workflows/gateway-api: Cover IPsec with GatewayAPI #35584
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
a1eac0b to
cf24ac2
Compare
This commit adds coverage for GatewayAPI+IPsec in the Gateway API workflow. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
The sysdump filename is not built with the same commands between its creation and its uploading. This wasn't an issue before the previous commit because both outputs would still match. However, the previous commit extended the matrix and surfaced this issue. This commit ensures the exact same command is used to generate the sysdump filenames at creation and upload times. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
cf24ac2 to
5fca412
Compare
This commit adds some basic checks from the Cilium CLI connectivity tests: - no-unexpected-packet-drops is trivial and will report any unexpected packet drops. - the pod-to-pod and node-to-node encryption tests will ensure that traffic is encrypted or not according to the configuration. This is useful here since the workflow may now be running with IPsec enabled. - allow-all-except-world will check connectivity with some basic network policy. This is also useful in the context of IPsec as some IPsec-related bugs can cause the source identity to be lost. Having a policy that allows everything but not world is typically enough to catch such cases. The check-log-errors test should also be enabled, but it is currently failing because there are errors in logs whenever enabling the Gateway API. It can be added once those errors are fixed. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
5fca412 to
61ff7bc
Compare
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
First commit adds coverage for IPsec as a new matrix config. Second commit fixes an issue with the sysdump filenames. Last commit adds a few basic CLI tests to catch potential IPsec bugs.