Merge remote-tracking branch 'origin/main' into codex/fix-release-workflow

# Conflicts:
#	scripts/ci/ci_assets_test.go
#	test/e2e/smoke/run.sh

Author: mahmut-Abi

deploy/README.md

@@ -145,10 +145,11 @@ The two most important dynamic Services currently are:
 
 Notes:
 
-- `nantian-gw-dataplane` is the shared frontend entry; current Kind smoke defaults to using it.
+- `nantian-gw-dataplane` is the shared frontend entry, mainly useful for shared-node exposure patterns such as Kind NodePort access.
 - `nantian-gw-<gatewayName>` is a dedicated Service derived from the Gateway name; for example, if the `Gateway` is named `edge`, the corresponding Service is typically `nantian-gw-edge`.
 - per-Gateway Services default to `ClusterIP`, but can be lowered to `NodePort` or `LoadBalancer` via `Gateway.spec.infrastructure.parametersRef`, making them the more natural north-south exposure point in long-term environments.
 - These objects are maintained by the control plane reconcile loop and are not static install assets from `deploy/kubernetes/base/`.
+- Because these derived frontend Services are backed by controller-managed EndpointSlices rather than a pod selector, `kubectl port-forward service/...` is not the right validation path for smoke tests; use real Service traffic from inside the cluster or a normal client entry point instead.
 
 ## Traffic Entry Relationships
 
@@ -179,7 +180,8 @@ The most easily confused aspect of the current repository is that the entries se
 
 | Scenario | Default Entry | Notes |
 | --- | --- | --- |
-| Kind / smoke | `nantian-gw-dataplane` | Shared dataplane Service uses `NodePort`; Kind overlay maps HTTP `18080`, HTTPS/TLS `18443`, UDP `5300` / `5301`, TCPRoute `19000` / `19001` by default |
+| Kind shared-node access | `nantian-gw-dataplane` | Shared dataplane Service uses `NodePort`; Kind overlay maps HTTP `18080`, HTTPS/TLS `18443`, UDP `5300` / `5301`, TCPRoute `19000` / `19001` by default |
+| Smoke validation | `nantian-gw-<gatewayName>` | Current smoke validates the derived per-Gateway Service from inside the cluster so selectorless frontend Services are exercised through normal Service routing |
 | Long-term / production | `nantian-gw-<gatewayName>` | Better to expose per Gateway individually, then control `ClusterIP` / `NodePort` / `LoadBalancer` via `parametersRef` |
 
 So if you see locally:

internal/grpcserver/snapshot_projection.go

@@ -157,7 +157,7 @@ func projectListeners(listeners []ir.Listener, snapshot *ir.Snapshot) []ir.Liste
 				attachedRoutes = append(attachedRoutes, routeKey)
 			}
 		}
-		if len(attachedRoutes) == 0 {
+		if len(attachedRoutes) == 0 && !isGatewayProjectedListener(listener) {
 			continue
 		}
 		listener.AttachedRoutes = attachedRoutes
@@ -166,6 +166,13 @@ func projectListeners(listeners []ir.Listener, snapshot *ir.Snapshot) []ir.Liste
 	return out
 }
 
+func isGatewayProjectedListener(listener ir.Listener) bool {
+	if listener.Metadata == nil {
+		return false
+	}
+	return listener.Metadata["gateway"] != "" && listener.Metadata["namespace"] != ""
+}
+
 func filterBackendRefs(routeNamespace string, refs []ir.BackendRef, survivingBackends map[string]struct{}) []ir.BackendRef {
 	out := make([]ir.BackendRef, 0, len(refs))
 	for _, ref := range refs {

internal/grpcserver/snapshot_projection_test.go

@@ -135,6 +135,44 @@ func TestProjectedSnapshotFullProfilePreservesAIServiceTokenPolicyWasmAndLabels(
 	}
 }
 
+func TestProjectedSnapshotPreservesListenerWhenAllAttachedRoutesArePruned(t *testing.T) {
+	t.Parallel()
+
+	projected := buildProjectedProtoSnapshot(
+		&ir.Snapshot{
+			Listeners: []ir.Listener{{
+				Name:           "listener-empty-after-projection",
+				Address:        "0.0.0.0",
+				Port:           80,
+				Protocol:       "HTTP",
+				AttachedRoutes: []string{"default/http-missing"},
+				Metadata: map[string]string{
+					"gateway":   "edge",
+					"namespace": "default",
+				},
+			}},
+			HTTPRoutes: []ir.HTTPRoute{{
+				Name:      "http-missing",
+				Namespace: "default",
+				Rules: []ir.HTTPRule{{
+					BackendRefs: []ir.BackendRef{{
+						Name:      "missing-backend",
+						Namespace: "default",
+						Port:      8080,
+					}},
+				}},
+			}},
+		},
+		effectiveProjectionProfile([]string{featureCoreV1}),
+		slog.New(slog.NewTextHandler(io.Discard, nil)),
+	)
+
+	listener := findProjectedListener(t, projected, "listener-empty-after-projection")
+	if got := listener.GetAttachedRoutes(); len(got) != 0 {
+		t.Fatalf("attached routes = %#v, want empty list", got)
+	}
+}
+
 func projectionTestSnapshot() *ir.Snapshot {
 	return &ir.Snapshot{
 		ID:          "projection-snapshot",

scripts/ci/ci_assets_test.go

@@ -252,14 +252,18 @@ func TestCollectKindDiagnosticsCapturesFrontendTopology(t *testing.T) {
 	}
 }
 
-func TestSmokeScriptForwardsToProgrammedGatewayListener(t *testing.T) {
+func TestSmokeScriptProbesDerivedGatewayServiceFromInsideCluster(t *testing.T) {
 	contents := string(readFile(t, repoPath("test", "e2e", "smoke", "run.sh")))
 
 	for _, want := range []string{
-		`GATEWAY_HOST="${GATEWAY_HOST:-127.0.0.1}"`,
-		`GATEWAY_HTTP_PORT="${GATEWAY_HTTP_PORT:-80}"`,
-		`wait_for_gateway_programmed`,
-		`http://${GATEWAY_HOST}:${GATEWAY_HTTP_PORT}/echo`,
+		`GATEWAY_SERVICE="nantian-gw-$GATEWAY_NAME"`,
+		`SMOKE_CLIENT_POD="smoke-client"`,
+		`SMOKE_URL="http://${GATEWAY_SERVICE}.${CONTROL_PLANE_NS}.svc.cluster.local/echo"`,
+		`kubectl get service -n "$CONTROL_PLANE_NS" "$GATEWAY_SERVICE"`,
+		`kubectl get endpointslice -n "$CONTROL_PLANE_NS"`,
+		`kubernetes.io/service-name=$GATEWAY_SERVICE`,
+		`wget -q -T "$request_timeout" -O - "$SMOKE_URL"`,
+		`last_request_error`,
 		`request_deadline=`,
 	} {
 		if !strings.Contains(contents, want) {
@@ -268,16 +272,15 @@ func TestSmokeScriptForwardsToProgrammedGatewayListener(t *testing.T) {
 	}
 
 	for _, unwanted := range []string{
-		`LOCAL_HTTP_PORT="${LOCAL_HTTP_PORT:-10080}"`,
-		`service/$DATA_PLANE_SVC`,
 		`kubectl port-forward`,
+		`service/$DATA_PLANE_SVC`,
 		`pod/$dataplane_pod`,
 		`dataplane_pod=$(kubectl get pod`,
-		`port-forward to $dataplane_pod exited before request succeeded`,
-		`10080:10080`,
+		`curl -s -o /dev/null -w "%{http_code}"`,
+		`wget -q -O - "$SMOKE_URL" >/dev/null 2>&1`,
 	} {
 		if strings.Contains(contents, unwanted) {
-			t.Fatalf("smoke script still contains stale pod-forward pattern %q", unwanted)
+			t.Fatalf("smoke script still contains stale host-probe pattern %q", unwanted)
 		}
 	}
 }
@@ -295,6 +298,7 @@ func TestCIEntrypointsUseCurrentDeployResourceNames(t *testing.T) {
 	for _, want := range []string{
 		`GATEWAY_CLASS_NAME="${GATEWAY_CLASS_NAME:-nantian-gw}"`,
 		`CONTROL_PLANE_DEPLOYMENT="nantian-gw-controlplane"`,
+		`DATA_PLANE_SELECTOR="app=nantian-gw-dataplane"`,
 		`gatewayClassName: $GATEWAY_CLASS_NAME`,
 	} {
 		if !strings.Contains(smokeScript, want) {

test/e2e/smoke/run.sh

@@ -10,9 +10,14 @@ CLUSTER_NAME="${CLUSTER_NAME:-nantian-e2e}"
 CONTROL_PLANE_NS="nantian-gw"
 TEST_NS="nantian-e2e"
 CONTROL_PLANE_DEPLOYMENT="nantian-gw-controlplane"
+DATA_PLANE_SELECTOR="app=nantian-gw-dataplane"
 GATEWAY_CLASS_NAME="${GATEWAY_CLASS_NAME:-nantian-gw}"
-GATEWAY_HOST="${GATEWAY_HOST:-127.0.0.1}"
-GATEWAY_HTTP_PORT="${GATEWAY_HTTP_PORT:-80}"
+GATEWAY_NAME="${GATEWAY_NAME:-nantian-gw}"
+GATEWAY_SERVICE="nantian-gw-$GATEWAY_NAME"
+SMOKE_CLIENT_POD="smoke-client"
+SMOKE_CLIENT_IMAGE="${SMOKE_CLIENT_IMAGE:-docker.io/busybox:1.36.1}"
+SMOKE_URL="http://${GATEWAY_SERVICE}.${CONTROL_PLANE_NS}.svc.cluster.local/echo"
+ECHO_PORT=8080
 TIMEOUT="${TIMEOUT:-180}"
 KIND_CONFIG="${KIND_CONFIG:-$GATEWAY_ROOT/scripts/ci/kind-ci-config.yaml}"
 CLEANUP="true"
@@ -143,7 +148,7 @@ create_gateway() {
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
-  name: nantian-gw
+  name: $GATEWAY_NAME
 spec:
   gatewayClassName: $GATEWAY_CLASS_NAME
   listeners:
@@ -190,7 +195,7 @@ metadata:
   name: echo
 spec:
   parentRefs:
-  - name: nantian-gw
+  - name: $GATEWAY_NAME
   rules:
   - matches:
     - path:
@@ -207,53 +212,101 @@ YAML
     green "  HTTPRoute created"
 }
 
-wait_for_gateway_programmed() {
-    local gateway_name="${1:-nantian-gw}"
+ensure_smoke_client() {
+    kubectl apply -n "$TEST_NS" -f - <<YAML
+apiVersion: v1
+kind: Pod
+metadata:
+  name: $SMOKE_CLIENT_POD
+spec:
+  restartPolicy: Always
+  containers:
+  - name: client
+    image: $SMOKE_CLIENT_IMAGE
+    command:
+    - sh
+    - -c
+    - sleep 3600
+YAML
 
