Skip to content

fix: add BackendTLSPolicy features to GATEWAY-HTTP profile #4199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 3, 2025
Merged

fix: add BackendTLSPolicy features to GATEWAY-HTTP profile #4199

merged 1 commit into from
Nov 3, 2025

Conversation

@snorwin
Copy link
Member

@snorwin snorwin commented Oct 24, 2025

What type of PR is this?

/kind bug
/area conformance-test

What this PR does / why we need it:
This PR ensures that the BackendTLSPolicy conformance tests are properly included in the conformance profiles and reflected in the generated reports. Currently, these tests run successfully but don’t appear in the report because they aren’t associated with any profile

Which issue(s) this PR fixes:

Fixes #3936

Does this PR introduce a user-facing change?:

Added BackendTLSPolicy features to GATEWAY-HTTP profile

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. area/conformance-test Issues or PRs related to Conformance tests. labels Oct 24, 2025
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 24, 2025
@snorwin
Copy link
Member Author

snorwin commented Oct 24, 2025

/cc @shaneutt @candita

@snorwin snorwin force-pushed the fix-profiles branch 2 times, most recently from b8c43d4 to 7e1bdec Compare October 24, 2025 11:44
snorwin
snorwin commented Oct 24, 2025
View reviewed changes
conformance/utils/suite/profiles.go
features.GatewayExtendedFeatures,
features.HTTPRouteExtendedFeatures,
features.BackendTLSPolicyCoreFeatures,
features.BackendTLSPolicyExtendedFeatures,
Copy link
Member Author

@snorwin snorwin Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added now the BackendTLSPolicy Core feature to the Extended features of the profile, I wasn’t sure if the overall BackendTLSPolicy is considered Core or Extended.

Copy link
Contributor

@candita candita Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should create a new profile for Policies.

Copy link
Member Author

@snorwin snorwin Oct 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion, I don’t think it’s worth creating a new profile at this point. Currently, there are only two features that would be part of such a dedicated profile, and both require the Gateway and HTTPRoute feature to execute the tests anyway. Therefore, it would make much more sense to include them under GATEWAY-HTTP for now, and potentially later also under GATEWAY-GRPC and GATEWAY-TLS, once we’ve written the corresponding conformance tests.

The main question for me is whether BackendTLSPolicy is considered part of the Core or Extended. I couldn’t find any information about this in the GEP. If we add it to Core, all implementations would need to support it before achieving conformance for version 1.4, which, in my opinion, would be quite challenging for some. Therefore, I’d suggest adding it as part of the Extended features for now.

Copy link
Contributor

@youngnick youngnick Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The guideline is that all additional objects should be considered Extended unless there is a good reason.

This comes back to "what does Extended mean?". The word "Extended" is relevant for a field and all of its child features. So, when a whole object is Extended, that means that you don't have to support that object. However, if you do support it, then within that object, Core features are MUST, and Extended features are SHOULD.

So, the BackendTLSPolicyExtendedFeatures really require BackendTLSPolicyCoreFeatures and BackendTLSPolicyExtendedFeatures.

So, yes, I agree that BackendTLSPolicy should be Extended. At some point, it may be worth moving it into overall Core support for the HTTP Profile, but not yet.

Copy link
Member Author

@snorwin snorwin Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@youngnick Just to make sure I understand correctly, are you suggesting that we add BackendTLSPolicyCoreFeatures to BackendTLSPolicyExtendedFeatures, or should we keep the change as it is?

Copy link
Contributor

@candita candita Oct 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to see features.BackendTLSPolicyCoreFeatures added to a new conformanceProfile for policies.

Suggested change
features.BackendTLSPolicyExtendedFeatures,
PolicyConformanceProfile = ConformanceProfile{
Name: GatewayHTTPConformanceProfileName,
CoreFeatures: sets.New(
features.BackendTLSPolicyCoreFeatures,
),
ExtendedFeatures: sets.New[features.FeatureName]().
Insert(features.SetsToNamesSet(
features.BackendTLSPolicyExtendedFeatures,
...

Copy link
Contributor

@candita candita Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Disregard.

