Stand up a test environment that mirrors how the edge really runs#226
Closed
scotwells wants to merge 2 commits into
Closed
Stand up a test environment that mirrors how the edge really runs#226scotwells wants to merge 2 commits into
scotwells wants to merge 2 commits into
Conversation
Brings up a two-cluster environment that mirrors how the edge really runs: the production gateway version, the firewall data plane real traffic passes through, and the actual path configuration travels to the edge. Lets tests exercise the route customer traffic takes instead of a simplified stand-in. Test scaffolding only; no change to how the edge runs for customers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JbCy8vy66RdNYzGSgqH6P6
scotwells
force-pushed
the
test/prod-fidelity-test-environment
branch
2 times, most recently
from
June 25, 2026 21:43
a29d679 to
4b21276
Compare
The endpoint that lets the parity test confirm the proxy is running exactly the set the build intended is off by default and served only when asked for. The base deployment reads --enable-programmed-set from the ENABLE_PROGRAMMED_SET env var; flip it to "true" in the downstream edge overlay with a strategic-merge patch on env so the test environment keeps that visibility while production exposes nothing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JbCy8vy66RdNYzGSgqH6P6
scotwells
force-pushed
the
test/prod-fidelity-test-environment
branch
from
June 25, 2026 21:48
4b21276 to
d2e62bf
Compare
This was referenced Jul 10, 2026
This was referenced Jul 13, 2026
ecv
added a commit
that referenced
this pull request
Jul 14, 2026
Add a test-infra:test-e2e task that runs the control-plane e2e suite against the live #226 two-cluster environment, mapping the suite's chainsaw aliases (nso-standard/nso-infra) onto this env's upstream and downstream kubeconfigs at invocation. Bring the hardened suite from main onto this branch and pin the operator image to the env's build. Key changes: - add test-infra:test-e2e task; CLI_ARGS selects a single scenario - pin manager and e2e-downstream image tags to d2e62bf - assert the ClusterIssuer CA Certificate is Ready before gateway steps - carry the listener-hostname-collision, tpp-enforce, and tpp-paranoia-validation scenarios from main
Contributor
|
Superseded by #276 — this env rebased onto |
ecv
added a commit
that referenced
this pull request
Jul 14, 2026
Add a test-infra:test-e2e task that runs the control-plane e2e suite against the live #226 two-cluster environment, mapping the suite's chainsaw aliases (nso-standard/nso-infra) onto this env's upstream and downstream kubeconfigs at invocation. Bring the hardened suite from main onto this branch and pin the operator image to the env's build. Key changes: - add test-infra:test-e2e task; CLI_ARGS selects a single scenario - pin manager and e2e-downstream image tags to d2e62bf - assert the ClusterIssuer CA Certificate is Ready before gateway steps - carry the listener-hostname-collision, tpp-enforce, and tpp-paranoia-validation scenarios from main
Contributor
|
@scotwells permission to close in favor of #276? – also, lets start mergin the stack |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this stands up
Our edge tests have run against a simplified setup that didn't match how the edge actually runs in production. Whole classes of problems — the ones that only appear with the real gateway, the real firewall data plane, and the real path the platform uses to hand configuration to the edge — could never show up in a test.
This brings up a test environment that mirrors the real edge: two clusters wired the way production is, the same gateway version we run in production, the firewall data plane customer traffic actually passes through, and the same delivery path configuration really travels. Tests can now exercise the route real traffic takes, instead of a stand-in for it.
Why it matters
A test is only as trustworthy as how closely it resembles the real thing. Every gap between the test setup and production is a place a bug can hide unseen. Closing that gap is what makes the end-to-end tests built on top of this worth trusting.
Scope
This is test scaffolding — it changes nothing about how the edge runs for customers. It only gives us a faithful place to prove the edge behaves before changes reach them.
Part of #247 — catching silent edge misconfiguration before it reaches customers.
One of a five-PR stack, best reviewed and merged in order: