add authz and ipsec E2E test #1489

xiaojiangao123 · 2025-08-17T13:25:04Z

What type of PR is this?

/kind security

What this PR does / why we need it:

add E2E test cases for ip, port, namespace authz and ipsec feature

What this PR fix:
Fixes #1408

gemini-code-assist

Summary of Changes

Hello @xiaojiangao123, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces new end-to-end (E2E) test cases to validate the authorization functionality within Kmesh. Specifically, these tests cover policies based on IP addresses, network ports, and namespaces. The primary impact is to enhance the robustness and reliability of Kmesh's security authorization features, particularly when these policies are offloaded to XDP (eXpress Data Path) eBPF programs.

Highlights

New E2E Tests: Added comprehensive end-to-end (E2E) tests for Kmesh authorization policies.
IP Authorization Tests: Introduced TestIPAuthorization to verify authorization based on source IP addresses, covering both allow and deny scenarios.
Port Authorization Tests: Implemented TestPortAuthorization to validate authorization rules applied to specific destination ports, including allow and deny cases.
Namespace Authorization Tests: Developed TestNamespaceAuthorization to ensure correct authorization behavior based on the source namespace.
XDP Program Verification: Included a utility function waitForXDPOnDstWorkloads to confirm the loading of XDP eBPF programs on destination workloads, emphasizing the XDP offload aspect of these tests.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Code flows, rules apply,Security holds fast.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds end-to-end tests for L4 authorization features (IP, port, and namespace). The tests are well-structured and cover both ALLOW and DENY policies. I've found one high-severity issue related to a resource leak in the waitForXDPOnDstWorkloads helper function, which I've detailed in a specific comment with a suggested fix. Otherwise, the test logic looks correct.

gemini-code-assist · 2025-08-17T13:26:24Z

test/e2e/authorization_test.go

+func waitForXDPOnDstWorkloads(t framework.TestContext, dst echo.Instances) {
+	count := 0
+	workloads := dst.WorkloadsOrFail(t)
+	namespace := apps.Namespace.Name()
+	for _, client := range workloads {
+		if count == len(workloads) {
+			break
+		}
+		podName := client.PodName()
+		timeout := time.After(5 * time.Second)
+		ticker := time.NewTicker(500 * time.Millisecond)
+		defer ticker.Stop()
+	InnerLoop:
+		for {
+			select {
+			case <-timeout:
+				t.Fatalf("Timeout: XDP eBPF program not found on pod %s", podName)
+			case <-ticker.C:
+				cmd := exec.Command("kubectl", "exec", "-n", namespace, podName, "--", "sh", "-c", "ip a | grep xdp")
+				output, err := cmd.CombinedOutput()
+				if err == nil && len(output) > 0 {
+					t.Logf("XDP program is loaded on pod %s", podName)
+					count++
+					break InnerLoop
+				}
+				t.Logf("Waiting for XDP program to load on pod %s: %v", podName, err)
+			}
+		}
+	}
+}


The current implementation of waitForXDPOnDstWorkloads has a resource leak. The defer ticker.Stop() is inside a for loop, which means that tickers are not stopped until the function returns. For a destination with N workloads, N-1 tickers will be leaked until the function exits. This can lead to resource exhaustion.

Additionally, the count variable and the check if count == len(workloads) are redundant and can be removed to simplify the code.

I suggest refactoring the function to explicitly stop the ticker in each iteration and remove the unnecessary code.

func waitForXDPOnDstWorkloads(t framework.TestContext, dst echo.Instances) { workloads := dst.WorkloadsOrFail(t) namespace := apps.Namespace.Name() for _, client := range workloads { podName := client.PodName() ticker := time.NewTicker(500 * time.Millisecond) timeout := time.After(5 * time.Second) waitLoop: for { select { case <-timeout: ticker.Stop() t.Fatalf("Timeout: XDP eBPF program not found on pod %s", podName) case <-ticker.C: cmd := exec.Command("kubectl", "exec", "-n", namespace, podName, "--", "sh", "-c", "ip a | grep xdp") output, err := cmd.CombinedOutput() if err == nil && len(output) > 0 { t.Logf("XDP program is loaded on pod %s", podName) ticker.Stop() break waitLoop } t.Logf("Waiting for XDP program to load on pod %s: %v", podName, err) } } } }

Copilot

Pull Request Overview

This PR adds comprehensive E2E test cases for authorization features in Kmesh, specifically testing IP-based, port-based, and namespace-based authorization policies. The tests validate that XDP eBPF programs correctly enforce authorization rules at the network layer.

