simplify BackendTLSPolicy test infrastructure and remove unnecessary code #4016

snorwin · 2025-08-23T06:35:11Z

What type of PR is this?

/kind test
/area conformance-machinery

What this PR does / why we need it:
This PR simplifies the test infrastructure for BackendTLSPolicy by reusing the existing backend-tls Deployment instead of creating a separate backend. In addition, it fixes the CA certificate creation process as a CA certificates typically do not contain hostnames and following best practices, the CA certificate private key is now omitted from the ConfigMap.

The refactoring was validated by re-running the BackendTLSPolicy tests against Envoy Gateway and Airlock Microgateway, all of which passed successfully.

Which issue(s) this PR fixes:

Fixes #3934

Does this PR introduce a user-facing change?:

NONE

snorwin · 2025-08-23T06:36:14Z

/cc @candita @kl52752

snorwin · 2025-08-23T06:39:43Z

In case that #3983 is merged before this PR, the changes here will also need to be applied to the BackendTLSPolicySANValidation tests.

kl52752

Thanks for cleaning this up! One question impacting SAN tests that are in review

conformance/utils/kubernetes/certificate.go

snorwin · 2025-08-25T20:05:40Z

@shaneutt, it would be great if we could get this merged before the code freeze.

kl52752

Thanks for the PR, looks good now :)

kl52752 · 2025-08-26T13:37:59Z

/lgtm

snorwin · 2025-08-26T15:16:11Z

In the community meeting, we agreed to wait on merging this until #3983 is merged.
/hold
/cc @kl52752

rikatz · 2025-08-26T18:20:57Z

conformance/utils/kubernetes/certificate_test.go

-	"github.com/stretchr/testify/require"
-)
-
-func Test_generateCACert(t *testing.T) {


why remove the test? we still have the generateCACert helper function right? I mean, was this test failing or is this test not being useful?

It was only for testing that the CA certificate contained the specified hostnames, which does not make sense.

…code Signed-off-by: Norwin Schnyder <[email protected]>

…normative tests

snorwin · 2025-08-28T07:47:21Z

#3983 has been merged, so I rebased this PR and applied the changes to the SAN validation tests.
/unhold

/cc @kl52752
/cc @kubernetes-sigs/gateway-api-admins

kl52752 · 2025-08-28T07:50:12Z

#3983 has been merged, so I rebased this PR and applied the changes to the SAN validation tests. /unhold

/cc @kl52752 /cc @kubernetes-sigs/gateway-api-admins

@snorwin Can you confirm that after those changes SAN conformance tests are passing for your implementation?

snorwin · 2025-08-28T07:57:20Z

@kl52752 sure, I verified the refactoring by running the BackendTLSPolicySANValidation and BackendTLSPolicy tests again.

kl52752

Thank you for the refactoring :)

kl52752 · 2025-08-28T09:06:29Z

/lgtm

rikatz · 2025-08-28T14:23:14Z

Tested locally (removing the resolvedRefs assertion for now as it is not supported by implementations), lgtm, thanks for this nice cleanup!

/lgtm

k8s-ci-robot · 2025-08-28T14:35:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kl52752, shaneutt, snorwin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~conformance/OWNERS~~ [shaneutt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/test area/conformance-machinery Issues or PRs related to the machinery and the suite used to run conformance tests. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 23, 2025

k8s-ci-robot requested review from howardjohn and kflynn August 23, 2025 06:35

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Aug 23, 2025

k8s-ci-robot requested review from candita and kl52752 August 23, 2025 06:36

snorwin changed the title ~~simplify BackendTLSPolicy test infrastructure and remove unnecessary …~~ simplify BackendTLSPolicy test infrastructure and remove unnecessary code Aug 23, 2025

kl52752 suggested changes Aug 25, 2025

View reviewed changes

conformance/utils/kubernetes/certificate.go Show resolved Hide resolved

snorwin requested a review from kl52752 August 25, 2025 17:33

kl52752 approved these changes Aug 26, 2025

View reviewed changes

k8s-ci-robot assigned kl52752 Aug 26, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 26, 2025

k8s-ci-robot requested a review from kl52752 August 26, 2025 15:16

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 26, 2025

shaneutt added this to Release v1.4.0 Aug 26, 2025

shaneutt moved this to Review in Release v1.4.0 Aug 26, 2025

shaneutt added this to the v1.4.0 milestone Aug 26, 2025

shaneutt self-assigned this Aug 26, 2025

rikatz reviewed Aug 26, 2025

View reviewed changes

simplify BackendTLSPolicy test infrastructure and remove unnecessary …

a783fc4

…code Signed-off-by: Norwin Schnyder <[email protected]>

snorwin force-pushed the btlsp-cleanup-tests branch from 37defa3 to 89f8855 Compare August 28, 2025 06:44

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 28, 2025

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 28, 2025

snorwin requested a review from rikatz August 28, 2025 06:53

snorwin force-pushed the btlsp-cleanup-tests branch from 89f8855 to 043583d Compare August 28, 2025 07:03

rebase to 'origin/main' and refactor BackendTLSPolicy validation and …

9e4cf2a

…normative tests

snorwin force-pushed the btlsp-cleanup-tests branch from 043583d to 9e4cf2a Compare August 28, 2025 07:32

k8s-ci-robot requested a review from a team August 28, 2025 07:47

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 28, 2025

kl52752 approved these changes Aug 28, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 28, 2025

shaneutt self-requested a review August 28, 2025 11:27

k8s-ci-robot assigned rikatz Aug 28, 2025

shaneutt approved these changes Aug 28, 2025

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 28, 2025

k8s-ci-robot merged commit 64dfa32 into kubernetes-sigs:main Aug 28, 2025
19 checks passed

github-project-automation bot moved this from Review to Done in Release v1.4.0 Aug 28, 2025

simplify BackendTLSPolicy test infrastructure and remove unnecessary code #4016

simplify BackendTLSPolicy test infrastructure and remove unnecessary code #4016

Conversation

snorwin commented Aug 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

snorwin commented Aug 23, 2025

Uh oh!

snorwin commented Aug 23, 2025

Uh oh!

kl52752 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

snorwin commented Aug 25, 2025

Uh oh!

kl52752 left a comment

Choose a reason for hiding this comment

Uh oh!

kl52752 commented Aug 26, 2025

Uh oh!

snorwin commented Aug 26, 2025

Uh oh!

rikatz Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

snorwin Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

snorwin commented Aug 28, 2025

Uh oh!

kl52752 commented Aug 28, 2025

Uh oh!

snorwin commented Aug 28, 2025

Uh oh!

kl52752 left a comment

Choose a reason for hiding this comment

Uh oh!

kl52752 commented Aug 28, 2025

Uh oh!

rikatz commented Aug 28, 2025

Uh oh!

k8s-ci-robot commented Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

snorwin commented Aug 23, 2025 •

edited

Loading