test(e2e): update gcp v2 refresh without recreate

e2e/suites/provider/cases/gcp/provider.go

@@ -188,6 +188,20 @@ func (s *GcpProvider) CreateSecret(key string, val framework.SecretEntry) {
 	Expect(err).ToNot(HaveOccurred())
 }
 
+func (s *GcpProvider) UpdateSecret(key string, val framework.SecretEntry) {
+	client, err := s.getClient(GinkgoT().Context())
+	Expect(err).ToNot(HaveOccurred())
+	defer client.Close()
+
+	_, err = client.AddSecretVersion(GinkgoT().Context(), &secretmanagerpb.AddSecretVersionRequest{
+		Parent: fmt.Sprintf("projects/%s/secrets/%s", s.projectID, key),
+		Payload: &secretmanagerpb.SecretPayload{
+			Data: []byte(val.Value),
+		},
+	})
+	Expect(err).ToNot(HaveOccurred())
+}
+
 func (s *GcpProvider) DeleteSecret(key string) {
 	client, err := s.getClient(GinkgoT().Context())
 	Expect(err).ToNot(HaveOccurred())

e2e/suites/provider/cases/gcp/provider_support_test.go

@@ -89,3 +89,21 @@ func TestProviderV2NamespacedSuiteDoesNotIncludeWorkloadIdentity(t *testing.T) {
 		}
 	}
 }
+
+func TestProviderV2RefreshSuiteOverridesDefaultRemoteMutation(t *testing.T) {
+	t.Parallel()
+
+	content, err := os.ReadFile("provider_v2.go")
+	if err != nil {
+		t.Fatalf("read provider_v2.go: %v", err)
+	}
+
+	for _, required := range []string{
+		"UpdateRemoteSecret:",
+		"prov.UpdateSecret(",
+	} {
+		if !strings.Contains(string(content), required) {
+			t.Fatalf("expected GCP v2 refresh suite to include %q", required)
+		}
+	}
+}

e2e/suites/provider/cases/gcp/provider_support_v2.go

@@ -87,6 +87,10 @@ func (p *ProviderV2) CreateSecret(key string, val framework.SecretEntry) {
 	p.backend.CreateSecret(key, val)
 }
 
+func (p *ProviderV2) UpdateSecret(key string, val framework.SecretEntry) {
+	p.backend.UpdateSecret(key, val)
+}
+
 func (p *ProviderV2) DeleteSecret(key string) {
 	p.backend.DeleteSecret(key)
 }

e2e/suites/provider/cases/gcp/provider_v2.go

@@ -63,6 +63,11 @@ var _ = Describe("[gcp] v2 namespaced provider", Label("gcp", "secretsmanager",
 				UpdatedExpectedData: "gcp-v2-updated",
 				RefreshInterval:     10 * time.Second,
 				WaitTimeout:         30 * time.Second,
+				UpdateRemoteSecret: func(_ *framework.TestCase, _ framework.SecretStoreProvider) {
+					prov.UpdateSecret(f.MakeRemoteRefKey("gcp-v2-refresh-remote"), framework.SecretEntry{
+						Value: `{"value":"gcp-v2-updated"}`,
+					})
+				},
 			})
 		}, useV2StaticAuth(prov)),
 		framework.Compose(withStaticAuth, f, func(f *framework.Framework) (string, func(*framework.TestCase)) {