Adds IP authorization tests that verify ALLOW/DENY policies based on source IP addresses
Implements port authorization tests to validate policy enforcement on specific service/pod ports
Introduces namespace authorization tests to ensure proper isolation between namespaces

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-17T13:26:25Z

test/e2e/authorization_test.go

+	for _, client := range workloads {
+		if count == len(workloads) {
+			break
+		}


The condition count == len(workloads) will never be true at this point since count starts at 0 and is only incremented inside the inner loop after this check. This break statement is unreachable and the loop will always process all workloads unnecessarily.

Suggested change

}

Copilot · 2025-08-17T13:26:25Z

test/e2e/authorization_test.go

+			// Enable authorization offload to xdp.
+
+			if len(apps.ServiceWithWaypointAtServiceGranularity) == 0 {
+				t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))


Using t.Fatal(fmt.Errorf(...)) is redundant. Use t.Fatalf(\"need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity\") instead for cleaner error reporting.

Suggested change

t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))

t.Fatalf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity")

Copilot · 2025-08-17T13:26:25Z

test/e2e/authorization_test.go

+
+			addresses := clients.Addresses()
+			if len(addresses) < 2 {
+				t.Fatal(fmt.Errorf("need at least 2 clients"))


Using t.Fatal(fmt.Errorf(...)) is redundant. Use t.Fatalf(\"need at least 2 clients\") instead for cleaner error reporting.

Suggested change

t.Fatal(fmt.Errorf("need at least 2 clients"))

t.Fatalf("need at least 2 clients")

Copilot · 2025-08-17T13:26:26Z

test/e2e/authorization_test.go

+			// Enable authorization offload to XDP.
+
+			if len(apps.ServiceWithWaypointAtServiceGranularity) == 0 {
+				t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))


Using t.Fatal(fmt.Errorf(...)) is redundant. Use t.Fatalf(\"need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity\") instead for cleaner error reporting.

Suggested change

t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))

t.Fatalf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity")

Copilot · 2025-08-17T13:26:26Z

test/e2e/authorization_test.go

+			// Enable authorization offload to XDP.
+
+			if len(apps.ServiceWithWaypointAtServiceGranularity) == 0 {
+				t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))


Using t.Fatal(fmt.Errorf(...)) is redundant. Use t.Fatalf(\"need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity\") instead for cleaner error reporting.

Suggested change

t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))

t.Fatalf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity")

Copilot · 2025-08-17T13:26:26Z

test/e2e/authorization_test.go

+					t.Fatal("invalid action")
+				}
+
+				return check.OK()


The return check.OK() statement after the switch block is unreachable because all switch cases either return a value or call t.Fatal() which terminates execution.

Suggested change

return check.OK()

Copilot · 2025-08-17T13:26:27Z

test/e2e/authorization_test.go

+					t.Fatal("invalid action")
+				}
+
+				return check.OK()


The return check.OK() statement after the switch block is unreachable because all switch cases either return a value or call t.Fatal() which terminates execution.

Suggested change

return check.OK()

Copilot · 2025-08-17T13:26:27Z

test/e2e/authorization_test.go

+					t.Fatal("invalid action")
+				}
+
+				return check.OK()


The return check.OK() statement after the switch block is unreachable because all switch cases either return a value or call t.Fatal() which terminates execution.

Suggested change

return check.OK()

codecov · 2025-08-17T13:46:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.78%. Comparing base (3c861d1) to head (93b6b85).
⚠️ Report is 24 commits behind head on main.
see 1 file with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f4d1eea...93b6b85. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

YaoZengzeng · 2025-09-04T06:23:15Z

@xiaojiangao123 please rebase this PR and make all the CI passed first.

