fix: repair jwt e2e setup and worker test sync

cmd/ateapi/internal/controlapi/functional_test.go

@@ -236,6 +236,7 @@ type testContext struct {
 	k8sClient           kubernetes.Interface
 	substrateClient     versioned.Interface
 	persistence         *ateredis.Persistence
+	workerCache         *workercache.Cache
 	fakeAtelet          *FakeAteletServer
 	cleanup             func()
 	actorTemplateLister listersv1alpha1.ActorTemplateLister
@@ -368,6 +369,7 @@ func setupTest(t *testing.T, ns string) *testContext {
 		k8sClient:           k8sClient,
 		substrateClient:     substrateClient,
 		persistence:         persistence,
+		workerCache:         wc,
 		fakeAtelet:          fakeAtelet,
 		cleanup:             cleanup,
 		actorTemplateLister: actorTemplateLister,
@@ -582,13 +584,13 @@ func createWorkerPod(t *testing.T, tc *testContext, ns string, name string, node
 		t.Fatalf("failed to update worker pod status: %v", err)
 	}
 
-	// Wait for worker to be registered via API
+	// Wait for worker to be visible to the scheduler.
 	err = wait.PollUntilContextTimeout(context.Background(), 100*time.Millisecond, 5*time.Second, true, func(ctx context.Context) (bool, error) {
-		resp, err := tc.client.ListWorkers(ctx, &ateapipb.ListWorkersRequest{})
+		workers, err := tc.workerCache.Workers()
 		if err != nil {
-			return false, nil // Retry on API error
+			return false, nil
 		}
-		for _, w := range resp.GetWorkers() {
+		for _, w := range workers {
 			if w.GetWorkerNamespace() == ns && w.GetWorkerPod() == name {
 				return true, nil
 			}
@@ -607,13 +609,13 @@ func deleteWorkerPod(t *testing.T, tc *testContext, ns string, name string) {
 		t.Fatalf("failed to delete worker pod %s: %v", name, err)
 	}
 
-	// Wait for worker to be removed from API
+	// Wait for worker to be removed from the scheduler.
 	err = wait.PollUntilContextTimeout(context.Background(), 100*time.Millisecond, 5*time.Second, true, func(ctx context.Context) (bool, error) {
-		resp, err := tc.client.ListWorkers(ctx, &ateapipb.ListWorkersRequest{})
+		workers, err := tc.workerCache.Workers()
 		if err != nil {
-			return false, nil // Retry on API error
+			return false, nil
 		}
-		for _, w := range resp.GetWorkers() {
+		for _, w := range workers {
 			if w.GetWorkerNamespace() == ns && w.GetWorkerPod() == name {
 				return false, nil // Still there
 			}

manifests/ate-install/ate-client.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ate-client
+  namespace: ate-system
+  labels:
+    apps: ate-client

manifests/ate-install/jwt/kustomization.yaml

@@ -16,6 +16,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - ../ate-client.yaml
   - ../ate-api-server.yaml
   - ../ate-controller.yaml
   - ../atelet.yaml

manifests/ate-install/kind-jwt/kustomization.yaml

@@ -16,6 +16,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - ../ate-client.yaml
   - ../kind
 
 patches: