Test TLS termination, SSL-redirect, Canary, and CORS by Stevenjin8 · Pull Request #330 · kubernetes-sigs/ingress2gateway

Stevenjin8 · 2026-02-02T20:23:55Z

What type of PR is this?

/kind test

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?:

NONE

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

We need a dummy workload so that ingresses and gateways have some service to send test traffic to. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Kong is both an ingress controller and a GWAPI implementation. Add helpers for both. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

We use port forwarding to reach ingress controllers and gateways in an infrastructure-agnostic way during testing. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

To be able to run multiple test cases concurrently on the same cluster, some resources must be shared. For example, CRDs are cluster-level rather than namespace-scoped. In addition, deploying multiple instances of an ingress controller or GWAPI implementation wastes time and resources even in cases where it's technically possible to do so. To address these concerns, we add a resource manager. This construct allows efficient and thread-safe sharing of resources. A shared resource is created on first usage, returned on subsequent attempts to acquire the resources and cleaned up when no users remain. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Verifiers are used to ensure ingress and GWAPI resources process traffic according to expectations. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

We can't use sudo on CI. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

This allows for more compact test case definitions and fewer indentation levels. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Rather than implementing bespoke retry logic across the code base, implement generic retry helpers and reuse them. This also extracts the retry logic out of verifiers for a better separation of concerns. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Call the binary instead of running Go code directly. This simulates actual customer usage better and works around concurrency issues caused by multiple test cases executing in parallel. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

k8s-ci-robot · 2026-02-02T20:23:58Z

@Stevenjin8: The label(s) kind/test cannot be applied, because the repository doesn't have them.

Details

In response to this:

What type of PR is this?

/kind test

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?:
NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

johananl

Thanks for expanding the e2e framework! I like many of the changes.

Added some comments. Some trivial, some critical.

johananl · 2026-02-12T12:28:15Z

 const (
-	gatewayAPIVersion    = "v1.4.1"
-	gatewayAPIInstallURL = "https://github.com/kubernetes-sigs/gateway-api/releases/download/" + gatewayAPIVersion + "/standard-install.yaml"
+	// gatewayAPIVersion    = "v1.4.1"


Forgot to clean up?

not really. I think we want to target gwapi 1.5, which isn't released yet (rc coming this week) because we really want support for status code 308 in ReqestRedirects. Since 308 isn't available in 1.4, but is in 1.5, I figured I'd use a monthly release and just update it to 1.5/1.5-rc whenever that comes out.

johananl · 2026-02-12T12:34:19Z

+	networkingv1 "k8s.io/api/networking/v1"
+)
+
+func TestCanary(t *testing.T) {


I think we might want to include "nginx" in the function name. Right now we see the following when the tests are run:

TestCanary/to_Istio/base_canary

This doesn't tell us which provider gets tested.

My initial thought with the naming was to organize the hierarchy by "from", "to" and "test case". This way you get e.g. TestIngressNginx/to_Istio/with_host_field. It's clear what exactly is being tested.

We should also think about filtering tests when choosing the naming, e.g. maybe I want to do "run all tests to Istio" or "run basic conversions for all providers".

I'm happy to change the naming scheme but IMO we want to be deliberate about it.

WDYT?

+1. I can either throw IngressNGINX into the test name, or I can make each of these functions called in scenarios_test.go. Up to you

or I can make each of these functions called in scenarios_test.go

I don't understand this ☝️

I don't have a strong opinion on the naming, just wanted to make sure you're aware of my attempt to group things in a logical way.

johananl · 2026-02-12T14:13:58Z


 // A prefix for all namespaces used in the e2e tests.
 const e2ePrefix = "i2gw"
+const DummyAppName1 = "dummy-app1"


Are we assuming many test cases would need two dummy apps? I'm wondering if we need to define these consts and do so here rather than defining plain text directly in the test cases.

(Most of what I'm doing is based on what istio does). I think its common enough to do it, but definitely worth thinking about if we are going to test timeouts or something

johananl · 2026-02-12T14:21:10Z

 	networkingv1 "k8s.io/api/networking/v1"
 )

-// Validates that a service is accessible and working correctly. The addr parameter is a


IMO we want some documentation here, especially if we have many types of verifiers (which we do).

johananl · 2026-02-12T14:25:33Z

 		return fmt.Errorf("constructing HTTP request: %w", err)
 	}

-	// If the Host field is specified in the test case, use that. Otherwise, default to deriving


Why remove this comment?

johananl

Thanks for following up. Looks better.

There is a new critical bug in gwapi.go and gwapi_kong.go. Also added some more non-critical comments.

johananl · 2026-02-13T14:08:05Z

 		})
+		suffix, err := randString(6)
+		require.NoError(t, err)
+		host := "foo.example.com" + suffix


I don't know if we should do it in this PR but IMO we want to remove scenarios_test.go and relocate any relevant tests to more specific _test.go files. This file contains some initial smoke tests I've included with the e2e framework. Since we moved to a multi-file setup this file is IMO obsolete.

johananl · 2026-02-13T14:22:03Z

+	if m.negate {
+		return !match
 	}
+	return match


Nit: This is logical XOR. We can simplify. But maybe clear is better than clever.

Suggested change

if m.negate {

return !match

}

return match

return m.pattern.MatchString(s) != m.negate

johananl

Last tiny comment.

johananl · 2026-02-13T15:56:21Z

 		})
+		suffix, err := randString(6)
+		require.NoError(t, err)
+		host := "foo.example.com" + suffix


OK. I don't understand why multiple implementations but let's discuss in the other PR.

johananl · 2026-02-13T16:14:25Z

Thanks!
/lgtm

…#330) * Add k8s clients Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add logger interface Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add CRD helpers Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add Helm helpers Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add namespace helpers Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add dummy app helpers We need a dummy workload so that ingresses and gateways have some service to send test traffic to. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add helper for installing Istio Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add helpers for Kong Kong is both an ingress controller and a GWAPI implementation. Add helpers for both. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add GWAPI helpers Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add port forwarding helpers We use port forwarding to reach ingress controllers and gateways in an infrastructure-agnostic way during testing. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add ingress-nginx helpers Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add helper for creating ingresses Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add resource manager To be able to run multiple test cases concurrently on the same cluster, some resources must be shared. For example, CRDs are cluster-level rather than namespace-scoped. In addition, deploying multiple instances of an ingress controller or GWAPI implementation wastes time and resources even in cases where it's technically possible to do so. To address these concerns, we add a resource manager. This construct allows efficient and thread-safe sharing of resources. A shared resource is created on first usage, returned on subsequent attempts to acquire the resources and cleaned up when no users remain. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add verifier interface and httpGetVerifier implementation Verifiers are used to ensure ingress and GWAPI resources process traffic according to expectations. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add main test logic Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add some initial test cases Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add Make targets for e2e Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Add README for e2e tests Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Install kind to ./bin We can't use sudo on CI. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Use builder pattern for ingresses in test cases This allows for more compact test case definitions and fewer indentation levels. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Centralize retry logic Rather than implementing bespoke retry logic across the code base, implement generic retry helpers and reuse them. This also extracts the retry logic out of verifiers for a better separation of concerns. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Use ingress2gateway binary Call the binary instead of running Go code directly. This simulates actual customer usage better and works around concurrency issues caused by multiple test cases executing in parallel. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> * Canary tests * Path rewrite * Verify TLS Ingresses and TLS redirects * touchup * touchup * lint * lint * use regex body verifier * random canary host * CORS tests * move to module * Use monthly CRD and move packages * Review * lints * review * lint * remove unecessary host * comments --------- Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com> Co-authored-by: Johanan Liebermann <jliebermann@microsoft.com>

johananl and others added 29 commits January 21, 2026 18:50

Add k8s clients

65fb552

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add logger interface

7098cb9

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add CRD helpers

ae94714

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add Helm helpers

7e76c00

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add namespace helpers

0385bd2

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add dummy app helpers

f4cfe5f

We need a dummy workload so that ingresses and gateways have some service to send test traffic to. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add helper for installing Istio

b5b6838

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add helpers for Kong

a7ad561

Kong is both an ingress controller and a GWAPI implementation. Add helpers for both. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add GWAPI helpers

