e2e: add block device shrink and manual BlockDevice tests

.github/workflows/build_dev.yml

@@ -309,9 +309,10 @@ jobs:
       - name: Run E2E tests (storage-e2e, TestSdsNodeConfigurator — scheduler then sds-node-configurator)
         id: run_tests
         env:
-          # Writable module cache; keep outside the repo checkout so actions/checkout (workspace wipe) never hits EACCES on extracted modules.
-          GOMODCACHE: ${{ runner.temp }}/e2e-gomodcache
-          GOCACHE: ${{ runner.temp }}/e2e-gocache
+          # Use per-run caches outside the checkout so self-hosted runners do not leave read-only
+          # module trees under the workspace that break later actions/checkout cleanup.
+          GOMODCACHE: ${{ runner.temp }}/sds-node-configurator-e2e-${{ github.run_id }}-${{ github.run_attempt }}/gomodcache
+          GOCACHE: ${{ runner.temp }}/sds-node-configurator-e2e-${{ github.run_id }}-${{ github.run_attempt }}/gocache
           TEST_CLUSTER_CREATE_MODE: ${{ secrets.E2E_TEST_CLUSTER_CREATE_MODE }}
           TEST_CLUSTER_NAMESPACE: e2e-${{ vars.MODULE_NAME }}-pr${{ github.event.pull_request.number }}-${{ github.run_id }}
           TEST_CLUSTER_STORAGE_CLASS: ${{ secrets.E2E_TEST_CLUSTER_STORAGE_CLASS }}
@@ -433,7 +434,7 @@ jobs:
             done
             shopt -u nullglob
           fi
-          go test -v -count=1 -timeout 60m ./tests/ -run '^TestSdsNodeConfigurator$' 2>&1 | tee ../e2e-test-output.log
+          go test -v -count=1 -timeout 120m ./tests/ -run '^TestSdsNodeConfigurator$' 2>&1 | tee ../e2e-test-output.log
           TEST_EXIT_CODE=${PIPESTATUS[0]}
           echo "TEST_EXIT_CODE=${TEST_EXIT_CODE}" >> $GITHUB_ENV
           echo "${TEST_EXIT_CODE}" > ../e2e-test-exit-code.txt
@@ -515,7 +516,7 @@ jobs:
             - **Triggered by:** \`e2e-smoke-test\` label
             - **Exit Code:** ${exitCode}
 
-            Tests were executed via storage-e2e (TestSdsNodeConfigurator: Common Scheduler Extender, then Sds Node Configurator).
+            Tests were executed via storage-e2e (TestSdsNodeConfigurator).
 
             **Artifacts:** Test logs are available in workflow artifacts.
 
@@ -552,6 +553,12 @@ jobs:
         if: always()
         run: |
           rm -f "$E2E_SSH_KEY_PATH" "$E2E_SSH_PUB_PATH" "$E2E_KUBECONFIG_PATH" 2>/dev/null || true
+          for p in "${GOMODCACHE:-}" "${GOCACHE:-}"; do
+            if [ -n "$p" ] && [ -e "$p" ]; then
+              chmod -R u+w "$p" 2>/dev/null || true
+              rm -rf "$p" 2>/dev/null || true
+            fi
+          done
           WS="${GITHUB_WORKSPACE}"
           for d in e2e/.gomodcache e2e/.gocache e2e/temp; do
             p="${WS}/${d}"

.github/workflows/go_checks.yaml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          clean: false
 
       - name: Run Go lint
         uses: deckhouse/modules-actions/go_linter@v12
@@ -30,6 +32,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          clean: false
 
       - name: Run Go tests
         uses: deckhouse/modules-actions/go_tests@v12
@@ -43,6 +47,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
+        with:
+          clean: false
 
       - name: Run Go test coverage count
         uses: deckhouse/modules-actions/go_test_coverage@v12
@@ -56,6 +62,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          clean: false
 
       - name: Run Go modules version check
         uses: deckhouse/modules-actions/go_modules_check@v12

