[e2e-scan] Test: Add e2e scenario for control-plane plan-then-apply-plan workflow

[github-actions]

Gap Summary

The plan → save to file → apply --plan <file> workflow is a core kongctl feature that lets users separate the planning phase from execution. This workflow is exercised for event gateways (test/e2e/scenarios/event-gateway/plan/apply-workflow, sync-workflow) and for portals/APIs (test/e2e/scenarios/plan/apply-workflow, sync-workflow), but there is no equivalent scenario for control planes.

All existing control-plane scenarios either call apply -f directly or run plan --mode apply only as an idempotency check (asserting total_changes: 0). No scenario:

1. Generates a non-trivial plan for control-plane resources and saves it to a file
2. Applies that saved plan file via apply --plan <file>

The diff/command-coverage scenario does save a sync-mode plan (stdoutFile: workdir/plan.json) that includes a control-plane UPDATE, and step 003-diff-plan-file reads it with diff --plan. However, no step ever calls apply --plan workdir/plan.json. The plan is saved and inspected but never executed for control planes.

A regression in plan serialization (e.g., control-plane fields being dropped or misencoded in the JSON plan), or in the apply --plan execution path specifically for control planes, would go undetected by the current suite.

Evidence

Implementation surface (uncovered path)

• internal/cmd/root/verbs/apply/ — apply --plan <file> codepath
• internal/declarative/planner/ — control-plane planners produce the plan entries consumed by apply-from-plan
• internal/declarative/executor/ — executes the deserialized plan

Existing scenarios that cover adjacent resource types

• test/e2e/scenarios/event-gateway/plan/apply-workflow/scenario.yaml — full plan → save → apply --plan workflow for event gateways
• test/e2e/scenarios/event-gateway/plan/sync-workflow/scenario.yaml — same for sync mode
• test/e2e/scenarios/plan/apply-workflow/scenario.yaml — covers portals and APIs; includes diff --plan and apply --plan
• test/e2e/scenarios/plan/sync-workflow/scenario.yaml — same in sync mode

Existing control-plane scenarios (none exercise apply-from-plan)

• test/e2e/scenarios/control-plane/apply/scenario.yaml — step 003-plan-idempotent uses plan --mode apply but only to assert zero changes
• test/e2e/scenarios/diff/command-coverage/scenario.yaml — step 002-diff-plan-sync-mode saves a plan with a control-plane UPDATE change but never applies it
• test/e2e/scenarios/control-plane/sync/scenario.yaml — no plan file involved at all

Proposed Scenario Work

New scenario: test/e2e/scenarios/control-plane/plan/apply-workflow/

This should mirror the structure of event-gateway/plan/apply-workflow but for a control plane resource. Suggested steps:

1. 000-reset-org — resetOrg: true

2. 001-plan-apply-create — run plan -f config.yaml --mode apply, assert:

   • metadata.mode: apply
   • summary.total_changes: 1, by_action.CREATE: 1
   • changes[?resource_type=='control_plane'] | [0].action == CREATE
   • Save plan to stdoutFile: workdir/plan-create.json

3. 002-apply-from-plan — run apply --plan workdir/plan-create.json --auto-approve, assert:

   • summary.applied: 1
   • summary.failed: 0

4. 003-verify-after-apply — run get konnect gateway control-plane <cp-name> -o json, assert:

   • name, description fields match testdata values

5. 004-plan-apply-update (with overlay that changes description/labels) — run plan -f config.yaml --mode apply, assert UPDATE action in plan; save to workdir/plan-update.json

6. 005-apply-from-plan-update — run apply --plan workdir/plan-update.json --auto-approve, assert applied count = 1

7. 006-verify-updated-fields — get the control plane, assert updated description/labels

8. 007-plan-idempotent — run plan -f config.yaml --mode apply with the same overlay, assert total_changes: 0

A sync-workflow variant can follow the same pattern using --mode sync.

Acceptance Criteria

• New scenario at test/e2e/scenarios/control-plane/plan/apply-workflow/
• Scenario runs plan and captures a non-trivial CREATE plan to a file
• Scenario runs apply --plan <file> from the saved plan
• Post-apply get step asserts resource fields (not just name)
• Scenario includes an UPDATE cycle through a plan file
• Final step asserts idempotency (total_changes: 0)
• Scenario passes cleanly in the E2E harness

Reference Patterns

• test/e2e/scenarios/event-gateway/plan/apply-workflow/scenario.yaml — closest structural parallel; copy plan-save and apply-from-plan steps
• test/e2e/scenarios/plan/apply-workflow/scenario.yaml — portal/API reference for the same workflow pattern
• test/e2e/scenarios/control-plane/apply/scenario.yaml — testdata and overlay structure for control-plane resources

Generated by E2E Coverage Scanner · ● 2.4M · ◷

• expires on May 20, 2026, 11:53 PM UTC