Skip to content

Commit 8fe4348

Browse files
ecvecv
committed
test: add httproute-accepted e2e for the local harness
Confirm a user's HTTPRoute is admitted end to end: an HTTPRoute attached to a Datum gateway reaches the Accepted state, so downstream traffic programming can proceed. Per datum-cloud/infra#3006, single-service API-contract tests move out of the infra live-env Chainsaw suite into their owning repo's local kind harness, run pre-merge. The gateway.networking.k8s.io HTTPRoute contract is owned by NSO, so it belongs here. The test mirrors the gateway sibling's proven setup on the prod-fidelity harness: a self-signed CA on the downstream cluster, an upstream GatewayClass, a verified Domain, and a Gateway that reaches Accepted. It then provisions an HTTPRoute and asserts acceptance on the per-parent status condition (status.parents[].conditions[]), where the Gateway API surfaces route acceptance, rather than a top-level condition.
1 parent 24a8f0e commit 8fe4348

1 file changed

Lines changed: 215 additions & 0 deletions

File tree

‎test/e2e/httproute-accepted/chainsaw-test.yaml‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
2+
apiVersion: chainsaw.kyverno.io/v1alpha1
3+
kind: Test
4+
metadata:
5+
name: httproute-accepted
6+
spec:
7+
bindings:
8+
- name: clusterIssuerName
9+
value: (join('-', ['e2e', $namespace]))
10+
- name: gatewayClassName
11+
value: (join('-', ['e2e', $namespace]))
12+
cluster: nso-standard
13+
steps:
14+
- name: Create CA
15+
try:
16+
- create:
17+
cluster: nso-infra
18+
resource:
19+
apiVersion: cert-manager.io/v1
20+
kind: ClusterIssuer
21+
metadata:
22+
name: (join('-', [$clusterIssuerName, 'issuer']))
23+
spec:
24+
selfSigned: {}
25+
26+
- create:
27+
cluster: nso-infra
28+
resource:
29+
apiVersion: cert-manager.io/v1
30+
kind: Certificate
31+
metadata:
32+
name: (join('-', [$clusterIssuerName, 'ca']))
33+
namespace: cert-manager
34+
spec:
35+
isCA: true
36+
commonName: (join('-', [$clusterIssuerName, 'ca']))
37+
secretName: ($clusterIssuerName)
38+
privateKey:
39+
algorithm: ECDSA
40+
size: 256
41+
issuerRef:
42+
name: (join('-', [$clusterIssuerName, 'issuer']))
43+
kind: ClusterIssuer
44+
group: cert-manager.io
45+
46+
- create:
47+
cluster: nso-infra
48+
resource:
49+
apiVersion: cert-manager.io/v1
50+
kind: ClusterIssuer
51+
metadata:
52+
name: ($clusterIssuerName)
53+
spec:
54+
ca:
55+
secretName: ($clusterIssuerName)
56+
57+
- assert:
58+
cluster: nso-infra
59+
resource:
60+
apiVersion: cert-manager.io/v1
61+
kind: Certificate
62+
metadata:
63+
name: (join('-', [$clusterIssuerName, 'ca']))
64+
namespace: cert-manager
65+
status:
66+
conditions:
67+
- type: Ready
68+
status: "True"
69+
70+
- name: Create GatewayClass for the upstream gateways
71+
try:
72+
- create:
73+
cluster: nso-standard
74+
resource:
75+
apiVersion: gateway.networking.k8s.io/v1
76+
kind: GatewayClass
77+
metadata:
78+
name: ($gatewayClassName)
79+
spec:
80+
controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
81+
82+
- name: Provision Domain
83+
try:
84+
- create:
85+
cluster: nso-standard
86+
resource:
87+
apiVersion: networking.datumapis.com/v1alpha
88+
kind: Domain
89+
metadata:
90+
name: test-domain
91+
spec:
92+
domainName: e2e.env.datum.net
93+
94+
- description: |
95+
Under normal operation, the Domain controller will perform verification
96+
via HTTP or DNS, and update the Domain's status.
97+
script:
98+
content: |
99+
kubectl -n $NAMESPACE patch domain test-domain \
100+
--subresource=status --type=merge \
101+
-p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
102+
103+
- name: Provision Gateway
104+
try:
105+
- create:
106+
cluster: nso-standard
107+
resource:
108+
apiVersion: gateway.networking.k8s.io/v1
109+
kind: Gateway
110+
metadata:
111+
name: test-gateway
112+
spec:
113+
gatewayClassName: ($gatewayClassName)
114+
listeners:
115+
- protocol: HTTP
116+
port: 80
117+
name: http-test-e2e
118+
allowedRoutes:
119+
namespaces:
120+
from: Same
121+
hostname: test.e2e.env.datum.net
122+
- protocol: HTTPS
123+
port: 443
124+
name: https-test-e2e
125+
allowedRoutes:
126+
namespaces:
127+
from: Same
128+
hostname: test.e2e.env.datum.net
129+
tls:
130+
mode: Terminate
131+
options:
132+
gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
133+
134+
- assert:
135+
timeout: 120s
136+
cluster: nso-standard
137+
resource:
138+
apiVersion: gateway.networking.k8s.io/v1
139+
kind: Gateway
140+
metadata:
141+
name: test-gateway
142+
status:
143+
(conditions[?type == 'Accepted']):
144+
- status: "True"
145+
146+
- name: Provision HTTPRoute and assert it is Accepted
147+
try:
148+
- create:
149+
cluster: nso-standard
150+
resource:
151+
kind: EndpointSlice
152+
metadata:
153+
name: test-slice-1
154+
addressType: FQDN
155+
apiVersion: discovery.k8s.io/v1
156+
endpoints:
157+
- addresses:
158+
- backend-service.default.svc.cluster.local
159+
conditions:
160+
ready: true
161+
serving: true
162+
terminating: false
163+
ports:
164+
- name: http
165+
appProtocol: http
166+
port: 8080
167+
168+
- create:
169+
cluster: nso-standard
170+
resource:
171+
apiVersion: gateway.networking.k8s.io/v1
172+
kind: HTTPRoute
173+
metadata:
174+
name: test-route
175+
spec:
176+
parentRefs:
177+
- name: test-gateway
178+
kind: Gateway
179+
rules:
180+
- matches:
181+
- path:
182+
type: PathPrefix
183+
value: /
184+
backendRefs:
185+
- group: discovery.k8s.io
186+
kind: EndpointSlice
187+
name: test-slice-1
188+
port: 8080
189+
190+
- assert:
191+
timeout: 120s
192+
cluster: nso-standard
193+
resource:
194+
apiVersion: gateway.networking.k8s.io/v1
195+
kind: HTTPRoute
196+
metadata:
197+
name: test-route
198+
status:
199+
parents:
200+
- conditions:
201+
- reason: Accepted
202+
status: "True"
203+
type: Accepted
204+
parentRef:
205+
name: test-gateway
206+
kind: Gateway
207+
group: gateway.networking.k8s.io
208+
catch:
209+
- script:
210+
cluster: nso-standard
211+
content: |
212+
kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator
213+
kubectl get gateways -n $NAMESPACE -o yaml
214+
kubectl get httproutes -n $NAMESPACE -o yaml
215+
kubectl get endpointslices -n $NAMESPACE -o yaml

0 commit comments

Comments
 (0)