.github/workflows/trivy_image_check.yaml

@@ -13,16 +13,15 @@ on:
       release_branch:
         description: "Optional. Set minor version of release you want to scan. e.g.: 1.23"
         required: false
-      scan_several_latest_releases:
+      scan_several_lastest_releases:
         description: "Optional. Whether to scan last several releases or not. true/false. For scheduled pipelines it is always true. Default is: false."
         required: false
       latest_releases_amount:
         description: "Optional. Number of latest releases to scan. Default is: 3"
         required: false
-      release_in_dev:
-        description: 'If true, release tag will be searched in dev registry instead of prod'
+      severity:
+        description: "Optional. Vulnerabilities severity to scan. Default is: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
         required: false
-        default: 'False'
       svace_enabled:
         description: "Enable svace build and analyze"
         type: boolean
@@ -41,113 +40,43 @@ jobs:
     name: CVE scan for PR
     runs-on: [self-hosted, regular]
     needs: [build_dev]
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@v4
-      - name: Split repository name
-        id: split
-        env:
-          REPO: ${{ github.repository }}
-        run: echo "name=${REPO##*/}" >> $GITHUB_OUTPUT
-
-      - name: Import secrets
-        id: secrets
-        uses: hashicorp/vault-action@v2
-        with:
-          url: https://seguro.flant.com
-          path: github
-          role: "${{ steps.split.outputs.name }}"
-          method: jwt
-          jwtGithubAudience: github-access-aud
-          secrets: |
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/registry_host DECKHOUSE_DEV_REGISTRY_HOST | DECKHOUSE_DEV_REGISTRY_HOST ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/dev-registry/writetoken login | DECKHOUSE_DEV_REGISTRY_USER ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/dev-registry/writetoken password | DECKHOUSE_DEV_REGISTRY_PASSWORD ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/registry_host DECKHOUSE_READ_REGISTRY_HOST | PROD_READ_REGISTRY ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/ssdlc-registry-read-license login | PROD_READ_REGISTRY_USER ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/ssdlc-registry-read-license password | PROD_READ_REGISTRY_PASSWORD ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_TOKEN | DD_TOKEN ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_URL | DD_URL ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_SSH_PRIVATE_KEY | CVE_TEST_SSH_PRIVATE_KEY ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_REPO_GIT | CVE_TEST_REPO_GIT ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DECKHOUSE_PRIVATE_REPO | DECKHOUSE_PRIVATE_REPO ;
-            projects/data/b050f3bd-733f-4746-9640-9df80d484074/CODEOWNERS_REPO_TOKEN CODEOWNERS_REPO_TOKEN | CODEOWNERS_REPO_TOKEN ;
-      - uses: deckhouse/modules-actions/cve_scan@v11
+      - uses: deckhouse/modules-actions/cve_scan@v6
         with:
-          source_tag: 'pr${{ github.event.number }}'
-          case: "External Modules"
-          external_module_name: ${{ vars.MODULE_NAME }}
-          dd_url: ${{ steps.secrets.outputs.DD_URL }}
-          dd_token: ${{ steps.secrets.outputs.DD_TOKEN }}
-          prod_registry: ${{ steps.secrets.outputs.PROD_READ_REGISTRY }}
-          prod_registry_user: ${{ steps.secrets.outputs.PROD_READ_REGISTRY_USER }}
-          prod_registry_password: ${{ steps.secrets.outputs.PROD_READ_REGISTRY_PASSWORD }}
-          dev_registry: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_HOST }}
-          dev_registry_user: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_USER }}
-          dev_registry_password: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_PASSWORD }}
-          deckhouse_private_repo: ${{ steps.secrets.outputs.DECKHOUSE_PRIVATE_REPO }}
-          codeowners_repo_token: ${{ steps.secrets.outputs.CODEOWNERS_REPO_TOKEN }}
-          cve_test_repo_git: ${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }}
-          cve_ssh_private_key: ${{ steps.secrets.outputs.CVE_TEST_SSH_PRIVATE_KEY }}
-          trivy_reports_log_output: "1"
+          tag: pr${{ github.event.number }}
+          tag_type: "dev"
+          module_name: ${{ vars.MODULE_NAME }}
+          dd_url: ${{ secrets.DEFECTDOJO_HOST }}
+          dd_token: ${{ secrets.DEFECTDOJO_API_TOKEN }}
+          prod_registry: "registry.deckhouse.io"
+          prod_registry_user: "license-token"
+          prod_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
+          dev_registry: ${{ vars.DEV_REGISTRY }}
+          dev_registry_user: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
+          dev_registry_password: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
+          deckhouse_private_repo: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
+          severity: "HIGH,CRITICAL"
   cve_scan:
     if: github.event_name != 'pull_request'
     name: Regular CVE scan
     runs-on: [self-hosted, regular]
-    needs: [build_dev]
-    permissions:
-      contents: read
-      id-token: write
     steps:
-      - uses: actions/checkout@v11
-      - name: Split repository name
-        id: split
-        env:
-          REPO: ${{ github.repository }}
-        run: echo "name=${REPO##*/}" >> $GITHUB_OUTPUT
-
-      - name: Import secrets
-        id: secrets
-        uses: hashicorp/vault-action@v2
-        with:
-          url: https://seguro.flant.com
-          path: github
-          role: "${{ steps.split.outputs.name }}"
-          method: jwt
-          jwtGithubAudience: github-access-aud
-          secrets: |
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/registry_host DECKHOUSE_DEV_REGISTRY_HOST | DECKHOUSE_DEV_REGISTRY_HOST ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/dev-registry/writetoken login | DECKHOUSE_DEV_REGISTRY_USER ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/dev-registry/writetoken password | DECKHOUSE_DEV_REGISTRY_PASSWORD ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/registry_host DECKHOUSE_READ_REGISTRY_HOST | PROD_READ_REGISTRY ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/ssdlc-registry-read-license login | PROD_READ_REGISTRY_USER ;
-            projects/data/101ceaca-97cd-462f-aed5-070d9b9de175/ssdlc-registry-read-license password | PROD_READ_REGISTRY_PASSWORD ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_TOKEN | DD_TOKEN ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_URL | DD_URL ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_SSH_PRIVATE_KEY | CVE_TEST_SSH_PRIVATE_KEY ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_REPO_GIT | CVE_TEST_REPO_GIT ;
-            projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DECKHOUSE_PRIVATE_REPO | DECKHOUSE_PRIVATE_REPO ;
-            projects/data/b050f3bd-733f-4746-9640-9df80d484074/CODEOWNERS_REPO_TOKEN CODEOWNERS_REPO_TOKEN | CODEOWNERS_REPO_TOKEN ;
-      - uses: deckhouse/modules-actions/cve_scan@main
+      - uses: actions/checkout@v4
+      - uses: deckhouse/modules-actions/cve_scan@v6
         with:
-          source_tag: ${{ github.event.inputs.release_branch || github.event.repository.default_branch }}
-          case: "External Modules"
-          external_module_name: ${{ vars.MODULE_NAME }}
-          dd_url: ${{ steps.secrets.outputs.DD_URL }}
-          dd_token: ${{ steps.secrets.outputs.DD_TOKEN }}
-          prod_registry: ${{ steps.secrets.outputs.PROD_READ_REGISTRY }}
-          prod_registry_user: ${{ steps.secrets.outputs.PROD_READ_REGISTRY_USER }}
-          prod_registry_password: ${{ steps.secrets.outputs.PROD_READ_REGISTRY_PASSWORD }}
-          dev_registry: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_HOST }}
-          dev_registry_user: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_USER }}
-          dev_registry_password: ${{ steps.secrets.outputs.DECKHOUSE_DEV_REGISTRY_PASSWORD }}
-          deckhouse_private_repo: ${{ steps.secrets.outputs.DECKHOUSE_PRIVATE_REPO }}
-          scan_several_latest_releases: ${{ github.event.inputs.scan_several_latest_releases || 'True'}}
+          tag: ${{ github.event.inputs.release_branch || github.event.repository.default_branch }}
+          tag_type: "dev"
+          module_name: ${{ vars.MODULE_NAME }}
+          dd_url: ${{ secrets.DEFECTDOJO_HOST }}
+          dd_token: ${{ secrets.DEFECTDOJO_API_TOKEN }}
+          prod_registry: "registry.deckhouse.io"
+          prod_registry_user: "license-token"
+          prod_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
+          dev_registry: ${{ vars.DEV_REGISTRY }}
+          dev_registry_user: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
+          dev_registry_password: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
+          deckhouse_private_repo: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
+          scan_several_lastest_releases: ${{ github.event.inputs.scan_several_lastest_releases }}
           latest_releases_amount: ${{ github.event.inputs.latest_releases_amount || '3' }}
-          codeowners_repo_token: ${{ steps.secrets.outputs.CODEOWNERS_REPO_TOKEN }}
-          cve_test_repo_git: ${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }}
-          cve_ssh_private_key: ${{ steps.secrets.outputs.CVE_TEST_SSH_PRIVATE_KEY }}
-          release_in_dev: ${{ github.event.inputs.release_in_dev || 'False' }}
-          trivy_reports_log_output: "1"
+          severity: ${{ github.event.inputs.severity }}

