Change cloudE2E test to use oblt-cli

[michel-laterman]

What is the problem this PR solves?

Change buildkite pipelines to use oblt-cli instead of terraform

[michel-laterman]

Some instability with the cloudE2E tests in the builds: https://buildkite.com/elastic/fleet-server/builds/15100

[github-actions]

TL;DR

Both package jobs failed while mage docker:image was resolving the Docker runtime base image, not while running PR-specific Cloud E2E logic. cgr.dev returned 500 Internal Server Error for the anonymous token request for cgr.dev/chainguard/wolfi-base:latest, so retry the package jobs/build.

Remediation

• Retry Package x86_64 and Package aarch64; the failing operation is an external registry token/metadata fetch during Docker build.
• If this keeps recurring, pin or mirror the Wolfi runtime image used by Dockerfile:23 so package CI does not depend on resolving cgr.dev/chainguard/wolfi-base:latest on every run.

Investigation details

Root Cause

This is an infrastructure/dependency availability failure in the package Docker image build. The failed jobs run .buildkite/scripts/release_test.sh, which calls mage docker:image after package artifact upload/test steps. Docker.Image invokes docker build -f Dockerfile ... from magefile.go:1054-1065, and the Dockerfile runtime stage is pulled from cgr.dev/chainguard/wolfi-base:latest at Dockerfile:23.

Both package architectures failed at the same BuildKit metadata step for that external base image. The PR diff changes Cloud E2E/OBLT wiring and test env variable names, but it does not change .buildkite/scripts/release_test.sh, Dockerfile, or the Docker.Image build path involved here.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/15152
• Jobs/steps: Package x86_64 and Package aarch64
• Key log excerpt from both jobs:

=> ERROR [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest
Dockerfile:23
--------------------
  23 | >>> FROM cgr.dev/chainguard/wolfi-base:latest
--------------------
ERROR: failed to build: failed to solve: failed to fetch anonymous token: unexpected status from GET request to (cgr.dev/redacted) 500 Internal Server Error
Error: running "docker build --build-arg GO_VERSION=1.26.4 ... -f Dockerfile ..." failed with exit code 1

Verification

• Not run locally: Docker-in-Docker is unavailable in this workflow environment, and the captured failure depends on Buildkite worker access to cgr.dev during Docker metadata resolution.
• Checked recent PR detective comments. The latest prior comments covered OBLT Cloud E2E provisioning/auth issues; older comments covered a similar cgr.dev dependency failure in a different E2E job, but not this current package build.
• Checked for matching flaky-test issues in elastic/fleet-server; none matched this cgr.dev anonymous-token failure.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.