Skip to content

Commit dc99c42

Browse files
committed
Address the last of the review comments
1 parent 967e2b9 commit dc99c42

File tree

6 files changed

+28
-64
lines changed

6 files changed

+28
-64
lines changed

conformance/base/manifests.yaml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ spec:
139139
containers:
140140
- name: infra-backend-v1
141141
# Originally from https://github.com/kubernetes-sigs/ingress-controller-conformance/tree/master/images/echoserver
142-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
142+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
143143
env:
144144
- name: POD_NAME
145145
valueFrom:
@@ -185,7 +185,7 @@ spec:
185185
spec:
186186
containers:
187187
- name: infra-backend-v2
188-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
188+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
189189
env:
190190
- name: POD_NAME
191191
valueFrom:
@@ -231,7 +231,7 @@ spec:
231231
spec:
232232
containers:
233233
- name: infra-backend-v3
234-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
234+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
235235
env:
236236
- name: POD_NAME
237237
valueFrom:
@@ -277,7 +277,7 @@ spec:
277277
spec:
278278
containers:
279279
- name: tls-backend
280-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
280+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
281281
volumeMounts:
282282
- name: secret-volume
283283
mountPath: /etc/secret-volume
@@ -346,7 +346,7 @@ spec:
346346
spec:
347347
containers:
348348
- name: tls-backend
349-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
349+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
350350
volumeMounts:
351351
- name: secret-volume
352352
mountPath: /etc/secret-volume
@@ -408,7 +408,7 @@ spec:
408408
spec:
409409
containers:
410410
- name: app-backend-v1
411-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
411+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
412412
env:
413413
- name: POD_NAME
414414
valueFrom:
@@ -454,7 +454,7 @@ spec:
454454
spec:
455455
containers:
456456
- name: app-backend-v2
457-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
457+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
458458
env:
459459
- name: POD_NAME
460460
valueFrom:
@@ -507,7 +507,7 @@ spec:
507507
spec:
508508
containers:
509509
- name: web-backend
510-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
510+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
511511
env:
512512
- name: POD_NAME
513513
valueFrom:
@@ -554,7 +554,7 @@ spec:
554554
spec:
555555
containers:
556556
- name: grpc-infra-backend-v1
557-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
557+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
558558
env:
559559
- name: POD_NAME
560560
valueFrom:
@@ -603,7 +603,7 @@ spec:
603603
spec:
604604
containers:
605605
- name: grpc-infra-backend-v2
606-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
606+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
607607
env:
608608
- name: POD_NAME
609609
valueFrom:
@@ -652,7 +652,7 @@ spec:
652652
spec:
653653
containers:
654654
- name: grpc-infra-backend-v3
655-
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20241007-v1.2.0-6-g9f820af9
655+
image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
656656
env:
657657
- name: POD_NAME
658658
valueFrom:

conformance/conformance.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ func logOptions(t *testing.T, opts suite.ConformanceOptions) {
144144
t.Logf(" Enable All Features: %t", opts.EnableAllSupportedFeatures)
145145
t.Logf(" Supported Features: %v", opts.SupportedFeatures.UnsortedList())
146146
t.Logf(" ExemptFeatures: %v", opts.ExemptFeatures.UnsortedList())
147+
t.Logf(" ConformanceProfiles: %v", opts.ConformanceProfiles.UnsortedList())
147148
}
148149

149150
func writeReport(logf func(string, ...any), report confv1.ConformanceReport, output string) error {

conformance/tests/backendtlspolicy.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121

2222
"k8s.io/apimachinery/pkg/types"
2323

24+
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
2425
h "sigs.k8s.io/gateway-api/conformance/utils/http"
2526
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
2627
"sigs.k8s.io/gateway-api/conformance/utils/suite"
@@ -47,7 +48,7 @@ var BackendTLSPolicy = suite.ConformanceTest{
4748
gwNN := types.NamespacedName{Name: "gateway-backendtlspolicy", Namespace: ns}
4849

4950
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
50-
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAcceptedMultipleListeners(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
51+
gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
5152
kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
5253

5354
serverStr := "abc.example.com"
@@ -66,7 +67,7 @@ var BackendTLSPolicy = suite.ConformanceTest{
6667
})
6768
})
6869

