test(e2e): re-enable and modernize the VM backup e2e (backup path is uncovered) #3236

Summary

The VM backup end-to-end test is disabled and stale, so the VMInstance backup/restore path is not covered by CI. Because of this, config-level regressions in the default backup flow ship unnoticed. On a v1.5.x SeaweedFS-backed cluster the default VM backup flow does not complete out of the box; the issues below would be caught by a working e2e.

Current state

Updated 2026-08-03 — the BATS era is over: the test was ported to Chainsaw and now lives at hack/e2e-chainsaw/backup/chainsaw-test.yaml.disabled. It is still not executed, and for the same reason: hack/select-e2e.sh enumerates suites with find hack/e2e-chainsaw -mindepth 2 -maxdepth 2 -name chainsaw-test.yaml, so the .disabled suffix keeps backup unselectable. The sibling app suites all run.

The API drift is on three axes, not one, so "re-enable" means rewriting the BackupJob step rather than renaming a file:

1. BackupJob shape. The disabled test sets spec.storageRef + spec.strategyRef. api/backups/v1alpha1/backupjob_types.go now defines BackupJobSpec as ApplicationRef + a required BackupClassName, with an optional PlanRef. Both old fields are gone from the type, so the apply is pruned or rejected outright rather than merely mis-routed.
2. Strategy name. velero-strategy-default no longer exists; main ships cozy-default-velero-vminstance and cozy-default-velero-vmdisk.
3. Application kind. The test creates apps.cozystack.io/VirtualMachine, which is not a package at all — packages/apps/ has only vm-instance and vm-disk, and cozy-default routes VMInstance and VMDisk.

Defaults that break the out-of-the-box flow (repo-verified)

1. BSL endpoint scheme vs S3 TLS. FIXED (2026-08-03 re-check). templates/_helpers.tpl now derives the endpoint from the COSI system-credentials Secret and returns https://<external S3 ingress>, which carries an ACME cert; the plaintext http://seaweedfs-s3…:8333 survives in values.yaml only as the documented fallback for provisionBucket: false and for offline renders. Landed in PR fix(etcd): complete v1alpha2 transition for in-cluster 1.5→1.6 upgrades #3270; the same forced-https step is tracked as a forward-compatibility note in fix(bucket): endpoint helper unconditionally forces https:// — original scheme lost for provisioned buckets #3317.
2. Missing checksumAlgorithm. Still valid. git grep -i checksumAlgorithm -- packages/ returns nothing, and templates/velero-bsl.yaml sets only region, s3ForcePathStyle and s3Url under config. With velero-plugin-for-aws v1.14.1 (AWS SDK v2) against SeaweedFS, PutObject of the backup metadata fails with a misleading InvalidAccessKeyId; checksumAlgorithm: "" resolves it.

Proposed

• Re-enable the backup e2e and update it to the VMInstance + cozy-default BackupClass flow.
• Assert the Velero Backup reaches Completed and that objects are written to the bucket.
• Fix the remaining BSL default so the out-of-the-box flow works end to end: checksumAlgorithm: "". The endpoint half is already done, see above.

PR #3427 "test(vmi): modernize the VMInstance/VMDisk backup/restore e2e to the BackupClass flow" is open against this.