Conformance: Istio implementation fails GatewayFollowingEPPRouting conformance test #992
Description
Summary
The new conformance test GatewayFollowingEPPRouting, introducing in PR #961, is failing for the istio gateway-class. This test is designed to verify that a Gateway correctly routes traffic based on the endpoints selected by an Endpoint Policy (EPP).
The test results indicate that the Istio implementation sends traffic to pods that were not selected by the EPP.
Observed Behavior
When the GatewayFollowingEPPRouting conformance test is run against the istio GatewayClass, it fails. The error log shows that requests are being handled by pods that should not have received traffic according to the EPP's selection.
Test Command:
go test -v ./conformance -args -debug -gateway-class istio -cleanup-base-resources=false -run-test GatewayFollowingEPPRoutingTest Results and Error Log:
error log: gateway_following_epp_routing.go:144: Not all the requests are sent to the expectedPods successfully, err: request was handled by an unexpected pod "infra-backend-deployment-678ff64fb-txms2", Reached pods with request counts: map[infra-backend-deployment-678ff64fb-tnlhd:30 infra-backend-deployment-678ff64fb-txms2:32 infra-backend-deployment-678ff64fb-zjwk2:38]
--- FAIL: TestConformance (139.98s)
--- FAIL: TestConformance/GatewayFollowingEPPRouting (137.31s)
--- FAIL: TestConformance/GatewayFollowingEPPRouting/should_route_traffic_to_a_single_designated_pod (0.05s)
--- FAIL: TestConformance/GatewayFollowingEPPRouting/should_route_traffic_to_two_designated_pods (0.05s)
--- PASS: TestConformance/GatewayFollowingEPPRouting/should_route_traffic_to_all_available_pods (0.05s)
The test cases should_route_traffic_to_a_single_designated_pod and should_route_traffic_to_two_designated_pods fail, showing that when the EPP selects a subset of pods, Istio still distributes traffic to other pods in the service.
Expected Behavior
The Gateway implementation should strictly adhere to the list of endpoints returned by the Endpoint Policy. All traffic should be routed exclusively to the pods specified by the EPP.