@snorwin
Copy link
Member Author

snorwin commented Oct 28, 2025 •
edited
Loading

@youngnick here is an example of how the conformance profile for GATEWAY-HTTP looks for an implementation that supports BackendTLSPolicy:

profiles:
  - core:
      result: success
      statistics:
        Failed: 0
        Passed: 33
        Skipped: 0
    extended:
      result: success
      statistics:
        Failed: 0
        Passed: 26
        Skipped: 0
      supportedFeatures:
        - BackendTLSPolicy
        - BackendTLSPolicySANValidation
        - GatewayInfrastructurePropagation
        - GatewayPort8080
        - HTTPRouteBackendProtocolH2C
        - HTTPRouteBackendProtocolWebSocket
        - HTTPRouteBackendTimeout
        - HTTPRouteCORS
        - HTTPRouteDestinationPortMatching
        - HTTPRouteHostRewrite
        - HTTPRouteMethodMatching
        - HTTPRouteNamedRouteRule
        - HTTPRouteParentRefPort
        - HTTPRoutePathRedirect
        - HTTPRoutePathRewrite
        - HTTPRoutePortRedirect
        - HTTPRouteQueryParamMatching
        - HTTPRouteRequestTimeout
        - HTTPRouteResponseHeaderModification
        - HTTPRouteSchemeRedirect
      unsupportedFeatures:
        - GatewayAddressEmpty
        - GatewayHTTPListenerIsolation
        - GatewayStaticAddresses
        - HTTPRoute303RedirectStatusCode
        - HTTPRoute307RedirectStatusCode
        - HTTPRoute308RedirectStatusCode
        - HTTPRouteBackendRequestHeaderModification
        - HTTPRouteRequestMirror
        - HTTPRouteRequestMultipleMirrors
        - HTTPRouteRequestPercentageMirror
    name: GATEWAY-HTTP
    summary: Core tests succeeded. Extended tests succeeded.
    succeededProvisionalTests:
      - GatewayInfrastructure
      - HTTPRouteNamedRule

(If an implementation does not support BackendTLSPolicy, the related features will be listed under unsupportedFeatures)

@youngnick
Copy link
Contributor

youngnick commented Oct 28, 2025

Okay, thanks for checking @snorwin.

This LGTM then.

/approve

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Oct 28, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: snorwin, youngnick

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 28, 2025
@snorwin
Copy link
Member Author

snorwin commented Oct 31, 2025

I think this is ready to merge and to be cherry-picked into release-1.4.

/assign @robscott

@candita
Copy link
Contributor

candita commented Nov 3, 2025

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 3, 2025
@k8s-ci-robot k8s-ci-robot merged commit 64e261d into kubernetes-sigs:main Nov 3, 2025
20 checks passed
@snorwin
Copy link
Member Author

snorwin commented Nov 4, 2025

/cherry-pick release-1.4

@k8s-infra-cherrypick-robot
Copy link
Contributor

k8s-infra-cherrypick-robot commented Nov 4, 2025

@snorwin: new pull request created: #4223

In response to this:

/cherry-pick release-1.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-infra-cherrypick-robot k8s-infra-cherrypick-robot mentioned this pull request Nov 4, 2025
Merged
tylerauerbeck pushed a commit to tylerauerbeck/gateway-api that referenced this pull request Nov 27, 2025
@snorwin @tylerauerbeck
fix: add BackendTLSPolicy features to GATEWAY-HTTP profile (kubernete…
1188ccc 
…s-sigs#4199)

Signed-off-by: Norwin Schnyder <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@youngnick youngnick youngnick left review comments

@kflynn kflynn Awaiting requested review from kflynn

@robscott robscott Awaiting requested review from robscott

@candita candita Awaiting requested review from candita

@shaneutt shaneutt Awaiting requested review from shaneutt

Assignees

@robscott robscott

@candita candita

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/conformance-test Issues or PRs related to Conformance tests. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

BackendTLSPolicy Conformance Test - consider including the feature in the GATEWAY-HTTP profile or create a dedicated profile

6 participants

@snorwin @youngnick @k8s-ci-robot @candita @k8s-infra-cherrypick-robot @robscott