Add E2E test which shows adding deny rule blocks kas traffic

[Mansi Mandhare (m-mandhare)]

What

Creates a Swift HCP cluster (worker subnet + vnet-integration/Swift subnet, NSG + Red Hat delegation).
Case 1 — outbound Deny Any → worker (ports 443/6443): blocks kubelet → KAS ILB. Creates a node pool and asserts it stays stuck (never Succeeded) for ~15 minutes.
Removes that rule.
Case 2 — inbound Deny worker subnet → Swift subnet -: blocks worker(port 8443) → private-router / KAS / ignition / konnectivity. Same stuck-provisioning assertion.
Removes that rule, creates a third node pool, and asserts it reaches Provisioning/Succeeded (positive control).

Why

Misconfigured customer NSG rules that block worker bootstrap paths can leave node pools stuck in Provisioning. This e2e proves those two network paths matter and that the node pool recovers once the rules are removed.

Testing

Ignition error in nodepool VM -

Testing is required for feature completion and tests should be part of the pull
request along with the feature changes.

Describe the testing provided. If you did not add tests, provide a clear
justification.

• Unit tests
• Integration tests
• E2E tests

Special notes for your reviewer

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Screenshots included (if graph/UI/metrics changes)
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide)
• Draft PR used for WIP (if applicable)
• Commit history is clean (rebased/squashed)
• Tricky code blocks are commented
• Specific reviewers tagged
• All comment threads resolved before merge

If E2E tests are included:

• E2E tests follow Principles of Good E2E Test Case Design
• If new E2E use case is covered (via a new test or new check/verifier),
  demonstrate that the test is able to detect a defect/error and fail with
  proper error message and logs which communicates nature of the problem.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Mansi Mandhare (m-mandhare)]

/ok-to-test

[Martin Bukatovic (mbukatov)]

/assign Martin Bukatovic (@mbukatov)
/assign Miquel Simon (@miquelsi)

This is still a draft, but I'm making sure it's on our radar.

[Martin Bukatovic (mbukatov)]

/assign Martin Bukatovic (@mbukatov)

[Martin Bukatovic (mbukatov)]

/assign Miquel Simon (@miquelsi)

[Mansi Mandhare (m-mandhare)]

/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: m-mandhare
Once this PR has been reviewed and has the lgtm label, please ask for approval from miquelsi. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Mansi Mandhare (m-mandhare)]

/retest

[Mansi Mandhare (m-mandhare)]

/retest

[Mansi Mandhare (m-mandhare)]

/retest

[Mansi Mandhare (m-mandhare)]

/retest

[openshift-ci]

Mansi Mandhare (@m-mandhare): The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-parallel	efce902	link	true	/test e2e-parallel

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.