Gateway API conformance suite implementation.

Makefile

@@ -85,6 +85,18 @@ test-e2e: chainsaw
 		--cluster nso-standard=$(TMPDIR)/.kind-nso-standard.yaml \
 		--cluster nso-infra=$(TMPDIR)/.kind-nso-infra.yaml
 
+GATEWAY_CONFORMANCE_CLASS ?= gateway-conformance
+GATEWAY_CONFORMANCE_FLAGS ?=
+
+## TODO(jreese) add a recipe to clone the envoy gateway repo so we can use
+## `make kube-install-examples-image CLUSTER_NAME=nso-infra` to build and load
+## images into the infra cluster for the e2e tests
+.PHONY: test-conformance
+test-conformance:
+	go test ./test/conformance/gatewayapi -tags=conformance,e2e -count=1 -v \
+		--infra-kubeconfig $(TMPDIR)/.kind-nso-infra.yaml \
+		--gateway-class=$(GATEWAY_CONFORMANCE_CLASS) $(GATEWAY_CONFORMANCE_FLAGS)
+
 .PHONY: lint
 lint: golangci-lint ## Run golangci-lint linter
 	$(GOLANGCI_LINT) run

cmd/main.go

@@ -255,7 +255,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err := networkinggatewayv1webhooks.SetupHTTPRouteWebhookWithManager(mgr); err != nil {
+	if err := networkinggatewayv1webhooks.SetupHTTPRouteWebhookWithManager(mgr, serverConfig); err != nil {
 		setupLog.Error(err, "unable to create webhook", "webhook", "HTTPRoute")
 		os.Exit(1)
 	}

config/dev/downstream_resources/downstream-gateway.yaml

@@ -0,0 +1,110 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: auto-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: auto-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: auto-ca
+  secretName: auto
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: auto-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: auto
+spec:
+  ca:
+    secretName: auto
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: datum-downstream-gateway
+  namespace: datum-downstream-gateway
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        externalTrafficPolicy: Cluster
+        type: NodePort
+        patch:
+          type: StrategicMerge
+          value:
+            spec:
+              trafficDistribution: PreferClose
+              ipFamilyPolicy: RequireDualStack
+              ports:
+                - name: http-80
+                  nodePort: 30080
+                  port: 80
+                - name: https-443
+                  nodePort: 30443
+                  port: 443
+  mergeGateways: true
+  ipFamily: DualStack
+  telemetry:
+    metrics:
+      prometheus:
+        disable: false
+      enableVirtualHostStats: true
+      enablePerEndpointStats: true
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: datum-downstream-gateway
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: datum-downstream-gateway
+    namespace: datum-downstream-gateway
+---
+# If not Gateway is associated with a GatewayClass, the Envoy Gateway controller
+# will not provision the gateway infrastructure. This may become the canary /
+# monitoring endpoint in the future.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: anchor-gateway
+  namespace: datum-downstream-gateway
+spec:
+  gatewayClassName: datum-downstream-gateway
+  listeners:
+  - protocol: HTTP
+    port: 80
+    name: default-http
+    hostname: canary.prism.e2e.env.datum.net
+    allowedRoutes:
+      namespaces:
+        from: All
+  - protocol: HTTPS
+    port: 443
+    name: default-https
+    hostname: canary.prism.e2e.env.datum.net
+    allowedRoutes:
+      namespaces:
+        from: All
+    tls:
+      certificateRefs:
+      - group: ""
+        kind: Secret
+        name: anchor-gateway-default-https
+      mode: Terminate

config/dev/downstream_resources/kustomization.yaml

@@ -0,0 +1,3 @@
+resources:
+  - namespaces.yaml
+  - downstream-gateway.yaml

config/dev/downstream_resources/namespaces.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: datum-downstream-gateway
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: datum-downstream-gateway-hostnames

config/tools/kind/infra-cluster.yaml

@@ -5,3 +5,10 @@ networking:
   ipFamily: dual
 nodes:
 - role: control-plane
+  extraPortMappings:
+  - containerPort: 30080
+    hostPort: 30080
+    protocol: TCP
+  - containerPort: 30443
+    hostPort: 30443
+    protocol: TCP

config/tools/kind/standard-cluster.yaml

@@ -5,10 +5,3 @@ networking:
   ipFamily: dual
 nodes:
 - role: control-plane
-  extraPortMappings:
-  - containerPort: 80
-    hostPort: 10080
-    protocol: TCP
-  - containerPort: 443
-    hostPort: 10443
-    protocol: TCP