9505b08dd2
Three bats test cases verify the end-to-end infrastructure brought up by this PR: 1. Gateway API CRDs are installed (gatewayclasses, gateways, httproutes) and the 'cilium' GatewayClass is Accepted by the controller — proves gateway-api-crds installed and cilium.gatewayAPI.enabled propagated. 2. A minimal Gateway in tenant-test reconciles to Programmed and the controller materialises its cilium-gateway-<name> LoadBalancer Service — proves envoy.enabled kicked in and the data-plane wiring is live. 3. An HTTPRoute with a matching parentRef reaches Accepted status — proves Cilium's HTTPRoute attachment logic works. Not covered (because the test harness has no reachable Let's Encrypt endpoint and no way to flip cluster-wide gateway.enabled mid-pipeline without trampling other tests): - cert-manager HTTP-01 solver via gatewayHTTPRoute. - The ValidatingAdmissionPolicy that enforces tenant hostname ownership (installed only when gateway.enabled=true at platform level). - Full tenant.spec.gateway=true flow with extra/gateway chart and CiliumLoadBalancerIPPool. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
91 lines
3.1 KiB
Bash
91 lines
3.1 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
@test "Gateway API CRDs are installed and the cilium GatewayClass is Accepted" {
|
|
# Gateway API CRDs must exist — installed by packages/system/gateway-api-crds
|
|
kubectl wait crd/gatewayclasses.gateway.networking.k8s.io --for=condition=Established --timeout=60s
|
|
kubectl wait crd/gateways.gateway.networking.k8s.io --for=condition=Established --timeout=60s
|
|
kubectl wait crd/httproutes.gateway.networking.k8s.io --for=condition=Established --timeout=60s
|
|
|
|
# Cilium must have registered its built-in GatewayClass once gatewayAPI.enabled
|
|
# is true in the cilium values. This verifies the flip in
|
|
# packages/system/cilium/values.yaml propagated end-to-end.
|
|
timeout 120 sh -ec 'until kubectl get gatewayclass cilium >/dev/null 2>&1; do sleep 2; done'
|
|
kubectl wait gatewayclass/cilium --for=condition=Accepted --timeout=3m
|
|
}
|
|
|
|
@test "Cilium Gateway API controller reconciles a minimal Gateway to Programmed" {
|
|
# Use the pre-existing tenant-test namespace created by e2e-install-cozystack.bats.
|
|
kubectl apply -f - <<'EOF'
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: gateway-e2e-probe
|
|
namespace: tenant-test
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: http
|
|
protocol: HTTP
|
|
port: 80
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
EOF
|
|
|
|
# The controller must accept and program the Gateway.
|
|
kubectl -n tenant-test wait gateway/gateway-e2e-probe --for=condition=Accepted --timeout=2m
|
|
kubectl -n tenant-test wait gateway/gateway-e2e-probe --for=condition=Programmed --timeout=3m
|
|
|
|
# Cilium materialises a LoadBalancer Service named cilium-gateway-<gateway-name>
|
|
# for each programmed Gateway. Its existence is the observable proof that the
|
|
# full data-plane wiring kicked in.
|
|
kubectl -n tenant-test get svc cilium-gateway-gateway-e2e-probe
|
|
|
|
# Cleanup
|
|
kubectl -n tenant-test delete gateway/gateway-e2e-probe --ignore-not-found --timeout=1m
|
|
}
|
|
|
|
@test "HTTPRoute with a matching parentRef reaches Accepted status" {
|
|
# Put a Gateway and a route in the same namespace so allowedRoutes: Same accepts them.
|
|
kubectl apply -f - <<'EOF'
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: gateway-route-probe
|
|
namespace: tenant-test
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: http
|
|
protocol: HTTP
|
|
port: 80
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: httproute-probe
|
|
namespace: tenant-test
|
|
spec:
|
|
parentRefs:
|
|
- name: gateway-route-probe
|
|
sectionName: http
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: kubernetes
|
|
namespace: default
|
|
port: 443
|
|
EOF
|
|
|
|
kubectl -n tenant-test wait gateway/gateway-route-probe --for=condition=Programmed --timeout=3m
|
|
timeout 120 sh -ec 'until kubectl -n tenant-test get httproute httproute-probe -o jsonpath="{.status.parents[0].conditions[?(@.type==\"Accepted\")].status}" 2>/dev/null | grep -q True; do sleep 2; done'
|
|
|
|
kubectl -n tenant-test delete httproute/httproute-probe --ignore-not-found
|
|
kubectl -n tenant-test delete gateway/gateway-route-probe --ignore-not-found
|
|
}
|