6740ba4

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add port forwarding helpers

2d48d39

We use port forwarding to reach ingress controllers and gateways in an infrastructure-agnostic way during testing. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add ingress-nginx helpers

126c0a6

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add helper for creating ingresses

665eaa9

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add verifier interface and httpGetVerifier implementation

9f95c22

Verifiers are used to ensure ingress and GWAPI resources process traffic according to expectations. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add main test logic

4f693fa

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add some initial test cases

f63093e

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add Make targets for e2e

88ed612

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Add README for e2e tests

d5c28ed

Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Install kind to ./bin

7aa6b5f

We can't use sudo on CI. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Use builder pattern for ingresses in test cases

ad1c425

This allows for more compact test case definitions and fewer indentation levels. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Use ingress2gateway binary

3221ffb

Call the binary instead of running Go code directly. This simulates actual customer usage better and works around concurrency issues caused by multiple test cases executing in parallel. Signed-off-by: Johanan Liebermann <jliebermann@microsoft.com>

Canary tests

c3e0aa8

Merge remote-tracking branch 'up/main' into test/canary

6df4abc

Path rewrite

72043b7

Verify TLS Ingresses and TLS redirects

ae822a8

Merge remote-tracking branch 'up/main' into test/canary

5b2790c

Merge branch 'test/canary' into tests/e2e-tls

04180bf

touchup

8a6932c

Stevenjin8 removed request for LiorLieberman, bexxmodd and youngnick February 11, 2026 02:14

Stevenjin8 mentioned this pull request Feb 11, 2026

ingress2gateway 1.0 effort tracking issue #276

Closed

johananl reviewed Feb 12, 2026

View reviewed changes

Review

0ff86f7

Stevenjin8 requested a review from LiorLieberman as a code owner February 12, 2026 17:04

Stevenjin8 temporarily deployed to release February 12, 2026 17:04 — with GitHub Actions Inactive

Stevenjin8 requested a review from johananl February 12, 2026 17:06

lints

c2a2d25

Stevenjin8 temporarily deployed to release February 12, 2026 17:14 — with GitHub Actions Inactive

johananl reviewed Feb 13, 2026

View reviewed changes

review

47ddeee

Stevenjin8 temporarily deployed to release February 13, 2026 15:21 — with GitHub Actions Inactive

lint

7a82725

Stevenjin8 temporarily deployed to release February 13, 2026 15:36 — with GitHub Actions Inactive

johananl reviewed Feb 13, 2026

View reviewed changes

Comment thread e2e/util.go Outdated

remove unecessary host

6bb967b

Stevenjin8 temporarily deployed to release February 13, 2026 15:45 — with GitHub Actions Inactive

Stevenjin8 requested a review from johananl February 13, 2026 15:47

Stevenjin8 mentioned this pull request Feb 13, 2026

feat: add support for from-to-www-redirect #337

Merged

johananl reviewed Feb 13, 2026

View reviewed changes

comments

4f1c9cf

Stevenjin8 temporarily deployed to release February 13, 2026 16:07 — with GitHub Actions Inactive

k8s-ci-robot assigned johananl Feb 13, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 13, 2026

k8s-ci-robot merged commit b5c9d05 into kubernetes-sigs:main Feb 13, 2026
5 checks passed

Conversation

Stevenjin8 commented Feb 2, 2026

Uh oh!

k8s-ci-robot commented Feb 2, 2026

Uh oh!

johananl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johananl left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

johananl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johananl commented Feb 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

johananl left a comment •

edited

Loading