kgateway-dev · sheidkamp · Oct 31, 2025 · Oct 31, 2025 · Oct 27, 2025 · Nov 4, 2025
diff --git a/.github/actions/kubernetes-e2e-tests/action.yaml b/.github/actions/kubernetes-e2e-tests/action.yaml
@@ -20,6 +20,10 @@ inputs:
   matrix-label:
     required: true
     description: The version of the matrix being used - used to name artifacts to prevent filename collisions
+  gosum-test-args:
+    required: false
+    description: The arguments passed to the gosum test invocation
+    default: '--format=testname'
 
 runs:
   using: "composite"
@@ -29,6 +33,7 @@ runs:
       GO_TEST_USER_ARGS: ${{ inputs.test-args }} -run "${{ inputs.run-regex }}" -v
       CLUSTER_NAME: ${{ inputs.cluster-name }}
       ISTIO_VERSION: ${{ inputs.istio-version }}
+      GOTESTSUM_ARGS: ${{ inputs.gosum-test-args }}
     shell: bash
     run: make e2e-test
   - name: Archive bug report directory on failure

diff --git a/.github/actions/setup-kind-cluster/action.yaml b/.github/actions/setup-kind-cluster/action.yaml
@@ -15,10 +15,14 @@ inputs:
   istio-version:
     required: true
     description: The version of Istio
-  gateway-api-version:
+  kgateway-api-version:
     required: false
     default: "" # If this is undefined the setup-kind script has its own default value
     description: The version of the gateway-api to use
+  kgateway-api-channel:
+    required: false
+    default: "" # If this is undefined the setup-kind script has its own default value
+    description: The channel of the gateway-api to use
   localstack:
     required: false
     default: "false"
@@ -37,8 +41,10 @@ runs:
         CLUSTER_NAME: ${{ inputs.cluster-name }}
         CLUSTER_NODE_VERSION: ${{ inputs.kind-node-version }}
         ISTIO_VERSION: ${{ inputs.istio-version }}
-        CONFORMANCE_VERSION: ${{ inputs.gateway-api-version }}
+        CONFORMANCE_VERSION: ${{ inputs.kgateway-api-version }}
+        CONFORMANCE_CHANNEL: ${{ inputs.kgateway-api-channel }}
         LOCALSTACK: ${{ inputs.localstack }}
+        # AI Tests rely on metal LB
         CONFORMANCE: true
       run: |
         ./hack/kind/setup-kind.sh
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -75,7 +75,6 @@ jobs:
         - cluster-name: 'agent-gateway-cluster'
           go-test-args: '-v -timeout=25m'
           go-test-run-regex: '^TestAgentgatewayIntegration'
-          agentgateway: 'true'
         # August 29, 2025: ~3 minutes
         - cluster-name: 'api-validation'
           go-test-args: '-v -timeout=10m'

diff --git a/.github/workflows/nightly-tests.yaml b/.github/workflows/nightly-tests.yaml
@@ -22,6 +22,10 @@ on:
         description: "Run load testing suite"
         type: boolean
         default: false
+      run-e2e-tests:
+        description: "Run e2e tests"
+        type: boolean
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -59,3 +63,53 @@ jobs:
       with:
         ref: main
     - uses: ./.github/actions/kube-gateway-api-load-tests
+
+  kgateway_e2e_tests_for_gateway_api_versions:
+    name: E2E Tests for Gateway API Versions
+    if: ${{ (github.event_name == 'workflow_dispatch' && inputs.run-e2e-tests)}}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        gateway-api-version: [ { version: 'v1.4.0', channel: 'experimental' },
+                              { version: 'v1.4.0', channel: 'standard' },
+                              { version: 'v1.3.0', channel: 'experimental' },
+                              { version: 'v1.3.0', channel: 'standard' },
+                              { version: 'v1.2.1', channel: 'experimental' },
+                              { version: 'v1.2.1', channel: 'standard' }]
+        test-regex: [ {name: "kgateway", regex: "^Test[^A]"},
+                      {name: "agentgateway", regex: "^TestA" } ]
+    steps:
+    - uses: actions/checkout@v4
+    - name: Prep Go Runner
+      uses: ./.github/actions/prep-go-runner
+    - name: Dotenv Action
+      uses: falti/[email protected]
+      id: dotenv
+      with:
+        path: "./.github/workflows/.env/nightly-tests/max_versions.env"
+        log-variables: true
+    - name: Setup KinD Cluster
+      uses: ./.github/actions/setup-kind-cluster
+      with:
+        kgateway-api-version: ${{ matrix.gateway-api-version.version }}
+        kgateway-api-channel: ${{ matrix.gateway-api-version.channel }}
+        cluster-name: "kgw-api-e2e-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}-${{ matrix.test-regex.name }}"
+        kubectl-version: ${{ steps.dotenv.outputs.kubectl_version }}
+        istio-version: ${{ steps.dotenv.outputs.istio_version }}
+        kind-node-version: ${{ steps.dotenv.outputs.node_version }}
+    - id: run-tests
+      uses: ./.github/actions/kubernetes-e2e-tests
+      env:
+        VERSION: '1.0.0-ci1'
+        GITHUB_TOKEN: ${{ github.token }}
+        GO_TEST_RETRIES: '2'
+      with:
+        cluster-name: "kgw-api-e2e-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}-${{ matrix.test-regex.name }}"
+        test-args: '-v -timeout=120m'
+        run-regex: ${{ matrix.test-regex.regex }}
+        istio-version: ${{ steps.dotenv.outputs.istio_version }}
+        matrix-label: "nightly-kgw-api-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}-${{ matrix.test-regex.name }}"
+        gosum-test-args: '--format=standard-verbose'
+
diff --git a/design/12721.md b/design/12721.md
@@ -0,0 +1,145 @@
+# EP-12721: E2e testing with Gateway API Versions
+
+
+* Issue: [12721](https://github.com/kgateway-dev/kgateway/issues/12721)
+
+
+## Background
+The current e2e tests assume the latest supported experimental version of the `gateway.networking.k8s.io` APIs is installed. This will not always be the case in the environments in which kgateway is deployed. In order to validate functionality across a wider range of environments, we will allow testing with different versions of the Gateway API.
+
+In addition to different semver designated versions of the API, there are two channels, `standard` and `experimental`
+
+
+### Differences in API versions
+* v0.3.0
+  * TCPRoute, TLSRoute, and the unused UDPRoute added to experimental (not available in standard as of v1.4.0)
+* v1.1.0
+  * SessionPersistance for HTTPRoute rules added to experimental (not available in standard as of v1.4.0)
+* v1.2.0
+  * HTTPRoutes.spec.rules[].name added in experimental (promoted to standard in v1.4.0)
+* v1.3.0
+  * XListenerSets added to experimental (not available in standard as of v1.4.0, planned for v1.5.0)
+  * CORS filters added to experimental (not available in standard as of v1.4.0)
+* v1.4.0
+  * BackendTLSPolicy promoted to v1 in standard and experimental. Previous v1alpha3 version is not supported.
+  * HTTPRoutes.spec.rules[].name added to standard
+
+The are a substantial number of tests that need to be modified to 
+
+
+## Motivation
+Better test coverage and understanding of how kgateway works with different Gateway API versions
+
+## Goals
+* E2E tests can be run locally or in CI with different versions (semver and channel) of the Gateway API
+* Consistent approach to managing resources for different versions of the API
+
+## Non-Goals
+* Mass update of existing tests to use the BaseTestingSuite
+  * Suites that don't use the BaseTestingSuite will continue to run all tests for any GatewayAPI version
+  * Tests that need implement version dependent behavior will be migrated to BaseTestingSuite as needed
+* Running tests in CRC/Openshift
+* Updating application code to support earlier versions
+
+
+## Implementation Details
+### Determining the Gateway API version
+The Gateway API CRDs contain two relevant annotations:
+* `gateway.networking.k8s.io/bundle-version` - the API version, for example `gateway.networking.k8s.io/bundle-version: v1.2.0`
+* `gateway.networking.k8s.io/channel` - the API channel, standard or experimental, for example `gateway.networking.k8s.io/channel: standard`
+
+These annotations can be examined to determine the version. If the annotations are not present, this should be considered a fatal error.
+
+### Test cases
+The e2e tests are built up of [TestCases](https://github.com/kgateway-dev/kgateway/blob/2b04f3d1465257d0c449687922ea6e92603b822c/test/kubernetes/e2e/tests/base/base_suite.go#L33) that define the resources used for the tests.
+
+In order to allow test cases to run conditionally based on the API version, we will add new fields, `MinGwApiVersion` and `MaxGwApiVersion` to the TestCase struct:
+
+```
+	// MinGwApiVersion specifies the minimum Gateway API version required per channel.
+	// Map key is the channel (GwApiChannelStandard or GwApiChannelExperimental), value is the minimum version.
+	// If the map is empty/nil, the test runs on any channel/version.
+	// The test will only run if the Gateway API version is >= the specified minimum version.
+	// For minimum requirements, if only experimental constraints exist, the test is considered experimental-only and will skip on standard channel.
+	// Matching logic based on installed channel:
+	//   - experimental: If experimental key exists, check version; otherwise run
+	//   - standard: If standard key exists, check version; if only experimental exists, skip; otherwise runs on any standard version.
+	MinGwApiVersion map[GwApiChannel]*GwApiVersion
+
+	// MaxGwApiVersion specifies the maximum Gateway API version required per channel.
+	// Map key is the channel (GwApiChannelStandard or GwApiChannelExperimental), value is the maximum version.
+	// If the map is empty/nil, the test runs on any channel/version.
+	// The test will only run if the Gateway API version is < the specified maximum version.
+	// Maximum constraints are channel-specific - experimental constraints don't affect standard channel execution.
+	// If the maximum version is less than the minimum version, the test will be skipped.
+	MaxGwApiVersion map[GwApiChannel]*GwApiVersion
+```
+
+`MinGwApiChannel` is a typed string with the value of `experimental` or `standard`, and will define the minimum version of the API needed to run the test for the channel. If the current installation is now greater or equal to the required version, the test will be skipped. If no `MinGwApiChannel` value is defined, the test will run on any version of the API. The exception to this logic is if the standard channel is installed and the `MinGwApiVersion` for the TestCase only defines an experimental minimum version, for example:
+
+```
+    MinGwApiVersion: map[base.GwApiChannel]*semver.Version{
+        base.GwApiChannelExperimental: base.GwApiV1_3_0,
+    },
+```
+
+This will be interpreted as "the test needs to use features available in experimental API v1.4.0; these features are not yet available in the standard channel". In this case, the test will be skipped for all standard channel versions.
+
+`GwApiVersion` is a wrapper around the underlying semver packages used, and was created in order to allow test suites to use semver types without having to know about the underlying implementation.
+
+
+### Test Suites
+
+
+#### SetupByVersion
+A common pattern used in our e2e tests is to setup a Gateway and possibly other resources during suite setup and using them for every test. This pattern allows the tests to run faster, as time is not spent deploying and removing Gateways. In the [BaseTestingSuite](https://github.com/kgateway-dev/kgateway/blob/2b04f3d1465257d0c449687922ea6e92603b822c/test/kubernetes/e2e/tests/base/base_suite.go#L49C1-L66C2), these resources are defined by the [Setup](https://github.com/kgateway-dev/kgateway/blob/2b04f3d1465257d0c449687922ea6e92603b822c/test/kubernetes/e2e/tests/base/base_suite.go#L53) field
+
+However, once we allow tests to run for different versions of the API, we are no longer in a "one configuration fits all" situation. For example, using ListenerSets requires `allowedListeners` to be defined on the Gateway, but this field will cause the resource to be rejected when using older versions of the API.
+
+To accommodate this, we will add a new field `SetupByVersion` to the BaseTestingSuite:
+```
+	// SetupByVersion allows defining different setup configurations for different GW API versions and channels.
+	// The outer map key is the channel (standard or experimental).
+	// The inner map key is the minimum version, and the value is the TestCase to use.
+	// The system will select the setup with the highest matching version for the current channel.
+	// If no setups match, falls back to the Setup field for backward compatibility.
+	// Example:
+	//   SetupByVersion: map[GwApiChannel]map[*semver.Version]*TestCase{
+	//     GwApiChannelExperimental: {
+	//       GwApiV1_3_0: &setupExperimentalV1_3,
+	//     },
+	//     GwApiChannelStandard: {
+	//       GwApiV1_3_0: &setupStandardV1_4,
+	//     },
+	//   }
+	SetupByVersion map[GwApiChannel]map[*semver.Version]*TestCase
+```
+
+When choosing which setup to use, the suite will use the highest defined semver for the channel that is less than or equal to the current version, falling back to the existing `Setup` if there is no such version.
+
+There are other data structures that could be used to store the setup information, but this approach was chosen because by making channel and version keys for the map, we guarantee that it will be unambiguous which setup to use.
+
+#### MinGwApiVersion
+
+`MinGwApiVersion` has also been added at the suite level to allow entire suites to be skipped.
+
+This is used for the cases where all the tests in a suite require configuration not available in all Gw API versions, and it was introduced because test suites apply their setup before running (or skipping) the individual test cases. In these cases, the suite may run its setup with resources incompatible with the installed version of the Gw API, and we would not want to restore those resources.
+
+### DevX
+* This approach requires no changes for tests and suites that aren't version sensitive
+* If a test needs to be skipped on certain versions, it can configured on the test case
+* If a suite requires different setups/gateways based on version, once the setup is configured additional test cases just need to be congfigured with the versions they run on.
+
+
+### Test Plan
+Successful runs of a GitHub job across versions v1.2-1.4 in both channels.
+
+Tests and suites will be adapted to older versions in 2 ways:
+* If a test requires a feature (like XListenerSets or rule names in HTTPRoutes), those tests will be skipped.
+* Some tests will fail because the suite setup or test resources have invalid config for a Gw API version, but the test itself does not. For example, a Gateway for the suite may be configured with `allowedListeners`, but only some tests use listenersets. In this case we will split the resources and use a combination of SetupForVersion and MinGwApiVersion to apply the appropriate config and run the appropriate tests for the Gw API version.
+
+## Alternatives
+Do not test other versions of the API.
+
+## Open Questions
+* Should we be able to set minimum version at the suite level? EG, for the listenerset suite, when we know that no tests in the suite will run?
diff --git a/devel/testing/nightly-tests.md b/devel/testing/nightly-tests.md
@@ -5,3 +5,7 @@ The following are run on a schedule via a [GitHub action](/.github/workflows/nig
 ## Gateway API conformance tests
 Kubernetes Gateway API conformance tests are run using the earliest and latest supported k8s versions.
 
+## Gateway Load Tests
+Kubernetes Gateway load tests are run using the earliest and latest supported k8s versions.
+
+## E2E tests with different Gateway API versions
diff --git a/go.mod b/go.mod
@@ -180,7 +180,7 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect

diff --git a/hack/utils/oss_compliance/osa_provided.md b/hack/utils/oss_compliance/osa_provided.md
@@ -1,6 +1,7 @@
 Name|Version|License
 ---|---|---
 [cel.dev/expr](https://cel.dev/expr)|v0.24.0|Apache License 2.0
+[semver/v3](https://github.com/Masterminds/semver)|v3.4.0|MIT License
 [agentgateway/agentgateway](https://github.com/agentgateway/agentgateway)|v0.10.3|Apache License 2.0
 [anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)|v1.13.0|MIT License
 [retry-go/v4](https://github.com/avast/retry-go)|v4.3.3|MIT License

diff --git a/internal/kgateway/agentgatewaysyncer/agentgateway_testutils.go b/internal/kgateway/agentgatewaysyncer/agentgateway_testutils.go
@@ -475,7 +475,7 @@ func (tc TestCase) Run(
 	}
 
 	for _, file := range tc.InputFiles {
-		objs, err := testutils.LoadFromFiles(file, scheme, gvkToStructuralSchema)
+		objs, err := testutils.LoadFromFiles(file, scheme, gvkToStructuralSchema, "")
 		if err != nil {
 			return ActualTestResult{}, err
 		}

diff --git a/pkg/utils/kubeutils/kubectl/cli.go b/pkg/utils/kubeutils/kubectl/cli.go
@@ -440,3 +440,20 @@ func (c *Cli) GetLeaseHolder(ctx context.Context, namespace string, leaderElecti
 	stdout = strings.Trim(stdout, "'")
 	return stdout + stderr, err
 }
+
+// GetDefaultNamespace returns the default namespace configured in the current kubectl context.
+// If no namespace is configured, it returns "default".
+func (c *Cli) GetDefaultNamespace(ctx context.Context) (string, error) {
+	stdout, _, err := c.Execute(ctx, "config", "view", "--minify", "--output", "jsonpath={..namespace}")
+	if err != nil {
+		return "", err
+	}
+
+	namespace := strings.TrimSpace(stdout)
+	if namespace == "" {
+		// If no namespace is configured in context, kubectl uses "default"
+		return "default", nil
+	}
+
+	return namespace, nil
+}
diff --git a/test/deployer/deployer_helm.go b/test/deployer/deployer_helm.go
@@ -76,7 +76,7 @@ func (dt DeployerTester) RunHelmChartTest(
 	gvkToStructuralSchema, err := testutils.GetStructuralSchemas(crdDir)
 	assert.NoError(t, err, "error getting structural schemas")
 
-	objs, err := testutils.LoadFromFiles(inputFile, scheme, gvkToStructuralSchema)
+	objs, err := testutils.LoadFromFiles(inputFile, scheme, gvkToStructuralSchema, "")
 	assert.NoError(t, err, "error loading files from input file")
 
 	commonObjs, gtw := ExtractCommonObjs(t, objs)

diff --git a/test/e2e/features/agentgateway/README.md b/test/e2e/features/agentgateway/README.md
@@ -2,14 +2,8 @@
 
 ## Setup
 
-To use the agentgateway control plane with kgateway, you need to enable the integration in the helm chart via 
-`--set agentgateway.enabled=true` or in the values.yaml:
-```yaml
-agentgateway:
-  enabled: true # set this to true
-```
+The agentgateway control plane is automatically enabled when installing kgateway.
 
-This is done automatically by the agentgateway e2e suite. 
 
 ## Testing with an unreleased agentgateway commit 
 

diff --git a/test/e2e/features/agentgateway/aibackend/suite.go b/test/e2e/features/agentgateway/aibackend/suite.go
@@ -78,8 +78,11 @@ type testingSuite struct {
 }
 
 func NewTestingSuite(ctx context.Context, testInst *e2e.TestInstallation) suite.TestingSuite {
+	// This suite applies TrafficPolicy to specific named sections of the HTTPRoute, and requires HTTPRoutes.spec.rules[].name to be present in the Gateway API version.
 	return &testingSuite{
-		base.NewBaseTestingSuite(ctx, testInst, setup, testCases),
+		BaseTestingSuite: base.NewBaseTestingSuite(ctx, testInst, setup, testCases,
+			base.WithMinGwApiVersion(base.GwApiRequireRouteNames),
+		),
 	}
 }
 

diff --git a/test/e2e/features/agentgateway/rbac/testdata/cel-rbac.yaml b/test/e2e/features/agentgateway/rbac/testdata/cel-rbac.yaml
@@ -29,7 +29,6 @@ spec:
           name: httpbin
           port: 8000
           weight: 1
-      name: httpbin-get
       matches:
         - path:
             type: PathPrefix

diff --git a/test/e2e/features/agentgateway/suite.go b/test/e2e/features/agentgateway/suite.go
@@ -27,8 +27,9 @@ type testingSuite struct {
 }
 
 func NewTestingSuite(ctx context.Context, testInst *e2e.TestInstallation) suite.TestingSuite {
+	// This suite applies TrafficPolicy to specific named sections of the HTTPRoute, and requires HTTPRoutes.spec.rules[].name to be present in the Gateway API version.
 	return &testingSuite{
-		base.NewBaseTestingSuite(ctx, testInst, base.TestCase{}, testCases),
+		BaseTestingSuite: base.NewBaseTestingSuite(ctx, testInst, base.TestCase{}, testCases, base.WithMinGwApiVersion(base.GwApiRequireRouteNames)),
 	}
 }
 

diff --git a/test/e2e/features/agentgateway/types.go b/test/e2e/features/agentgateway/types.go
@@ -39,6 +39,9 @@ var (
 		},
 		"TestAgentgatewayTCPRoute": {
 			Manifests: []string{defaults.CurlPodManifest, tcpRouteManifest},
+			MinGwApiVersion: map[base.GwApiChannel]*base.GwApiVersion{
+				base.GwApiChannelExperimental: &base.GwApiAny, // TCPRoutes are experimental only
+			},
 		},
 	}
 )