✨ Enable dual-stack binds for VM Operator webhook, metrics, health, profiler, and web-console validator

.cursor/rules/e2e-sync-with-changes.mdc

@@ -0,0 +1,18 @@
+---
+description: Add, update, or delete E2E tests in the same change set as related product behavior
+alwaysApply: true
+---
+
+# E2E tests stay aligned with code changes
+
+When changing VM Operator behavior that is observable on a WCP supervisor cluster (APIs, controllers, webhooks, defaults, validation, VM lifecycle or platform integration), **treat `test/e2e` as part of the same deliverable**:
+
+- **Add** E2E coverage when introducing or materially changing user-facing or cluster-observable behavior that this suite is meant to guard, or when fixing a gap a regression would have caught.
+- **Update** existing specs when expectations, labels, status, or workflows under test change.
+- **Delete** (or replace) scenarios and helpers when removing features or obsolete flows; drop fixtures and manifest patterns that become dead.
+
+Prefer extending existing suites under `test/e2e/vmservice/` (see `vmservice/virtualmachine/`), correct Ginkgo `Label(...)` usage, and shared helpers (`lib/vmoperator`, `manifestbuilders`, `infrastructure/vsphere`) per `test/e2e/README.md`.
+
+**Do not** land product-only changes that clearly require E2E updates without adjusting tests in the same effort (unless the team has explicitly scoped E2E as follow-up — then say so in the PR/summary).
+
+How to run and write tests (commands, labels, config): **`test/e2e/README.md`**. Cheatsheet when editing E2E files: **`.cursor/rules/e2e-testing.mdc`**.

.cursor/rules/e2e-testing.mdc

@@ -0,0 +1,58 @@
+---
+description: Run and write VM Operator E2E tests (Ginkgo suite against real WCP/vSphere)
+globs: "test/e2e/**/*.go"
+alwaysApply: false
+---
+
+# E2E Tests (`test/e2e`)
+
+**Product + E2E together:** `.cursor/rules/e2e-sync-with-changes.mdc` (always on) — add, update, or delete E2E tests alongside related code changes.
+
+**Canonical documentation:** `test/e2e/README.md` — prerequisites, architecture, env vars, labels, debugging, and writing patterns. Prefer updating that README when workflows change; keep this rule as a short pointer plus the commands used most often.
+
+## Running tests
+
+**Environment setup** (kubeconfig under `~/.kube/wcp-config`, vars exported — see README for `testbedInfo.json` or a remote URL):
+
+```bash
+source ./hack/setup-testbed-env.sh <testbedInfo.json|URL> --e2e
+```
+
+**Makefile targets** (from repo root):
+
+| Goal | Command |
+|------|---------|
+| Full E2E | `make test-e2e` |
+| Smoke | `make e2e-smoke` |
+| Core | `make e2e-core` |
+| Extended | `make e2e-extended` |
+
+**Prebuilt vs compile:** `make test-e2e` auto-detects `./e2e-tests` vs `test-e2e-ginkgo`. Prebuilt binaries need `-e2e.*` and `--ginkgo.*` in **one** argv block (no `--` separator); splitting with `--` drops Ginkgo filters.
+
+**Common filters** (passed through Makefile — see README for full list):
+
+```bash
+make test-e2e TEST_FOCUS="PATTERN"
+make test-e2e TEST_SKIP="a|b"
+make test-e2e LABEL_FILTER="smoke && !encryption"
+make test-e2e FLAKE_ATTEMPTS=3
+E2E_NAMESPACE=my-ns make e2e-smoke
+make test-e2e GINKGO_ARGS="-v --trace"
+```
+
+Config file: `test/e2e/vmservice/config/wcp.yaml`. Env vars such as `NETWORK`, `STORAGE_CLASS`, `E2E_NAMESPACE`, `TEST_FOCUS`, etc. are documented in the README table.
+
+## Writing tests
+
+- Follow layouts and examples under `test/e2e/vmservice/` (e.g. `vmservice/virtualmachine/`).
+- Use Ginkgo `Label(...)` with the project’s label scheme (`smoke`, `core-functional`, `extended-functional`, feature labels — see README).
+- Prefer helpers in `lib/vmoperator`, `manifestbuilders`, and `infrastructure/vsphere` rather than ad-hoc API calls.
+- Async behavior: `Eventually` / `Consistently`, not sleeps — same spirit as controller tests; details and snippets are in the README.
+
+### Structure and manifests
+
+- **Avoid inline closures** (`func(...) { ... }` assigned to a variable) inside `Describe` / `Context` unless they are clearly the smallest way to express a one-off and would not read cleaner as a few lines at the call site or a **package-level** helper in the same test package. Prefer inlining the steps in `It` / `BeforeEach`, or extending **`manifestbuilders`** / **`createPvcsFromSpec`**-style helpers so PVC and VM shapes stay consistent with the rest of the suite.
+- **PVCs**: Build volume claims with `createPvcsFromSpec` (or the same `manifestbuilders.PVC` fields it fills) and **`manifestbuilders.GetPersistentVolumeClaimYaml`** when you need a **standalone** PVC document (e.g. apply the PVC before the VM so admission can resolve the claim). That keeps YAML aligned with `GetVirtualMachineYamlA5` / `v1a5singlevm.yaml.in`.
+- **Apply path**: If `controller-runtime` `Create` on a PVC fails against CSI mutation webhooks (e.g. TLS timeout), use **`clusterProxy.ApplyWithArgs`** with the rendered YAML so the same path as `kubectl apply` is used.
+
+When adding new categories, labels, or Makefile variables, **update `test/e2e/README.md`**.