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/sds-node-configurator/api
 
-go 1.25.7
+go 1.25.9
 
 require k8s.io/apimachinery v0.33.0
 

e2e/E2E_USAGE.md

@@ -5,7 +5,7 @@ This guide explains how to run the **storage-e2e** smoke tests for `sds-node-con
 ## What the test does
 
 - Uses the [storage-e2e](https://github.com/deckhouse/storage-e2e) framework.
-- Entry point: `TestSdsNodeConfigurator` in `e2e/tests/sds_node_configurator_suite_test.go` (single Ginkgo run; nested cluster in `BeforeSuite`; Common Scheduler + Sds specs in package).
+- Entry point: `TestE2E` in `e2e/tests/e2e_suite_test.go` (single Ginkgo run: Common Scheduler scenarios first, then Sds Node Configurator — see file order / `Describe` order).
 - Covers BlockDevice discovery and LVMVolumeGroup flows on a test cluster (existing or created via framework).
 - Test cluster is reached via SSH (base cluster host or jump host) and kubeconfig (often through an SSH tunnel to the API).
 
@@ -101,7 +101,7 @@ ginkgo -v --progress ./tests/
 Or run specific test:
 
 ```bash
-# Ginkgo focus on a spec name; CI runs: go test ./tests/ -run '^TestSdsNodeConfigurator$'
+# Ginkgo focus on a spec name; CI runs: go test ./tests/ -run '^TestE2E$'
 ginkgo -v --progress --focus="Should schedule Pod with local PVC" ./tests/
 ```
 
@@ -173,4 +173,4 @@ storage-e2e checks the Deckhouse `Module/virtualization` once with a short timeo
 ## See also
 
 - [README.md](README.md) — test scenarios, debugging, troubleshooting.
-- Local runs: `ginkgo -v --progress ./tests/` or `go test -v -count=1 -timeout 60m ./tests/ -run '^TestSdsNodeConfigurator$'` (same as CI).
+- Local runs: `ginkgo -v --progress ./tests/` or `go test -v -count=1 -timeout 60m ./tests/ -run '^TestE2E$'` (same as CI).

e2e/Makefile

@@ -43,15 +43,15 @@ cleanup: ## Delete Job and RBAC
 # === Local run ===
 
 .PHONY: test
-test: ## Run full E2E suite (TestSdsNodeConfigurator — все Ginkgo-спеки в пакете)
+test: ## Run full E2E suite (TestE2E — все Ginkgo-спеки в пакете)
 	go test -v -count=1 -timeout 60m ./tests/
 
 .PHONY: test-go
-test-go: ## Как в CI smoke: только TestSdsNodeConfigurator (Common Scheduler, затем Sds Node Configurator)
-	go test -v -count=1 -timeout 60m ./tests/ -run '^TestSdsNodeConfigurator$$'
+test-go: ## Как в CI smoke: только TestE2E (Common Scheduler, затем Sds Node Configurator)
+	go test -v -count=1 -timeout 60m ./tests/ -run '^TestE2E$$'
 
