Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[e2e] eg release upgrade test #2862

Merged
merged 21 commits into from
Mar 11, 2024
Merged

[e2e] eg release upgrade test #2862

merged 21 commits into from
Mar 11, 2024

Conversation

alexwo
Copy link
Contributor

@alexwo alexwo commented Mar 10, 2024

Tests eg upgrades - ensuring zero-downtime during the upgrade.

We want to ensure that the complete helm deployment is upgradable (Including helm template changes).

Direction:

  1. Begin with the removal of the existing EnvoyGateway version using Helm uninstall.
  2. Proceed to install the most recent stable release, or an alternate specified version if determined by the last_version_tag environment variable.
  3. Introduce a minimal traffic load to ensure uninterrupted routing to an already deployed backend.
  4. Update the EnvoyGateway to the latest main version.
  5. Validate that both the upgrade and service connectivity were seamlessly maintained without disruptions.

Which issue(s) this PR fixes:
#1713

Copy link

codecov bot commented Mar 10, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 63.87%. Comparing base (dbabeae) to head (13e3a62).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2862   +/-   ##
=======================================
  Coverage   63.87%   63.87%           
=======================================
  Files         124      124           
  Lines       20924    20924           
=======================================
  Hits        13366    13366           
  Misses       6703     6703           
  Partials      855      855           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@zirain
Copy link
Contributor

zirain commented Mar 10, 2024

I'm thinking should use a seprated test suite?

@guydc guydc added this to the v1.0.0 milestone Mar 10, 2024
@guydc
Copy link
Contributor

guydc commented Mar 10, 2024

I'm thinking should use a seprated test suite?

Probably a good idea, as this may in the future depend on features like graceful drain that we will be enabled with a dedicated EnvoyProxy, as discussed #2839. Also, the install/uninstall/upgrade may be have side effects to other tests if this test is not executed in isolation after the main suite.

alexwo and others added 3 commits March 10, 2024 16:30
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 10, 2024

I'm thinking should use a seprated test suite?

Probably a good idea, as this may in the future depend on features like graceful drain that we will be enabled with a dedicated EnvoyProxy, as discussed #2839. Also, the install/uninstall/upgrade may be have side effects to other tests if this test is not executed in isolation after the main suite.

Sounds good, please share your feedback on the overall approach :)

If possible lets execute the tests at least once via the Continuous Integration system, as I'm uncertain about the completeness of local testing. If everything functions as expected, we can then move forward with restructuring this into a dedicated test suite.

@guydc
Copy link
Contributor

guydc commented Mar 10, 2024

Sorry Alex, didn't notice that the CI was off for this. Sure, I enabled it now.

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 10, 2024

/retest

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
depNS := "envoy-gateway-system"
lastVersionTag := os.Getenv("last_version_tag")
if lastVersionTag == "" {
lastVersionTag = "v0.0.0-latest" // Default version tag if not specified
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets make this v0.6.0

Copy link
Contributor Author

@alexwo alexwo Mar 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't do a hitless upgrade from v0.6.0, as per the tests we have about 1,017 failures :
upgrade completed after 12.14846937s with 41572 requests, 40555 success, 1017 failures and 1017 errors
7735

We can do v1.0.0-rc.1 , WDYT?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we know why it failed, this sounds like a release blocker

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or we can track this as a follow up issue, to unblock this PR

Copy link
Contributor

@arkodg arkodg Mar 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also rereading your description, it sounds like upgrade passed, but hitless upgrade failed :)
I think thats fine for v0.6.0 to latest, we can make sure v1.0.0 to latest is hitless
any way you can tweak this PR to make sure some requests succeeded eventually, rather than make sure there are no failures ?

Copy link
Contributor Author

@alexwo alexwo Mar 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arkodg yes, we can keep v0.6.0 and i will tweak it to do a one simple request before the upgrade and one after the upgrade.
This should always work.

I guess we don't need the load part now as the upgrade flow is less interesting (not working hitless at least for the older releases).

Copy link
Contributor Author

@alexwo alexwo Mar 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have removed the load test and replaced this with a more simple check, it will work for v.06.0 now. I think we should be almost hitless with the more latest versions as we have shut down manager in. but lets revise later.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awesome thanks !

chartPath, err := install.LocateChart("oci://docker.io/envoyproxy/gateway-helm", cli.New())
if err != nil {
return err
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets add a TODO comment in here saying we need to explicitly reinstall CRDs, and raise a separate GH issue to work on that as a follow up

t.Log("Starting load generation", "reqURL:", reqURL.String())

// Run load async and continue to restart deployment
go runLoadAndWait(t, suite.TimeoutConfig, loadSuccess, aborter, reqURL.String())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so we're only checking if the traffic + route works post install ? can we also check if it works before ? (probably obvious, but helps the next dev debug this code better in case they are debugging upgrade failures)

@arkodg
Copy link
Contributor

arkodg commented Mar 10, 2024

@alexwo the code looks good added some minor comments, thanks for getting this in into v1.0 !

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

@alexwo the code looks good added some minor comments, thanks for getting this in into v1.0 !

Absolutely! You're very welcome! :)

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo alexwo marked this pull request as ready for review March 11, 2024 05:20
@alexwo alexwo requested a review from a team as a code owner March 11, 2024 05:20
@ShyunnY
Copy link
Contributor

ShyunnY commented Mar 11, 2024

This looks good, there are many similarities between the PRs you and I wrote about the Helm library, maybe we need a way to make this part of the code reusable in egctl/e2e! ❤️
@alexwo

@@ -121,7 +121,8 @@ run-e2e: install-e2e-telemetry
kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available
kubectl apply -f test/config/gatewayclass.yaml
ifeq ($(E2E_RUN_TEST),)
go test -v -tags e2e ./test/e2e --gateway-class=envoy-gateway --debug=true --cleanup-base-resources=$(E2E_CLEANUP)
go test -v -tags e2e ./test/e2e --gateway-class=envoy-gateway --debug=true
go test -v -tags e2e ./test/e2e/upgrade --gateway-class=envoy-gateway --debug=true --cleanup-base-resources=$(E2E_CLEANUP)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should also add smiliar line on L128?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes indeed, so that we have an option to run just it.

@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

This looks good, there are many similarities between the PRs you and I wrote about the Helm library, maybe we need a way to make this part of the code reusable in egctl/e2e! ❤️ @alexwo

Sure, I can check if we can maybe make it reusable.

@ShyunnY
Copy link
Contributor

ShyunnY commented Mar 11, 2024

Grateful! It looks like the egctl install/egctl uninstall I wrote relies more heavily on the Helm library part, maybe I can extract it into the utils package so that it can share functionality!

@guydc
Copy link
Contributor

guydc commented Mar 11, 2024

/retest

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
…ateway into tests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

/retest

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

/retest

1 similar comment
@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

/retest

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
@alexwo
Copy link
Contributor Author

alexwo commented Mar 11, 2024

/retest

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
…ateway into tests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Copy link
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks for adding this !

@arkodg arkodg requested review from a team March 11, 2024 17:50
@guydc
Copy link
Contributor

guydc commented Mar 11, 2024

/retest

1 similar comment
@guydc
Copy link
Contributor

guydc commented Mar 11, 2024

/retest

@guydc guydc merged commit 0141b9f into envoyproxy:main Mar 11, 2024
19 checks passed
Xunzhuo pushed a commit to Xunzhuo/gateway that referenced this pull request Mar 13, 2024
* [e2e] eg release upgrade test

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fixing linit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* Update test/e2e/tests/eg_upgrade.go

Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>

* Update test/e2e/tests/eg_upgrade.go

Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>

* adding updated go mod

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix tests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* move eg upgrade tests to a dedicated suit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* removing unused

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix code review feedbacks and move e2e clean after the eg upgrades suit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* don't clean after this step yet

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* increase helm install / upgrade default timeouts

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* restructure test order add an option to execute a single test

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix kube make single test exec

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* change to rc version

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* removing loadtest part, changing to simple requests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

---------

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Xunzhuo added a commit that referenced this pull request Mar 13, 2024
* ci: update cherry-pick v1.0.0 (#2784)

Signed-off-by: bitliu <bitliu@tencent.com>

* fix: add missing release notes details and re organize it (#2785)

fix: complete missing release notes and re organize it

Signed-off-by: bitliu <bitliu@tencent.com>

* e2e: backend upgrade test (#2725)

* chore: add testdata to passive health checks (#2788)

* chore: add testdata to passive health checks

Signed-off-by: yeedove <yeedove@gmail.com>

* fix test

Signed-off-by: yeedove <yeedove@gmail.com>

---------

Signed-off-by: yeedove <yeedove@gmail.com>

* promote: guydc as maintainer (#2794)

Signed-off-by: bitliu <bitliu@tencent.com>

* fix: Delete unused status keys from watchable (#2782)

* Delete unused status keys in gatewayapi-runner

Signed-off-by: Yuneui Jeong <uniglot@proton.me>

* Delete unused status keys in xds-translator runner

Signed-off-by: Yuneui Jeong <uniglot@proton.me>

* Add tests and fix code to pass all tests

Signed-off-by: Yuneui Jeong <uniglot@proton.me>

* Cover more

Signed-off-by: Yuneui <uniglot@proton.me>

* Change struct's name and other minor fixes

Signed-off-by: Yuneui Jeong <uniglot@proton.me>

---------

Signed-off-by: Yuneui Jeong <uniglot@proton.me>
Signed-off-by: Yuneui <uniglot@proton.me>

* docs: fix commands in basic auth example (#2791)

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* feat: Support WellKnownSystemCerts in BackendTLSPolicy (#2804)

* Add support for using the system truststore with upstream TLS.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Make the linter happy

Signed-off-by: Lior Okman <lior.okman@sap.com>

---------

Signed-off-by: Lior Okman <lior.okman@sap.com>

* docs: refactor user guides (#2797)

* docs: refactor user guides

Signed-off-by: bitliu <bitliu@tencent.com>

* fix: relative paths

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>

* Fix gen check (#2814)

* fix: gen-check error

Signed-off-by: bitliu <bitliu@tencent.com>

* run lint for docs

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>

* refactor: set instead of map for mergeGateways (#2803)

* refactor:set[T] instead of map[T]bool

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>

* fix lint

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>

---------

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>

* remove: support for hostnetwork (#2815)

* feat(egctl): add support for egctl to translate from gateway-api resources to IR (#2799)

* Added an option to translate to IR representation.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Added a unit test, and made sure that existing services have an IP
address.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Add omitempty where needed.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Make gen-check happy

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Added some documentation.

Signed-off-by: Lior Okman <lior.okman@sap.com>

---------

Signed-off-by: Lior Okman <lior.okman@sap.com>

* docs: basic auth example use https (#2806)

* docs: basic auth example use https

Signed-off-by: phantooom <xiaorui.zou@gmail.com>

* docs: refactor user guides (#2797)

* docs: refactor user guides

Signed-off-by: bitliu <bitliu@tencent.com>

* fix: relative paths

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>
Signed-off-by: phantooom <xiaorui.zou@gmail.com>

* Fix gen check (#2814)

* fix: gen-check error

Signed-off-by: bitliu <bitliu@tencent.com>

* run lint for docs

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>
Signed-off-by: phantooom <xiaorui.zou@gmail.com>

* refactor: set instead of map for mergeGateways (#2803)

* refactor:set[T] instead of map[T]bool

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>

* fix lint

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>

---------

Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>
Signed-off-by: phantooom <xiaorui.zou@gmail.com>

* Update site/content/en/latest/user/security/basic-auth.md

Co-authored-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: zou rui <xiaorui.zou@gmail.com>

---------

Signed-off-by: phantooom <xiaorui.zou@gmail.com>
Signed-off-by: bitliu <bitliu@tencent.com>
Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>
Signed-off-by: zou rui <xiaorui.zou@gmail.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>
Co-authored-by: Dennis Zhou <idennis.zhou@gmail.com>
Co-authored-by: Huabing Zhao <zhaohuabing@gmail.com>

* chore: group go.opentelemetry.io dependabot (#2821)

Signed-off-by: zirain <zirain2009@gmail.com>

* Add referenced BackendRefs for ExtAuth to Resource Tree (#2795)

* add referenced BackendRefs for ExtAuth to Resource Tree

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* clean up the controller code

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* minor changes

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* return errors

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix validate error

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* Support BackendTLSPolicy for the Ext HTTP/GRPC auth service

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* check cross-ns reference grant

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix bootstrap merge (#2801)

* fix bootstrap merge

Signed-off-by: zirain <zirain2009@gmail.com>

* refactor validateBootstrap

Signed-off-by: zirain <zirain2009@gmail.com>

* lint

Signed-off-by: zirain <zirain2009@gmail.com>

* update test

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: skip the ReasonTargetNotFound for all policies (#2802)

* stop populating ReasonTargetNotFound for all the policies

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* add test to ensure the status is expected

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix gen-check and lint

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

---------

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* docs: update EnvoyProxy logs (#2822)

* docs: update EnvoyProxy logs

Signed-off-by: zirain <zirain2009@gmail.com>

* lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: omit default replicas on Kubernetes Deployment (#2816)

* fix: remove default replicas function

Signed-off-by: Ardika Bagus <me@ardikabs.com>

* chore: omit replicas because nil equal to 1 by default

Signed-off-by: Ardika Bagus <me@ardikabs.com>

* chore: add a note when a user is being explicit on deployment replicas

Signed-off-by: Ardika Bagus <me@ardikabs.com>

---------

Signed-off-by: Ardika Bagus <me@ardikabs.com>

* bug: compute endpointType for all protocol types (#2833)

Fixes: #2832

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* docs: Routing outside k8s (#2831)

* docs: Routing outside k8s

Fixes: #2482

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* updates

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

---------

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (#2825)

Bumps google.golang.org/protobuf from 1.32.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump golang.org/x/net from 0.21.0 to 0.22.0 (#2826)

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.21.0 to 0.22.0.
- [Commits](golang/net@v0.21.0...v0.22.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#2827)

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.4 to 1.9.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.8.4...v1.9.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix: failed to create envoy-oidc-hmac secret when upgrading EG (#2835)

try to create every secret instead of returning eraly

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 (#2829)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.62.0 to 1.62.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.62.0...v1.62.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Ext auth e2e tests (#2830)

* e2e tests for http ext auth

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* export util methods to avoid unparam link issues

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fixt test

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix existing secret check (#2838)

fix existing secret

Signed-off-by: zirain <zirain2009@gmail.com>

* ci: update k8s matrix (#2836)

* ci: update k8s matrix

Signed-off-by: zirain <zirain2009@gmail.com>

* v1.26.14

Signed-off-by: zirain <zirain2009@gmail.com>

* nit

Signed-off-by: zirain <zirain2009@gmail.com>

* update matrix

Signed-off-by: zirain <zirain2009@gmail.com>

* link in quickstart

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

* 1.29.2

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* e2e: try to fix client timeout flakes (#2812)

* chore: client timeout log

Signed-off-by: zirain <zirain2009@gmail.com>

* add EnvoyProxy extra args

Signed-off-by: zirain <zirain2009@gmail.com>

* add E2E_CLEANUP

Signed-off-by: zirain <zirain2009@gmail.com>

* nit

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* feat: Support Upstream TLS to multiple Backends (#2818)

* Use transport_socket_matches to setup correct sockets for different
destinations.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Support Proxy Protocol for TLS upstreams.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Changed the name generated for each transport match to be more inline
with other names used in other places in xDS.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Added one more case in the unit-test to show that upstream proxy-protocol still works.

Signed-off-by: Lior Okman <lior.okman@sap.com>

---------

Signed-off-by: Lior Okman <lior.okman@sap.com>

* e2e: move drain settings into shutdown settings (#2850)

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* docs: mtls to the gateway (#2851)

* docs: mtls to the gateway

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* edits

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* add ref

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* typo

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

---------

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* ignore finalizers when comparing envoy proxy svc (#2856)

* ignore finalizers when comparing envoy proxy svc

Fixes: #1820

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* Chore: remove the uncessary allAssociatedRefGrants from resourceMappings (#2843)

* modify oidc docs

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* clear allAssociatedRefGrants

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* docs: allow users to configure custom certs for control plane auth (#2847)

Signed-off-by: zirain <zirain2009@gmail.com>

* add e2e tests for ext auth with grpc auth service (#2841)

* add e2e tests for ext auth with grpc auth service

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add BackedTLSPolicy

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* generate TLS socket for ext auth services

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix: Address race condition disrupting graceful shutdown process (#2864)

Signed-off-by: David Alger <davidmalger@gmail.com>

* docs: move Design docs under "Get Involved" (#2857)

* docs: move Design docs under "Get Involved"

* design docs are more relevant to internal contributors than external
  users

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* fix links

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

---------

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* e2e: backend TLS policy (#2853)

* start backendtls test

Signed-off-by: Guy Daich <guy.daich@sap.com>

* fix lint

Signed-off-by: Guy Daich <guy.daich@sap.com>

* use better name for egSetup(...)

Signed-off-by: Guy Daich <guy.daich@sap.com>

* add negative test

Signed-off-by: Guy Daich <guy.daich@sap.com>

* use static certs for test

Signed-off-by: Guy Daich <guy.daich@sap.com>

---------

Signed-off-by: Guy Daich <guy.daich@sap.com>

* Update the user doc for OIDC (#2778)

* user doc for oidc

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add ADOPTERS.md (#2865)

ADOPTERS.md

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>

* build(deps): bump softprops/action-gh-release from 1 to 2 (#2867)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 1 to 2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@de2c0eb...d99959e)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump github.com/bufbuild/buf from 1.29.0 to 1.30.0 in /tools/src/buf (#2870)

build(deps): bump github.com/bufbuild/buf in /tools/src/buf

Bumps [github.com/bufbuild/buf](https://github.com/bufbuild/buf) from 1.29.0 to 1.30.0.
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.29.0...v1.30.0)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump github.com/prometheus/common from 0.49.0 to 0.50.0 (#2871)

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.49.0 to 0.50.0.
- [Release notes](https://github.com/prometheus/common/releases)
- [Commits](prometheus/common@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump fortio.org/fortio from 1.63.3 to 1.63.4 (#2873)

Bumps [fortio.org/fortio](https://github.com/fortio/fortio) from 1.63.3 to 1.63.4.
- [Release notes](https://github.com/fortio/fortio/releases)
- [Commits](fortio/fortio@v1.63.3...v1.63.4)

---
updated-dependencies:
- dependency-name: fortio.org/fortio
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add tetrate to adopters (#2874)

add tetrate to adopters

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix: Don't override the ALPN array if HTTP/3 is enabled. (#2876)

* Don't override the ALPN array if HTTP/3 is enabled.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Removed the unneeded CEL validation for HTTP/3 and ALPN, as well as the
CEL tests.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Also regenerate the CRD.

Signed-off-by: Lior Okman <lior.okman@sap.com>

---------

Signed-off-by: Lior Okman <lior.okman@sap.com>

* [e2e] eg release upgrade test (#2862)

* [e2e] eg release upgrade test

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fixing linit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* Update test/e2e/tests/eg_upgrade.go

Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>

* Update test/e2e/tests/eg_upgrade.go

Co-authored-by: zirain <zirain2009@gmail.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>

* adding updated go mod

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix tests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* move eg upgrade tests to a dedicated suit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* removing unused

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix code review feedbacks and move e2e clean after the eg upgrades suit

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* don't clean after this step yet

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* increase helm install / upgrade default timeouts

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* restructure test order add an option to execute a single test

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* fix kube make single test exec

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* change to rc version

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

* removing loadtest part, changing to simple requests

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>

---------

Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>
Co-authored-by: zirain <zirain2009@gmail.com>

* Docs for ext auth (#2868)

* docs for ext auth

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* Remove the uncessary \ (#2883)

remove the \

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* docs: backend tls policy (#2884)

* backend tls docs

Signed-off-by: Guy Daich <guy.daich@sap.com>

* fix somy copy-paste mistakes

Signed-off-by: Guy Daich <guy.daich@sap.com>

* fix typo

Signed-off-by: Guy Daich <guy.daich@sap.com>

---------

Signed-off-by: Guy Daich <guy.daich@sap.com>

* feat: add PolicyStatus for BackendTrafficPolicy (#2846)

* add PolicyStatus for BTP

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix gen-check

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix ns problem, add more test and modify controller behavior

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix lint

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* make gateway as the ancestor of btp if it is targeting to the gateway

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix linter

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix go.mod

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* do some polish

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

---------

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* Change the Merge behavior to Replace for SecurityPolicy (#2885)

* Change the Merge behavior to Replace for SecurityPolicy

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add another http route

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* e2e: add weighted backend  (#2863)

* e2e: add backend weighted

Signed-off-by: ShyunnY <1147212064@qq.com>

* fix: Fix weight calculation issue and use AlmostEqual func

Signed-off-by: ShyunnY <1147212064@qq.com>

* fix: add additional comments

Signed-off-by: ShyunnY <1147212064@qq.com>

---------

Signed-off-by: ShyunnY <1147212064@qq.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>

* http3: use service port in alt-svc header (#2886)

Fixes: #2882

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* bug: add h3 alpn by default if http3 is enabled (#2887)

Fixes: #2875

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* fix: prevent policies targeting non-TLS listeners on the same port from conflicting (#2786)

* * Validate that multiple policies that affect listener configuration don't map to
  the same listener filter chain.
* Change the XDS listener generation so that instead of
  defaultFilterChain for non-TLS routes, a filterChain with a
  destinationPort matcher is used.
  This allows multiple policies attached to non-TLS listeners that
  differ on the destination port to provide different policies without
  conflicting.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Make hostname based routing work again for non-TLS listeners

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Fixed testdata for egctl

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Make the linter happy

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Added a unit-test

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Make the linter happy

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Update an e2e test with the new filterChain patch

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Revert changing the XDS translation, since a new listener is created
anyways for each port.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Also revert the xds change in the e2e test.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Don't need to go over the full XDSIR map - just the current gateway.

