Skip to content

test(e2e): end-to-end traversal test for the Kubernetes API TLSRoute #2478

Open
Open
test(e2e): end-to-end traversal test for the Kubernetes API TLSRoute#2478
Labels
area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)area/testingIssues or PRs related to testing (e2e, bats, unit tests)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

Description

@lexfrei
Aleksei Sviridkin (lexfrei)
opened on Apr 24, 2026

Context

#2470 ships TLSRoute for three TLS-passthrough services — Kubernetes API, vm-exportproxy, cdi-uploadproxy — on dedicated Passthrough listeners of the tenant Gateway. Current e2e coverage in hack/e2e-apps/gateway.bats:

  • GatewayClass cilium is Accepted.
  • A minimal Gateway reconciles to Programmed.
  • cozystack-gateway-hostname-policy rejects a foreign-hostname Gateway.
  • An HTTPRoute on a same-namespace Gateway reaches Accepted.
  • Three VAP negative paths (attached-namespaces, tenant-host, namespace-host-label).

Gap

Nothing actually opens a TLS connection through the tls-api / tls-vm-exportproxy / tls-cdi-uploadproxy listeners end-to-end. Raised on the #2470 review as well.

Proposed work

  • Generate a self-signed cert at install time and install it as the tenant Gateway's TLS secret.
  • Write an /etc/hosts entry (or equivalent) in the sandbox so api.<apex>, vm-exportproxy.<apex>, and cdi-uploadproxy.<apex> resolve to the Gateway LB IP.
  • Exercise each route — for the Kubernetes API listener, kubectl --server=https://api.<apex> --insecure-skip-tls-verify version should succeed; for vm-exportproxy and cdi-uploadproxy, a curl to the health path of each backend.

Requires cert + DNS plumbing the e2e sandbox does not currently ship, which is why the initial PR only covered the admission-time checks.

Activity

  1. dosubot
    added
    kind/featureCategorizes issue or PR as related to a new feature
    on Apr 24, 2026

  2. dosubot commented on Jul 24, 2026

    @dosubot
    dosubotbot
    on Jul 24, 2026 – with DosuBot

    Hi, Aleksei Sviridkin (@lexfrei). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Recap

    • You requested end-to-end coverage for the new TLSRoute passthrough listeners added in feat(networking): Gateway API support via Cilium (supersedes #2213) #2470.
    • The current test coverage appears to stop at Gateway/HTTPRoute admission and reconciliation.
    • The proposed path forward is to add a self-signed TLS certificate plus DNS/hosts plumbing in the sandbox so tests can connect through tls-api, tls-vm-exportproxy, and tls-cdi-uploadproxy.
    • The goal is to verify that those backends respond successfully in a real e2e flow.

    Next Steps

    • If this is still relevant on the latest version of the cozystack repository, please comment here to keep the discussion open.
    • Otherwise, this issue will be automatically closed in 7 days.

    Thanks for your understanding and contribution.

  3. dosubot
    added
    stale
    on Jul 24, 2026
  4. github-actions
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    and removed
    stale
    on Jul 27, 2026
  5. github-actions
    added
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Aug 12, 2026
  6. Aleksei Sviridkin (lexfrei)
    added
    area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)
    on Aug 19, 2026
  7. Aleksei Sviridkin (lexfrei)
    added
    area/testingIssues or PRs related to testing (e2e, bats, unit tests)
    triage/acceptedIndicates an issue is ready to be actively worked on
    priority/backlogGeneral backlog priority. Lower than priority/important-longterm
    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness
    and removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)area/testingIssues or PRs related to testing (e2e, bats, unit tests)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions