.g. incorrect member diff, missing API call to update group membership) would pass the current suite undetected.

Evidence

Unused overlay (file exists, never referenced):

• test/e2e/scenarios/control-plane/groups/overlays/002-update-members/control-plane.yaml — swaps groups-staging-runtime for groups-emea-runtime as a member of groups-shared-group

Incomplete scenario (CREATE + idempotent only, no UPDATE step):

• test/e2e/scenarios/control-plane/groups/scenario.yaml — two steps: 001-apply-group-members (CREATE) and 002-plan-idempotent; neither step uses inputOverlayDirs

Comparison: sync-groups covers the same update via sync:

• test/e2e/scenarios/control-plane/sync-groups/scenario.yaml step 002-update-group-members uses the equivalent overlay and asserts DELETE/CREATE/UPDATE changes plus an idempotent sync check. The groups scenario should mirror this for the apply workflow.

Proposed Scenario Work

Expand the existing scenario test/e2e/scenarios/control-plane/groups/scenario.yaml.

Add two new steps after 001-apply-group-members, using the already-present overlay:

Step 002-apply-update-members:

- name: 002-apply-update-members
  inputOverlayDirs:
    - overlays/002-update-members
  commands:
    - name: 002-apply
      run:
        - apply
        - -f
        - "\{\{ .workdir }}/control-plane.yaml"
        - --auto-approve
      assertions:
        - select: "plan.metadata"
          expect:
            fields:
              mode: apply
        - select: >-
            plan.changes[?resource_type=='control_plane' &&
                          resource_ref=='groups-staging-runtime'] | [0]
          expect:
            fields:
              action: DELETE
        - select: >-
            plan.changes[?resource_type=='control_plane' &&
                          resource_ref=='groups-emea-runtime'] | [0]
          expect:
            fields:
              action: CREATE
        - select: >-
            plan.changes[?resource_type=='control_plane' &&
                          resource_ref=='groups-shared-group'] | [0]
          expect:
            fields:
              action: UPDATE

Step 003-plan-idempotent (rename / replace current 002-plan-idempotent):

- name: 003-plan-idempotent
  inputOverlayDirs:
    - overlays/002-update-members
  commands:
    - name: 003-plan
      outputFormat: disable
      run:
        - plan
        - --mode
        - apply
        - -f
        - "\{\{ .workdir }}/control-plane.yaml"
      assertions:
        - select: "summary"
          expect:
            fields:
              total_changes: 0

The overlay overlays/002-update-members/control-plane.yaml already contains the right content — no new files are needed.

Acceptance Criteria

• Step 002-apply-update-members is added to groups/scenario.yaml and uses overlays/002-update-members
• Assertions in that step verify at least one DELETE (for the removed member), one CREATE (for the new member), and one UPDATE (for the group CP)
• The existing 002-plan-idempotent step is updated (or replaced) to use inputOverlayDirs: [overlays/002-update-members] so it checks idempotency against the post-update state
• Scenario passes cleanly in the E2E harness

Reference Patterns

• test/e2e/scenarios/control-plane/sync-groups/scenario.yaml — identical update-members scenario structure for the sync workflow; copy step 002-update-group-members and 003-plan-idempotent as a starting point
• test/e2e/scenarios/control-plane/apply/scenario.yaml — UPDATE lifecycle pattern with field verification after apply

Generated by E2E Coverage Scanner · ● 1.1M · ◷

• expires on May 7, 2026, 12:56 PM UTC