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-25T07:29:27Z

test/e2e/ipsec_test.go

+			time.Sleep(3 * time.Second)
+			continue
+		}
+		// fields[2] 是 pod 状态


Comment is in Chinese. Should be translated to English for consistency: '// fields[2] is the pod status'

Suggested change

// fields[2] 是 pod 状态

// fields[2] is the pod status

Copilot · 2025-09-25T07:29:28Z

deploy/charts/kmesh-helm/templates/kmesh.net_kmeshnodeinfos.yaml

+                  Addresses is used to store the internal ip address informatioon on the
+                  host. The IP address information is used to generate the IPsec state
+                  informatioon. IPsec uses this information to determine which network


Typo in 'informatioon' - should be 'information'

Suggested change

Addresses is used to store the internal ip address informatioon on the

host. The IP address information is used to generate the IPsec state

informatioon. IPsec uses this information to determine which network

Addresses is used to store the internal ip address information on the

host. The IP address information is used to generate the IPsec state

information. IPsec uses this information to determine which network

Copilot · 2025-09-25T07:29:28Z

deploy/charts/kmesh-helm/templates/kmesh.net_kmeshnodeinfos.yaml

+                  Addresses is used to store the internal ip address informatioon on the
+                  host. The IP address information is used to generate the IPsec state
+                  informatioon. IPsec uses this information to determine which network


Typo in 'informatioon' - should be 'information'

Suggested change

Addresses is used to store the internal ip address informatioon on the

host. The IP address information is used to generate the IPsec state

informatioon. IPsec uses this information to determine which network

Addresses is used to store the internal ip address information on the

host. The IP address information is used to generate the IPsec state

information. IPsec uses this information to determine which network

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

test/e2e/ipsec_test.go:1

Typo in comment: 'informatioon' should be 'information'.

//go:build integ

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-25T08:02:50Z

test/e2e/ipsec_test.go

+func checkIPSecRules(t framework.TestContext, containerName string) error {
+	stateCmd := exec.Command("docker", "exec", containerName, "bash", "-c", "ip xfrm state")
+	stateOut, err := stateCmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("failed to run ip xfrm state: %v\n%s", err, string(stateOut))
+		return err
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:51Z

test/e2e/ipsec_test.go

+	policyCmd := exec.Command("docker", "exec", containerName, "bash", "-c", "ip xfrm policy")
+	policyOut, err := policyCmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("failed to run ip xfrm policy: %v\n%s", err, string(policyOut))
+		return err
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:51Z

test/e2e/ipsec_test.go

+	if !strings.Contains(stateStr, "proto esp spi") || !strings.Contains(stateStr, "mode tunnel") {
+		t.Fatalf("ip xfrm state output does not contain expected ESP tunnel rules")
+		return fmt.Errorf("ip xfrm state output does not contain expected ESP tunnel rules")
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:51Z

test/e2e/ipsec_test.go

+	if !strings.Contains(stateStr, "aead rfc4106(gcm(aes))") {
+		t.Fatalf("ip xfrm state output does not contain expected AEAD algorithm")
+		return fmt.Errorf("ip xfrm state output does not contain expected AEAD algorithm")
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:51Z

test/e2e/ipsec_test.go

+	if !strings.Contains(policyStr, "tmpl src") || !strings.Contains(policyStr, "proto esp") || !strings.Contains(policyStr, "mode tunnel") {
+		t.Fatalf("ip xfrm policy output does not contain expected tunnel template")
+		return fmt.Errorf("ip xfrm policy output does not contain expected tunnel template")
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:52Z

test/e2e/ipsec_test.go

+	if !strings.Contains(policyStr, "dir out") || !strings.Contains(policyStr, "dir in") || !strings.Contains(policyStr, "dir fwd") {
+		t.Fatalf("ip xfrm policy output does not contain expected directions (out/in/fwd)")
+		return fmt.Errorf("ip xfrm policy output does not contain expected directions (out/in/fwd)")
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot · 2025-09-25T08:02:52Z

test/e2e/ipsec_test.go

+	if !strings.Contains(policyStr, "mark") {
+		t.Fatalf("ip xfrm policy output does not contain expected mark field")
+		return fmt.Errorf("ip xfrm policy output does not contain expected mark field")
+	}


Unreachable code: the return statement after t.Fatalf() will never execute since t.Fatalf() terminates the test. Either remove the return or replace t.Fatalf() with t.Errorf() if you want to continue execution.

Copilot

Pull Request Overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-25T11:31:18Z

test/e2e/ipsec_test.go

+func genRandomKeyHex() string {
+	b := make([]byte, 36)
+	_, err := rand.Read(b)
+	if err != nil {
+		panic("failed to generate random key")
+	}
+	return hex.EncodeToString(b)
+}


The magic number 36 should be defined as a named constant to improve code readability and maintainability.