 .PHONY: test-focus
-test-focus: ## Run by test name (make test-focus FOCUS="TestSdsNodeConfigurator")
+test-focus: ## Run by test name (make test-focus FOCUS="TestE2E")
 	@if [ -z "$(FOCUS)" ]; then \
 		echo "Error: specify FOCUS=<test name>"; \
 		exit 1; \

e2e/README.md

@@ -81,7 +81,17 @@ ginkgo -v --progress ./tests/
 ginkgo -v --progress --focus="Should schedule Pod with local PVC" ./tests/
 ```
 
-## Тестовые сценарии
+### BlockDevice Disappearance
+
+- На ноде появляется новый неразмеченный диск и для него создаётся `BlockDevice`
+- Затем диск отсоединяется и удаляется
+- Проверяется, что агент удаляет соответствующий `BlockDevice`
+
+**Проверки**:
+- ✅ Новый `BlockDevice` сначала обнаруживается и имеет `status.consumable=true`
+- ✅ После пропажи диска соответствующий `BlockDevice` удаляется агентом
+
+### LVMVolumeGroup
 
 ### Модуль sds-node-configurator (BlockDevice / LVM)
 
@@ -92,6 +102,27 @@ ginkgo -v --progress --focus="Should schedule Pod with local PVC" ./tests/
 
 Сценарии Common Scheduler Extender (в том же файле): фильтрация нод по LVMVolumeGroup для local PVC, Pending при нехватке места, резервация при конкурентных PVC. См. [E2E_USAGE.md](E2E_USAGE.md).
 
+### Block Device Size Reduction
+
+- Создаётся VirtualDisk, обнаруживается BlockDevice, создаётся LVMVolumeGroup, ожидается Ready
+- Оригинальный диск отсоединяется и удаляется, подключается диск меньшего размера (симуляция уменьшения устройства)
+- Проверяется, что LVMVolumeGroup переходит в состояние ошибки
+
+**Проверки**:
+- ✅ LVMVolumeGroup Phase != Ready после замены устройства
+- ✅ Conditions содержат хотя бы одну запись с status=False (VG/PV ошибка)
+- ✅ Phase в состоянии NotReady, Pending или Failed
+
+### Manual BlockDevice Creation/Modification
+
+- Пользователь создаёт поддельный объект BlockDevice вручную
+- Пользователь изменяет status.size существующего BlockDevice
+
+**Проверки**:
+- ✅ Поддельный BlockDevice (consumable=true, реальный nodeName, несуществующий path) удаляется агентом
+- ✅ API отклоняет создание, если активен validating webhook
+- ✅ Изменённый status.size восстанавливается агентом до реального значения при следующем сканировании
+
 ## Кластер заблокирован (cluster is already locked)
 
 Если предыдущий запуск прервался до cleanup:

e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/sds-node-configurator/e2e
 
-go 1.25.7
+go 1.25.9
 
 require (
 	github.com/deckhouse/sds-node-configurator/api v0.0.0-20260114125558-7fd7152586ff

e2e/tests/cluster_config.yml

@@ -30,20 +30,22 @@ clusterDefinition:
     #   coreFraction: 50
     #   ram: 2
     #   diskSize: 50
+    # Temporarily disabled to reduce CI cluster footprint (VM startup timeouts).
     # - hostname: "worker-4"
     #   hostType: "vm"
     #   osType: "AltLinux Server 11" # See internal/config/images.go
     #   cpu: 2
     #   coreFraction: 20
     #   ram: 8
     #   diskSize: 20
-    - hostname: "worker-5"
-      hostType: "vm"
-      osType: "Ubuntu 24.04 6.8.0-53-generic" # See internal/config/images.go
-      cpu: 2
-      coreFraction: 20
-      ram: 8
-      diskSize: 20
+    # Temporarily disabled to reduce CI cluster footprint.
+    # - hostname: "worker-5"
+    #   hostType: "vm"
+    #   osType: "Ubuntu 24.04 6.8.0-53-generic" # See internal/config/images.go
+    #   cpu: 2
+    #   coreFraction: 20
+    #   ram: 8
+    #   diskSize: 20
   # DKP parameters
   dkpParameters:
     kubernetesVersion: "Automatic"