69-
// For the re-encrypt case, we need to use the cert for the frontend tls listener.
70+
// For the re-encrypt case, we need to use the cert for the frontend tls listener.
7071
certNN := types.NamespacedName{Name: "tls-checks-certificate", Namespace: ns}
7172
cPem, keyPem, err := GetTLSSecret(suite.Client, certNN)
7273
if err != nil {

conformance/utils/kubernetes/certificate.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,9 @@ func generateRSACert(hosts []string, keyOut, certOut io.Writer, ca *x509.Certifi
146146
return nil
147147
}
148148

149-
// MustCreateCASignedCertConfigMap will create a ConfigMap containing a CA Certificate, given a TLS Secret
149+
// MustCreateCACertConfigMap will create a ConfigMap containing a CA Certificate, given a TLS Secret
150150
// for that CA certificate. Also returns the CA certificate.
151-
func MustCreateCASignedCertConfigMap(t *testing.T, namespace, configMapName string, hosts []string) (*corev1.ConfigMap, *x509.Certificate, *rsa.PrivateKey) {
151+
func MustCreateCACertConfigMap(t *testing.T, namespace, configMapName string, hosts []string) (*corev1.ConfigMap, *x509.Certificate, *rsa.PrivateKey) {
152152
require.NotEmpty(t, hosts, "require a non-empty hosts for Subject Alternate Name values")
153153

154154
var certData, keyData bytes.Buffer
@@ -176,7 +176,8 @@ func MustCreateCASignedCertConfigMap(t *testing.T, namespace, configMapName stri
176176
Name: configMapName,
177177
},
178178
Data: map[string]string{
179-
"ca.crt": certData.String(),
179+
"ca.crt": certData.String(),
180+
// Don't do this in production, this is just for conformance testing.
180181
"key.crt": keyData.String(),
181182
},
182183
}

conformance/utils/kubernetes/helpers.go

Lines changed: 8 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -332,24 +332,20 @@ func MeshNamespacesMustBeReady(t *testing.T, c client.Client, timeoutConfig conf
332332
//
333333
// The test will fail if these conditions are not met before the timeouts.
334334
// Note that this also returns a Gateway address to use, but it takes the port
335-
// from the first listener it finds. Therefore, if the Gateway has multiple listeners,
336-
// don't use this function unless you can ignore the port and allow the url
337-
// scheme to determine the default port to use in a URL. Set parameter `usePort` to
338-
// false if there are multiple listeners, and true if there is only one listener.
335+
// from the first listener it finds. Set parameter `usePort` to false if there
336+
// are multiple listeners, and true if there is only one listener.
339337
func GatewayAndRoutesMustBeAccepted(t *testing.T, c client.Client, timeoutConfig config.TimeoutConfig, controllerName string, gw GatewayRef, routeType any, usePort bool, routeNNs ...types.NamespacedName) string {
340338
t.Helper()
341339

342-
var err error
343-
var gwAddr string
344-
345340
RouteTypeMustHaveParentsField(t, routeType)
341+
gwAddr, err := WaitForGatewayAddress(t, c, timeoutConfig, gw)
342+
require.NoErrorf(t, err, "timed out waiting for Gateway address to be assigned")
343+
346344
// If the Gateway has multiple listeners, get a portless gwAddr.
345+
// Otherwise, you get the first listener's port, which might not be the one you want.
347346
if !usePort {
348-
gwAddr, err = WaitForGatewayAddressMultipleListeners(t, c, timeoutConfig, gw)
349-
} else {
350-
gwAddr, err = WaitForGatewayAddress(t, c, timeoutConfig, gw)
347+
gwAddr, _, _ = strings.Cut(gwAddr, ":")
351348
}
352-
require.NoErrorf(t, err, "timed out waiting for Gateway address to be assigned")
353349

354350
ns := gatewayv1.Namespace(gw.Namespace)
355351
kind := gatewayv1.Kind("Gateway")
@@ -416,12 +412,6 @@ func GatewayAndHTTPRoutesMustBeAccepted(t *testing.T, c client.Client, timeoutCo
416412
return GatewayAndRoutesMustBeAccepted(t, c, timeoutConfig, controllerName, gw, &gatewayv1.HTTPRoute{}, true, routeNNs...)
417413
}
418414

