test(kubernetes): provision e2e workers via KubernetesNodes

The chainsaw harness created the Kubernetes CR with spec.nodeGroups,
which the control-plane-only chart now ignores, so no MachineDeployment
was created and the suites timed out. Create a KubernetesNodes CR named
<cluster>-md0 (roles: [ingress-nginx]) so the same MachineDeployment is
produced and the MD/ingress waits pass; this also gives the split its
first e2e coverage.

Signed-off-by: Ivan Okhotnikov <xorokhotnikov@gmail.com>

hack/e2e-chainsaw/_lib/run-kubernetes.sh

@@ -314,16 +314,32 @@ ${ouroboros_addon}
       resources: {}
       resourcesPreset: micro
   host: ""
-  nodeGroups:
-    md0:
-      diskSize: 20Gi
-      gpus: []
-      instanceType: u1.medium
-      maxReplicas: 10
-      minReplicas: 2
-      resources: {}
-      roles:
-      - ingress-nginx
+  storageClass: replicated
+  version: "${k8s_version}"
+EOF
+
+  # Worker node pool is a separate KubernetesNodes resource since the Phase 2
+  # split. Named "<cluster>-md0" so it produces MachineDeployment
+  # kubernetes-${test_name}-md0 — the same object the pre-split
+  # spec.nodeGroups.md0 produced, which the waits below still key on. Carries
+  # roles: [ingress-nginx] so the ingress-nginx addon has a node to schedule on.
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: KubernetesNodes
+metadata:
+  name: "${test_name}-md0"
+  namespace: tenant-test
+spec:
+  cluster: "${test_name}"
+${talos_block}
+  diskSize: 20Gi
+  gpus: []
+  instanceType: u1.medium
+  maxReplicas: 10
+  minReplicas: 2
+  resources: {}
+  roles:
+  - ingress-nginx
   storageClass: replicated
   version: "${k8s_version}"
 EOF

hack/e2e-chainsaw/kubernetes-oidc-customconfig/kubernetes-oidc-byo.yaml

@@ -1,11 +1,9 @@
-# nodeGroups (and storageClass) intentionally omitted — this is a render-side
-# test that only asserts on the KamajiControlPlane + the tenant-supplied
-# issuer AuthenticationConfiguration Secret. With the schema default `{}`,
-# the chart helper emits the default `md0` group with `minReplicas: 0` —
-# exactly one MachineDeployment renders (API-surface completeness) but the
-# chart no longer manages `spec.replicas`, so CAPI's defaulting webhook seeds
-# it to 0 from the autoscaler min-size annotation. Result: zero
-# KubevirtMachines, zero worker DataVolumes, no DRBD churn between CI runs
+# No KubernetesNodes pool is created — this is a render-side test that only
+# asserts on the KamajiControlPlane + the tenant-supplied issuer
+# AuthenticationConfiguration Secret. Since the Phase 2 split the kubernetes
+# chart renders the control plane only (worker pools are separate KubernetesNodes
+# resources), so there are zero MachineDeployments, KubevirtMachines or worker
+# DataVolumes — no DRBD churn between CI runs.
 # (see #3231).
 # Unlike the bats original, no talos.imageFactoryURL block is injected here:
 # the helper emits it only when the in-sandbox Talos image cache is up, and

hack/e2e-chainsaw/kubernetes-oidc-system/kubernetes-oidc-system.yaml

@@ -1,11 +1,9 @@
-# nodeGroups (and storageClass) intentionally omitted — this is a render-side
-# test that only asserts on the KamajiControlPlane + the cozy-realm Keycloak
-# objects. With the schema default `{}`, the chart helper emits the default
-# `md0` group with `minReplicas: 0` — exactly one MachineDeployment renders
-# (API-surface completeness) but the chart no longer manages `spec.replicas`,
-# so CAPI's defaulting webhook seeds it to 0 from the autoscaler min-size
-# annotation. Result: zero KubevirtMachines, zero worker DataVolumes, no DRBD
-# churn overlapping the kubernetes-previous suite (see #3231).
+# No KubernetesNodes pool is created — this is a render-side test that only
+# asserts on the KamajiControlPlane + the cozy-realm Keycloak objects. Since the
+# Phase 2 split the kubernetes chart renders the control plane only (worker
+# pools are separate KubernetesNodes resources), so there are zero
+# MachineDeployments, KubevirtMachines or worker DataVolumes — no DRBD churn
+# overlapping the kubernetes-previous suite.
 # Unlike the bats original, no talos.imageFactoryURL block is injected here:
 # the helper emits it only when the in-sandbox Talos image cache is up, and
 # with zero worker replicas this render-side test instantiates no DataVolume