Add e2e reset cleanup verification

Author: Copilot

hack/e2e/README.md

@@ -1,6 +1,6 @@
 # AKS Flex Node E2E Tests
 
-The E2E suite provisions an AKS cluster and three Ubuntu VMs in Azure, joins the VMs as Flex Nodes, validates workloads, exercises unjoin/rejoin behavior, validates repave, collects logs, and tears down the resources.
+The E2E suite provisions an AKS cluster and three Ubuntu VMs in Azure, joins the VMs as Flex Nodes, validates workloads, exercises unjoin/rejoin behavior, verifies reset cleanup, validates repave, collects logs, and tears down the resources.
 
 ## Prerequisites
 
@@ -30,7 +30,7 @@ The default `all` command runs:
 2. Deploy AKS and three VMs with Bicep.
 3. Join all three VMs.
 4. Validate node readiness, node-problem-detector status, and run smoke workloads.
-5. Unjoin all Flex Nodes and verify they are absent.
+5. Unjoin all Flex Nodes and verify they are absent, including reset cleanup of host network artifacts.
 6. Rejoin all Flex Nodes and validate again.
 7. Run local-machine-driven repave validation.
 8. Collect logs and clean up Azure resources.

hack/e2e/lib/node-join.sh

@@ -149,6 +149,8 @@ _rp_delete_unjoin_node() {
   local vm_ip="$1"
   local vm_name="$2"
 
+  _seed_reset_cleanup_artifacts "${vm_ip}"
+
   log_info "Deleting local Machine resource on ${vm_ip}..."
   remote_exec "${vm_ip}" 'bash -s' <<'REMOTE'
 set -euo pipefail
@@ -170,6 +172,31 @@ REMOTE
   kubectl delete node "${vm_name}" --ignore-not-found --wait=false
 }
 
+_seed_reset_cleanup_artifacts() {
+  local vm_ip="$1"
+
+  log_info "Seeding reset cleanup artifacts on ${vm_ip}..."
+  remote_exec "${vm_ip}" 'bash -s' <<'REMOTE'
+set -euo pipefail
+
+sudo mkdir -p /etc/wireguard
+printf 'e2e private key\n' | sudo tee /etc/wireguard/server.priv >/dev/null
+printf 'e2e public key\n' | sudo tee /etc/wireguard/server.pub >/dev/null
+
+sudo modprobe dummy 2>/dev/null || true
+for iface in wg51898 geneve0 vxlan0 ipip0 unbounded0 cbr0; do
+  if ! ip link show "${iface}" &>/dev/null; then
+    sudo ip link add "${iface}" type dummy
+  fi
+done
+
+sudo ip rule add fwmark 0xca6a table 51898 2>/dev/null || true
+sudo ip route replace blackhole 198.51.100.254/32 table 51898
+
+echo "Reset cleanup artifacts seeded"
+REMOTE
+}
+
 _wait_for_node_not_ready_or_absent() {
   local vm_name="$1"
   local timeout="${E2E_NODE_JOIN_TIMEOUT}"
@@ -230,6 +257,34 @@ for machine in kube1 kube2; do
   fi
 done
 
+for iface in wg51898 geneve0 vxlan0 ipip0 unbounded0 cbr0; do
+  if [[ -e "/sys/class/net/${iface}" ]]; then
+    echo "reset cleanup interface ${iface} still exists"
+    ip link show "${iface}" || true
+    exit 1
+  fi
+done
+
+for path in /etc/wireguard/server.priv /etc/wireguard/server.pub; do
+  if [[ -e "${path}" ]]; then
+    echo "reset cleanup WireGuard key ${path} still exists"
+    sudo ls -l "${path}" || true
+    exit 1
+  fi
+done
+
+if ip rule show | grep -Eq 'lookup 51898|table 51898'; then
+  echo "reset cleanup policy routing rule for table 51898 still exists"
+  ip rule show
+  exit 1
+fi
+
+if ip route show table 51898 | grep -q .; then
+  echo "reset cleanup route table 51898 is not empty"
+  ip route show table 51898
+  exit 1
+fi
+
 for path in /etc/aks-flex-node /var/log/aks-flex-node; do
   if [[ -e "${path}" ]]; then
     echo "runtime path ${path} still exists after delete"