Repository navigation
e2e(gateway): the hostname policy is exercised with HTTPRoute only #4068
Description
Problem / motivation
hack/e2e-chainsaw/gateway/chainsaw-test.yaml exercises the route hostname policy with kind: HTTPRoute only (foreign-apex-route-denied, own-apex-route-allowed, the mixed-case pair). The policy set covers tlsroutes and, after #3872, grpcroutes too, but nothing submits either kind to a live apiserver and observes the deny. The static pins prove the rendered policy has the right shape, not that the apiserver enforces it for those kinds.
Proposed solution
A deny and an allow case per remaining kind, in the shape of the HTTPRoute pair. A GRPCRoute attaches to the hostname-less port-80 listener, so it needs no setup; a TLSRoute needs a passthrough listener, which the tenantgateway-reconciler test in the same file already creates.
Scope check
- This affects a single component / package
- I can describe the expected behavior concretely
Alternatives considered
None worth it.
Additional context
Surfaced while reviewing #3872.
Activity
lexfrei commentedon Sep 23, 2026
Closing as a duplicate of #3871. Since #3475 the suite sends TLSRoute and GRPCRoute only in the hostname-less deny case. The foreign-apex deny and own-apex allow pair is still HTTPRoute-only, which is exactly what #3871 tracks, and the GRPCRoute half fits there too.