Signed-off-by: Lior Okman <lior.okman@sap.com>

* Refactored to separate the validation and the translation.

Renamed the helper method to a more generic name.

Signed-off-by: Lior Okman <lior.okman@sap.com>

---------

Signed-off-by: Lior Okman <lior.okman@sap.com>
Co-authored-by: Guy Daich <guy.daich@sap.com>

* chore: remove ProcessBackendTLSPoliciesAncestorRef (#2845)

* remove ProcessBackendTLSPoliciesAncestorRef

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* Change the Merge behavior to Replace for BackendTrafficPolicy (#2888)

* Change the Merge behavior to Replace for BackendTrafficPolicy

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* shutdown drainTimeout should also affect envoy drain time (#2898)

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* skip publishing empty status for policies (#2902)

* skip publishing empty status for policies

* #2802 skips computing status
if a target resource cannot be found, mainly because that target maybe
irrelevant to this specific translation, its hard to proactively find
that out in the provider layer

* This fix ensures that any empty status is not published and resets any
existing status for a policy

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* also fix for envoypatchpolicy

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* also discard status for backendtlspolicy

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

---------

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* docs: multiple gatewayclass and merge gateways deployment mode (#2881)

* docs: multiple gatewayclass and merge gateways deployment mode

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add merged-gateways example

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* md lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* yaml lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add user guides

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>

* feat: add PolicyStatus for ClientTrafficPolicy (#2895)

* add PolicyStatus for CTP

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix gen-check

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* revert discard policy status

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

---------

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* Use gwapiv1a2.PolicyStatus for SecurityPolicy Status (#2848)

* use gwapiv1a2.PolicyStatus for SecurityPolicy Status

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add test for cross-ns refs

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* add todo

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* Update internal/gatewayapi/securitypolicy.go

Co-authored-by: sh2 <shawnhxh@outlook.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Co-authored-by: sh2 <shawnhxh@outlook.com>

* Fix oidc doc (#2905)

fix oidc doc

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

* Release v1.0 (#2909)

* add v1.0.0 release note

Signed-off-by: bitliu <bitliu@tencent.com>

* generate v1.0 release page

Signed-off-by: bitliu <bitliu@tencent.com>

* add v1.0.0 release announcement

Signed-off-by: bitliu <bitliu@tencent.com>

* generate v1.0.0 docs

Signed-off-by: bitliu <bitliu@tencent.com>

* update site links

Signed-off-by: bitliu <bitliu@tencent.com>

* fix linter

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>
Signed-off-by: yeedove <yeedove@gmail.com>
Signed-off-by: Yuneui Jeong <uniglot@proton.me>
Signed-off-by: Yuneui <uniglot@proton.me>
Signed-off-by: Arko Dasgupta <arko@tetrate.io>
Signed-off-by: Lior Okman <lior.okman@sap.com>
Signed-off-by: Dennis Zhou <idennis.zhou@gmail.com>
Signed-off-by: phantooom <xiaorui.zou@gmail.com>
Signed-off-by: zou rui <xiaorui.zou@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>
Signed-off-by: Ardika Bagus <me@ardikabs.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: David Alger <davidmalger@gmail.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Alexander Volchok <alex.volchok@sap.com>
Signed-off-by: Alex Volchok <alex.volchok@sap.com>
Signed-off-by: ShyunnY <1147212064@qq.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Guy Daich <guy.daich@sap.com>
Co-authored-by: Dennis Zhou <yeedove@gmail.com>
Co-authored-by: Yuneui Jeong <uniglot@proton.me>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Lior Okman <lior.okman@sap.com>
Co-authored-by: Dennis Zhou <idennis.zhou@gmail.com>
Co-authored-by: zou rui <xiaorui.zou@gmail.com>
Co-authored-by: Huabing Zhao <zhaohuabing@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: sh2 <shawnhxh@outlook.com>
Co-authored-by: Ardika <me@ardikabs.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: David Alger <davidmalger@gmail.com>
Co-authored-by: Alex Volchok <alex.volchok@sap.com>
Co-authored-by: Shyunn <1147212064@qq.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Development

Successfully merging this pull request may close these issues.

5 participants