.cursor/rules/testing-standards.mdc

@@ -6,6 +6,9 @@ alwaysApply: false
 
 # Testing Standards
 
+**E2E (real WCP/vSphere cluster):** Tests under `test/e2e/` follow a different layout and Makefile workflow than controller tests. Follow **e2e-sync-with-changes** to add/update/delete E2E tests with product work; use **e2e-testing** when editing `test/e2e/**/*.go`, and read **`test/e2e/README.md`** for setup, running, labels, and writing patterns.
+
+
 ## Test File Naming
 
 | Suffix | Purpose | Example |

.cursor/rules/use-this-format-for-PR-description.mdc

@@ -0,0 +1,56 @@
+---
+description: 
+alwaysApply: true
+---
+
+generate md format.
+format:
+<!--
+Thanks for sending a pull request!
+
+Please add one of the following icons to the title of this PR:
+
+    ⚠️ (:warning:, a major or breaking change)
+    ✨ (:sparkles:, feature additions)
+    🐛 (:bug:, patch and bugfixes)
+    📖 (:book:, documentation or proposals)
+    🌱 (:seedling:, minor or other)
+
+Some other tips:
+
+    1. If this is your first time filing a PR, please read our contributor
+       guidelines for submitting a change at https://vm-operator.readthedocs.io/en/stable/start/contrib/submit-change/.
+    2. If this PR is unfinished, please prefix the subject with "WIP:".
+
+Finally, before filing the PR, please delete all of the HTML comments.
+-->
+
+**What does this PR do, and why is it needed?**
+
+<!-- A clear and concise description of the PR and the problem it solves / feature it introduces / value it adds to the project. -->
+
+
+**Which issue(s) is/are addressed by this PR?** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
+
+Fixes #
+
+
+**Are there any special notes for your reviewer**:
+
+<!-- Anything else you would like the reviewers to know about this PR. -->
+
+
+**Please add a release note if necessary**:
+
+<!--
+Write your release note:
+
+    1. Enter your extended release note in the below block. If the PR requires
+       additional action from users switching to the new release, please include
+       the string "action required".
+    2. If a release note is not required, please write "NONE".
+-->
+
+```release-note
+
+```

.dockerignore

@@ -1 +1,16 @@
 *.tar
+# Test binaries and build artifacts
+*.test
+**/*.test
+# Build outputs
+_output/
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+# OS files
+.DS_Store
+Thumbs.db
+# Git
+.git/

.github/workflows/ci.yml

@@ -195,10 +195,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.2' # TODO (brito-rafa)  For GO-2026-4865
-                             # GO-2026-4866, GO-2026-4869, GO-2026-4870
-                             # GO-2026-4946, GO-2026-4947
-                             # remove once internal builds use 1.26.2
+        go-version: ${{ env.GO_VERSION }}
         go-version-file: 'go.mod'
         cache: true
         cache-dependency-path: '**/go.sum'

.gitignore

@@ -69,3 +69,7 @@ infrastructure-components.yaml
 /local.envvars
 /vendor
 /kind-cluster-info-dump
+
+# E2E tests
+test/e2e/**/test_logs
+e2e-tests

.golangci.yml

@@ -382,3 +382,25 @@ linters:
     # Ignore different receiver names in conversion functions (e.g. src vs dst).
     - path: "_conversion.go"
       text: ".*receiver name"
+
+    - path: "test/e2e"
+      linters:
+        - revive
+        - gosec
+        - prealloc
+        - wsl
+        - wsl_v5
+        - gocritic
+        - gocyclo
+        - noinlineerr
+        - makezero
+        - modernize
+        - gocheckcompilerdirectives
+        - embeddedstructcheck
+        - importas
+        - ineffassign
+        - goconst
+        - depguard
+        - godoclint
+        # E2E tests use . imports for gomega or ginkgo.
+        - staticcheck

Dockerfile.e2e

@@ -0,0 +1,94 @@
+# VM Operator E2E Test Container
+# Self-contained E2E testing environment
+
+ARG BASE_IMAGE=mirror.gcr.io/library/photon:5.0
+
+# Build stage - compile tests
+FROM ${BASE_IMAGE} AS builder
+
+# Build stage setup
+WORKDIR /vm-operator
+
+# Copy all source code needed for compilation
+COPY go.mod go.sum ./
+COPY api/ ./api/
+COPY external/ ./external/
+COPY pkg/ ./pkg/
+COPY test/e2e/ ./test/e2e/
+COPY hack/ ./hack/
+COPY Makefile ./
+
+# Install Go dependencies
+RUN tdnf install -y \
+    build-essential \
+    glibc-devel \
+    go
+RUN go mod download
+
+# Pre-compile test binaries for faster execution  
+RUN cd test/e2e/vmservice && go test -c -o /vm-operator/e2e-tests .
+
+# Runtime stage - minimal image with compiled tests
+FROM ${BASE_IMAGE} AS runtime
+
+# Build information
+ARG BUILD_BRANCH
+ARG BUILD_COMMIT  
+ARG BUILD_NUMBER
+ARG BUILD_VERSION
+
+# Image labels
+LABEL branch="${BUILD_BRANCH}" \
+      buildNumber="${BUILD_NUMBER}" \
+      commit="${BUILD_COMMIT}" \
+      name="VM Operator E2E Tests" \
+      vendor="Broadcom" \
+      version="${BUILD_VERSION}"
+
+# Install required packages
+RUN tdnf update -y && \
+    tdnf install -y \
+        curl \
+        jq \
+        git \
+        openssh \
+        sshpass \
+        bash \
+        make \
+        build-essential \
+        glibc-devel \
+        go \
+        && \
+    rm -rf /var/cache/tdnf
+
+ARG KUBECTL_VERSION=v1.32.0
+ARG KUBECTL_URL=https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl
+RUN curl -fsSL "${KUBECTL_URL}" -o /usr/local/bin/kubectl && \
+    chmod +x /usr/local/bin/kubectl
+
+# Create non-root user early 
+RUN groupadd -g 1000 vmoperator && \
+    useradd -u 1000 -g vmoperator -s /bin/bash -m vmoperator
+
+# Create directories and set up convenience scripts
+RUN mkdir -p /vm-operator /tmp/go-cache && \
+    chown vmoperator:vmoperator /vm-operator /tmp/go-cache
+
+WORKDIR /vm-operator
+
+COPY --from=builder --chown=vmoperator:vmoperator /vm-operator/hack/setup-testbed-env.sh ./hack/setup-testbed-env.sh
+RUN ln -sf /vm-operator/hack/setup-testbed-env.sh /usr/local/bin/setup-testbed-env
+
+COPY --from=builder --chown=vmoperator:vmoperator /vm-operator/Makefile ./Makefile
+COPY --from=builder --chown=vmoperator:vmoperator /vm-operator/e2e-tests ./e2e-tests
+COPY --from=builder --chown=vmoperator:vmoperator /vm-operator/test/e2e/vmservice/config/ ./test/e2e/vmservice/config/
+COPY --from=builder --chown=vmoperator:vmoperator /vm-operator/test/e2e/fixtures/ ./test/e2e/fixtures/
+
+# Switch to non-root user for runtime
+USER vmoperator
+
+# Set up Go environment for runtime
+ENV GOCACHE="/tmp/go-cache"
+
+# Default command
+CMD ["/bin/bash"]