fix(e2e): serialize Kubernetes HA deployment tests

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

architecture/build.md

@@ -112,6 +112,9 @@ the managed Podman driver path, Kubernetes database scenarios, and Docker-hosted
 SDK and policy-advisor E2E checks. The managed Podman test gateway receives the
 same run-specific sandbox runtime image as the standalone driver so each round
 uses the image built from its source commit.
+The Kubernetes HA test binary runs one test at a time because its scenarios
+scale and roll the same gateway deployment, and separate Nextest processes do
+not share their in-process lock.
 Policy-advisor E2E checks build a dedicated Docker workload with curl and cargo
 at the paths their denial scenarios inspect.
 The Docker gateway wrapper exports its resolved sandbox image to the test

e2e/rust/e2e-kubernetes.sh

@@ -58,6 +58,12 @@ test_filter=()
 if [ -n "${OPENSHELL_E2E_KUBE_TEST:-}" ]; then
   test_filter+=(--test "${OPENSHELL_E2E_KUBE_TEST}")
 fi
+test_threads=()
+if [ "${OPENSHELL_E2E_KUBE_TEST:-}" = "kubernetes_ha_rebalancing" ]; then
+  # These tests scale and roll the same deployment. Nextest starts each test
+  # in its own process, so their in-process mutex cannot serialize them.
+  test_threads+=(--test-threads 1)
+fi
 
 is_operator_workspace_mode() {
   [[ ",${E2E_FEATURES}," == *",e2e-kubernetes-workspace-operator,"* ]]
@@ -99,6 +105,7 @@ run_e2e() {
     --target-dir "${ROOT}/e2e/rust/target" \
     --manifest-path "${ROOT}/e2e/rust/Cargo.toml" \
     --features "${E2E_FEATURES}" \
+    ${test_threads[@]+"${test_threads[@]}"} \
     ${test_filter[@]+"${test_filter[@]}"}
 }