[k82cn]

The Kubernetes E2E job fails intermittently in "Configure external access" with ClientTrafficPolicy/flame-cache-client-mtls was not accepted (seen on #634, run 40440554603; e2e-k8s failed 2 of its last 30 runs, 10 were cancelled).

Cause

ci/k8s/e2e.sh applied the whole external-access.yaml, including the ClientTrafficPolicy that references the secret flame-cache-client-trust, and only afterwards waited for the client CA certificate and created that secret from it. In the failing run the policy and the secret were created in the same second, and the status Envoy Gateway wrote for the policy was:

TLS: failed to get certificate from ref: secret flame-system/flame-cache-client-trust does not exist.
reason: Invalid, type: Accepted, status: "False"

That status was still there five minutes later, when wait_client_policy_accepted gave up: the policy was not accepted again after the secret appeared. Whether it is accepted depends on which of the two Envoy Gateway sees first, hence the intermittent failure.

Change

The ClientTrafficPolicy moves to its own template, ci/k8s/external-access-client-policy.yaml, and e2e.sh renders and applies it right after it creates the trust secret, so the secret always exists when the policy does. The other resources, the order of the waits, and the policy itself are unchanged; the 17 documents of the old template are now 16 plus this one.

Checked

• bash -n ci/k8s/e2e.sh; both templates parse as YAML, and the old template's documents are exactly the union of the two (same kinds and names).
• Not run: the job itself needs kind, cert-manager and Envoy Gateway, so it is only exercised by this pull request's Kubernetes E2E Test. Because the failure is intermittent, one green run does not prove the change; the argument is that the missing secret in the status above can no longer happen.