-    echo "=== Waiting for Gateway ${gateway_name} to be Programmed ==="
-    local request_deadline=$((SECONDS + TIMEOUT))
-    while (( SECONDS < request_deadline )); do
-        local programmed
-        programmed="$(
-            kubectl get gateway "$gateway_name" -n "$CONTROL_PLANE_NS" \
-                -o jsonpath='{.status.conditions[?(@.type=="Programmed")].status}' 2>/dev/null || true
-        )"
-        if [[ "$programmed" == "True" ]]; then
-            green "  Gateway ${gateway_name} is Programmed"
+    kubectl wait --for=condition=ready pod/$SMOKE_CLIENT_POD -n "$TEST_NS" --timeout="${TIMEOUT}s"
+}
+
+gateway_service_exists() {
+    kubectl get service -n "$CONTROL_PLANE_NS" "$GATEWAY_SERVICE" >/dev/null 2>&1
+}
+
+gateway_frontend_endpoints_ready() {
+    kubectl get endpointslice -n "$CONTROL_PLANE_NS" \
+        -l "kubernetes.io/service-name=$GATEWAY_SERVICE" \
+        -o jsonpath='{range .items[*].endpoints[*]}{range .addresses[*]}{.}{" "}{end}{.conditions.ready}{"\n"}{end}' \
+        2>/dev/null \
+        | awk 'NF >= 1 && $NF != "false" {found=1} END {exit(found ? 0 : 1)}'
+}
+
+wait_for_gateway_frontend_endpoints() {
+    local deadline="$1"
+
+    while (( SECONDS < deadline )); do
+        if ! gateway_service_exists; then
+            sleep 2
+            continue
+        fi
+
+        if gateway_frontend_endpoints_ready; then
             return 0
         fi
+
         sleep 2
     done
 
-    fail "Gateway ${gateway_name} did not become Programmed=True within ${TIMEOUT}s"
     return 1
 }
 
-# ── Step 6: send request through the Kind host port entry ──
+# ── Step 6: probe the derived Gateway Service from inside the cluster ──
 send_request() {
-    local endpoint="http://${GATEWAY_HOST}:${GATEWAY_HTTP_PORT}/echo"
+    echo "=== Sending test request via derived Gateway Service ($SMOKE_URL) ==="
+
+    ensure_smoke_client
 
-    echo "=== Sending test request (${endpoint}) ==="
     local request_deadline=$((SECONDS + TIMEOUT))
-    local response="000"
+    local request_timeout="${SMOKE_REQUEST_TIMEOUT_SEC:-5}"
+    local last_request_error=""
+    local output=""
+
+    if ! wait_for_gateway_frontend_endpoints "$request_deadline"; then
+        if ! gateway_service_exists; then
+            fail "derived Gateway Service $GATEWAY_SERVICE was not created within ${TIMEOUT}s"
+            return 1
+        fi
+
+        fail "derived Gateway Service $GATEWAY_SERVICE did not expose ready frontend endpoints within ${TIMEOUT}s"
+        return 1
+    fi
+
     while (( SECONDS < request_deadline )); do
-        response=$(curl -s -o /dev/null -w "%{http_code}" "$endpoint" 2>/dev/null || echo "000")
-        if [[ "$response" == "200" ]]; then
-            green "  PASS: GET /echo -> HTTP $response"
+        if output="$(kubectl exec -n "$TEST_NS" "$SMOKE_CLIENT_POD" -- \
+            wget -q -T "$request_timeout" -O - "$SMOKE_URL" 2>&1)"; then
+            green "  PASS: GET /echo via $GATEWAY_SERVICE -> HTTP 200"
             return 0
         fi
 
+        last_request_error="$output"
         sleep 2
     done
 
-    fail "GET /echo via ${endpoint} -> HTTP $response (expected 200 within ${TIMEOUT}s)"
+    local detail=""
+    if [[ -n "$last_request_error" ]]; then
+        detail=$'\nlast request error: '"$last_request_error"
+    fi
+
+    fail "GET /echo via $GATEWAY_SERVICE did not succeed within ${TIMEOUT}s${detail}"
     return 1
 }
 
 # ── Main ──
 main() {
-    trap 'FAILED=true' ERR
-    trap 'cleanup_cluster; if $FAILED; then red "✗ Smoke test FAILED"; else green "✓ Smoke test PASSED"; fi' EXIT
+    trap 'exit_code=$?; if [[ "$exit_code" -ne 0 ]]; then FAILED=true; fi; cleanup_cluster; if $FAILED; then red "✗ Smoke test FAILED"; else green "✓ Smoke test PASSED"; fi; exit "$exit_code"' EXIT
 
     if [[ "$BOOTSTRAP" == "true" ]]; then
         ensure_cluster
@@ -264,7 +317,6 @@ main() {
     create_gateway
     create_reference_grant
     create_route
-    wait_for_gateway_programmed
     send_request
 }