419-
// GatewayAndHTTPRoutesMustBeAcceptedMultipleListeners is the same as GatewayAndHTTPRoutesMustBeAccepted except it does not
420-
// return the port in the gateway string. With multiple listeners, port varies and some tests can't succeed using the returned port.
421-
func GatewayAndHTTPRoutesMustBeAcceptedMultipleListeners(t *testing.T, c client.Client, timeoutConfig config.TimeoutConfig, controllerName string, gw GatewayRef, routeNNs ...types.NamespacedName) string {
422-
return GatewayAndRoutesMustBeAccepted(t, c, timeoutConfig, controllerName, gw, &gatewayv1.HTTPRoute{}, false, routeNNs...)
423-
}
424-
425415
// GatewayAndUDPRoutesMustBeAccepted waits until the specified Gateway has an IP
426416
// address assigned to it and the UDPRoute has a ParentRef referring to the
427417
// Gateway. The test will fail if these conditions are not met before the
@@ -431,8 +421,7 @@ func GatewayAndUDPRoutesMustBeAccepted(t *testing.T, c client.Client, timeoutCon
431421
}
432422

433423
// WaitForGatewayAddress waits until at least one IP Address has been set in the
434-
// status of the specified Gateway. Use when there is only one listener in the
435-
// Gateway.
424+
// status of the specified Gateway.
436425
func WaitForGatewayAddress(t *testing.T, client client.Client, timeoutConfig config.TimeoutConfig, gwRef GatewayRef) (string, error) {
437426
t.Helper()
438427

@@ -467,34 +456,6 @@ func WaitForGatewayAddress(t *testing.T, client client.Client, timeoutConfig con
467456
return net.JoinHostPort(ipAddr, port), waitErr
468457
}
469458

470-
// WaitForGatewayAddressMultipleListeners waits until at least one IP Address has been set in the
471-
// status of the specified Gateway and returns it without a port. A port interferes when
472-
// there are multiple listeners, e.g if the first listener is HTTP/80 but we want to be using another
473-
// listener with HTTPS/443, we can't send a request to https://gwaddr:80. But we can send a request
474-
// to https://gwaddr and expect it to succeed by using the default port for HTTPS.
475-
func WaitForGatewayAddressMultipleListeners(t *testing.T, client client.Client, timeoutConfig config.TimeoutConfig, gwRef GatewayRef) (string, error) {
476-
t.Helper()
477-
478-
var ipAddr string
479-
waitErr := wait.PollUntilContextTimeout(context.Background(), 1*time.Second, timeoutConfig.GatewayMustHaveAddress, true, func(ctx context.Context) (bool, error) {
480-
gw, err := getGatewayStatus(t, ctx, client, gwRef)
481-
if gw == nil {
482-
// The returned error is nil if the Gateway conditions don't have the latest observed generation.
483-
return false, err
484-
}
485-
486-
for _, address := range gw.Status.Addresses {
487-
if address.Type != nil && (*address.Type == gatewayv1.IPAddressType || *address.Type == v1alpha2.HostnameAddressType) {
488-
ipAddr = address.Value
489-
return true, nil
490-
}
491-
}
492-
return false, nil
493-
})
494-
require.NoErrorf(t, waitErr, "error waiting for Gateway to have at least one IP address in status")
495-
return ipAddr, waitErr
496-
}
497-
498459
func getGatewayStatus(t *testing.T, ctx context.Context, client client.Client, gwRef GatewayRef) (*gatewayv1.Gateway, error) {
499460
gw := &gatewayv1.Gateway{}
500461
err := client.Get(ctx, gwRef.NamespacedName, gw)

conformance/utils/suite/suite.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,7 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
370370
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
371371
secret = kubernetes.MustCreateSelfSignedCertSecret(t, "gateway-conformance-app-backend", "tls-passthrough-checks-certificate", []string{"abc.example.com"})
372372
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
373-
caConfigMap, ca, caPrivKey := kubernetes.MustCreateCASignedCertConfigMap(t, "gateway-conformance-infra", "backend-tls-checks-certificate", []string{"abc.example.com"})
373+
caConfigMap, ca, caPrivKey := kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-checks-certificate", []string{"abc.example.com"})
374374
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
375375
secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com"}, ca, caPrivKey)
376376
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)

0 commit comments

Comments
 (0)