test: migrate httproute-accepted e2e from infra#237
Draft
ecv wants to merge 1 commit into
Draft
Conversation
Migrate the Gateway/HTTPRoute Accepted API-contract test out of datum/infra's live-env Chainsaw suite into NSO's local kind harness, per datum-cloud/infra#3006. This test validates gateway.networking.k8s.io contracts owned by NSO, so it belongs in this repo and runs against the local operator pre-merge. Key changes: - Drop the datumctl auth update-kubeconfig setup step and the clusters/cluster: project blocks that targeted ./test-kubeconfig; the test now runs on spec.cluster: nso-standard like the sibling tests. - Remove spec.skip: true; the live blockers in #2733 don't apply to the local operator. - Inline the gateway.yaml and httproute.yaml fixtures so they can bind to the per-namespace managed GatewayClass, matching sibling conventions. - Create a managed GatewayClass, the cert-manager CA/ClusterIssuer, the downstream EnvoyProxy/GatewayClass and the verified Domain preamble the gateway sibling test uses, so the Gateway can program and reach Accepted. - Give the tenant listener a hostname (required after #219/#220) and add the EndpointSlice backend the HTTPRoute references. - Keep the Gateway Accepted (3m) and HTTPRoute Accepted (2m) waits intact.
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Migrates the
httproute-acceptedChainsaw test out of thedatum/infralive-env suite into NSO's local kind harness attest/e2e/httproute-accepted/.The test provisions a
Gatewayand anHTTPRoute, then waits for the Gateway to reachAccepted(3m) and the HTTPRoute to reachAccepted(2m).Why
Per
datum-cloud/infra#3006, infra is consolidating its live-env Chainsaw suite into a single "construct" group and evacuating single-service API-contract tests to their owning repos, run against the local kind harness pre-merge. Thesegateway.networking.k8s.iocontracts are owned by NSO, so they belong here. Related:datum-cloud/infra#3005.Adaptations from the infra source
datumctl auth update-kubeconfigsetup step and theclusters:/cluster: projectblocks pointing at./test-kubeconfig. Now targetsspec.cluster: nso-standard, matching sibling tests.spec.skip: true(the live blockers in infra #2733 do not apply to the local operator; the source noted these were fixed in #2880).gateway.yamlandhttproute.yamlfixtures rather than keeping them as separatefile:fixtures. Inlining is required so they can reference the per-namespace managed($gatewayClassName)binding, and it matches every sibling test's convention (none use fixture files).gatewayClassName: datum-external-global-proxythat does not exist in the local harness. Replaced with a managedGatewayClasscreated per-test (controllerName: gateway.networking.datumapis.com/external-global-proxy-controller), exactly as thegatewaysibling test does.gatewaysibling's preamble so the Gateway can program and reachAccepted: cert-manager self-signed CA +ClusterIssuer, downstreamEnvoyProxy+datum-downstream-gateway-e2eGatewayClass, thedatum-downstream-gateway-hostnamesnamespace, and aVerifiedDomain(e2e.env.datum.net).hostname(test.e2e.env.datum.net) — hostname-less tenant listeners are now rejected at admission (Gateway: hostname-less tenant listeners rejected with misleading 'must be unique' (default-listener injection collision) #219 fix / fix: clear error for hostname-less tenant listeners #220).EndpointSlice(e2e-test-endpoint) the HTTPRoute'sbackendRefpoints at; the source referenced it but never created it.Accepted(3m) and HTTPRouteAccepted(2m) waits intact.Status
WIP / draft.
chainsaw lintpasses. Not verified against a running kind harness.Known-uncertain
Acceptedin the local harness with only this preamble? The infra source only ever assertedAccepted(neverProgrammed), and it wasskipped in the live env. Thegatewaysibling test drives a much larger flow to get there; I mirrored its setup but did not run it, so the exact minimal preamble needed forAccepted(vsProgrammed) is unverified.test.e2e.env.datum.netunder the verifiede2e.env.datum.netDomain, following the sibling. If NSO requires the listener hostname to match a verified Domain forAccepted, this should hold; if not, the Domain step may be unnecessary. Unverified.Acceptedcondition location. Thewaituses the top-levelAcceptedcondition on the HTTPRoute (as the infra source did). NSO may surface acceptance understatus.parents[].conditionsinstead; if the top-level condition isn't populated, the wait would need to target the per-parent condition.concurrent: falseset because this test shares cluster-scoped downstream config (EnvoyProxy, downstreamGatewayClass) with the other gateway e2e tests, matching their convention.gateway.yaml/httproute.yamlfiles (see Adaptations). If reviewers prefer standalone fixtures, the bindings would need to move to static values.