hack/e2e-install-cozystack.bats: add 'gateway: {enabled: true}' to the
values used for the cozystack.cozystack-platform Package. The e2e
pipeline therefore exercises the Gateway API path as its primary
integration scenario — dashboard, keycloak render as HTTPRoutes;
cozystack-api, vm-exportproxy, cdi-uploadproxy render as TLSRoutes;
the legacy Ingresses for those services should not exist.
hack/e2e-apps/gateway.bats: two new test cases.
1. 'exposed services render HTTPRoute/TLSRoute but not Ingress when
gateway.enabled=true' — waits for the HTTPRoutes for dashboard and
keycloak to reach Accepted, confirms the three TLSRoutes exist in
their respective namespaces, and asserts (negative tests) that the
old Ingress objects are gone. Catches regressions where a developer
forgets to wrap an Ingress in the gateway-enabled conditional.
2. 'ValidatingAdmissionPolicy rejects Gateway with foreign hostname' —
tries to apply a Gateway in tenant-test that claims
dashboard.example.org (a domain outside the tenant's allowed suffix
test.example.org), asserts kubectl fails with the expected VAP error
and the expected message.
Together these cover the two most important regressions this PR is
shipping against: Ingress leaking through when it should not, and
the hostname-hijacking defence silently disappearing.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
8442f4e44e