e2e: assert the router ingress works on every IP family - #1083
Open
Yuan Gao (ygao-g) wants to merge 5 commits into
Open
e2e: assert the router ingress works on every IP family#1083Yuan Gao (ygao-g) wants to merge 5 commits into
Yuan Gao (ygao-g) wants to merge 5 commits into
Conversation
Yuan Gao (ygao-g)
force-pushed
the
e2e-ingress-family
branch
from
August 20, 2026 19:21
20fd2f2 to
55c1ba6
Compare
Yuan Gao (ygao-g)
marked this pull request as ready for review
August 20, 2026 21:10
Before, the actor zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor. A failure reads as a temporary error rather than an answer, so clients retry it and then give up on the name; Alpine actors could not resolve each other at all, even on an IPv4-only cluster. After, those queries return a correct empty answer, and one that resolvers can cache. A unit test pins the whole rendered zone as a literal, so editing the name pattern or the suffix fails there rather than passing silently.
Nothing in the e2e harness could query the actor DNS zone. Suites reach actors by port-forwarding atenet-router and passing the actor name as a Host header, so the zone CoreDNS actually serves went unasserted, and a suite that wanted to check it had no way to distinguish an empty answer from a server failure. Adds a DNS client that port-forwards the atenet DNS Service and reports the rcode class alongside the addresses, plus a helper for the router's ClusterIP in each family. The tests that use these follow. clusterIPsByFamily here is a stopgap that agent-substrate#938 replaces with internal/ipfamily.
The zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor -- and no test caught it, because Go's resolver masks a SERVFAIL that musl treats as fatal. These assert the rcode class rather than the record: a non-A qtype and a name that misses the actor regex must come back NODATA or NXDOMAIN, and an A query must carry the router's ClusterIP. Both rcode assertions fail on a tree without the first commit here and pass with it, measured on a single-stack IPv4 kind cluster. Part of agent-substrate#246.
The rcode assertions in the previous commit prove the zone stops failing an AAAA query, not that it ever answers one. Nothing checks that the record the zone does publish is the router's IPv6 ClusterIP, so agent-substrate#938 could regress to an empty answer and every existing test would still be green. Kept separate from TestActorDNSZone because it is the only assertion here whose expected result changes with the cluster: it skips wherever atenet-router has a single ClusterIP, which is every cluster until agent-substrate#911 gives the Service a dual-stack policy. Part of agent-substrate#246.
Nothing checked that the router's dataplane listeners bind more than an IPv4 socket, and nothing reached an actor over the router's IPv6 ClusterIP. Every other path a test has into the router -- a port-forward, the pods/proxy and services/proxy subresources -- is mediated by the API server, which picks the family, so no existing test could have caught a listener that lost its IPv6 socket. Reads the bound addresses from Envoy's own admin /listeners, and drives an in-cluster probe pod at the router over each ClusterIP in turn. Red until agent-substrate#911 binds those sockets, so this stays a draft until then. The per-family probe skips on a single-stack cluster. Part of agent-substrate#246.
Yuan Gao (ygao-g)
force-pushed
the
e2e-ingress-family
branch
from
August 21, 2026 01:01
55c1ba6 to
3abdcf2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1082, whose four commits it contains; the last commit is the reviewable change. Part of #246. Draft until #911 lands.
Nothing checks that the router's dataplane listeners bind more than an IPv4 socket, and no test reaches an actor over the router's IPv6 ClusterIP. Every path a test has into the router — a port-forward, the pods/proxy and services/proxy subresources — is mediated by the API server, which picks the family, so a listener that lost its IPv6 socket would go unnoticed.
🤖 Generated with Claude Code