Copilot · 2025-09-25T11:31:18Z

test/e2e/authorization_test.go

+			selectedPodPort := 19090
+			selectedServicePort := 9090
+			notSelectedPodPort := 16060
+			notSelectedServicePort := 9091
+
+			// Echo Pod healthy port
+			readyPort := 8080
+			livenessPort := 3333


These port numbers appear to be magic numbers. Consider defining them as constants at the package level or documenting why these specific values are chosen.

Copilot · 2025-09-25T11:31:18Z

test/e2e/ipsec_test.go

+			go func() {
+				out, _ := runTcpdumpESP(t, "kmesh-testing-control-plane", 10)
+				tcpdumpCh <- out
+			}()


The error from runTcpdumpESP is discarded with _. This could mask important failures. The error should be handled or at least logged.

Copilot · 2025-09-25T11:31:19Z

test/e2e/ipsec_test.go

+			t.Logf("Starting tcpdump in kmesh-testing-control-plane container after key rotation...")
+			tcpdumpCh = make(chan string)
+			go func() {
+				out, _ := runTcpdumpESP(t, "kmesh-testing-control-plane", 10)


The error from runTcpdumpESP is discarded with _. This could mask important failures. The error should be handled or at least logged.

Suggested change

out, _ := runTcpdumpESP(t, "kmesh-testing-control-plane", 10)

out, err := runTcpdumpESP(t, "kmesh-testing-control-plane", 10)

if err != nil {

t.Logf("runTcpdumpESP error: %v", err)

}

Copilot · 2025-09-25T11:31:19Z

docs/proposal/ipsec_authz_e2e_test.md

+
+For the Offload Authorization feature, E2E test cases are designed for IP, Port, Header, namespace, and hosts authorization.
+
+The test environment requires at least a 2-node Kubernetes cluster using httpbin and sleep or fortio as test applications.


The word 'informatioon' on line 43 contains a spelling error - it should be 'information'.

Signed-off-by: gaoxiaojian123 <[email protected]>

Signed-off-by: xiaojiangao123 <[email protected]>

YaoZengzeng · 2025-10-30T11:20:09Z

/lgtm

YaoZengzeng · 2025-10-30T11:20:16Z

/approve

kmesh-bot · 2025-10-30T11:20:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: YaoZengzeng

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [YaoZengzeng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings August 17, 2025 13:25

kmesh-bot added the kind/security label Aug 17, 2025

kmesh-bot requested review from YaoZengzeng and lec-bit August 17, 2025 13:25

gemini-code-assist bot reviewed Aug 17, 2025

View reviewed changes

kmesh-bot added the size/L label Aug 17, 2025

gemini-code-assist bot reviewed Aug 17, 2025

View reviewed changes

Copilot AI reviewed Aug 17, 2025

View reviewed changes

kmesh-bot added size/XL and removed size/L labels Aug 18, 2025

xiaojiangao123 changed the title ~~add ip port namespace test~~ add authz E2E test Aug 18, 2025

kmesh-bot added do-not-merge/contains-merge-commits size/XXL and removed size/XL labels Sep 3, 2025

xiaojiangao123 changed the title ~~add authz E2E test~~ add authz and ipsec E2E test Sep 3, 2025

xiaojiangao123 force-pushed the main branch from c455e84 to 73a3a47 Compare September 4, 2025 10:34

kmesh-bot removed the do-not-merge/contains-merge-commits label Sep 4, 2025

xiaojiangao123 mentioned this pull request Sep 5, 2025

[OSPP 2025] E2E of IPsce and offload Authorization #1408

Closed

Copilot AI review requested due to automatic review settings September 25, 2025 07:28

kmesh-bot added the do-not-merge/contains-merge-commits label Sep 25, 2025

Copilot AI reviewed Sep 25, 2025

View reviewed changes

xiaojiangao123 force-pushed the main branch from 9afc8c9 to ffee924 Compare September 25, 2025 07:44

kmesh-bot removed the do-not-merge/contains-merge-commits label Sep 25, 2025

Copilot AI review requested due to automatic review settings September 25, 2025 07:59

Copilot AI reviewed Sep 25, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings September 25, 2025 11:29

xiaojiangao123 force-pushed the main branch from 9457306 to 650db84 Compare September 25, 2025 11:29

Copilot AI reviewed Sep 25, 2025

View reviewed changes

xiaojiangao123 added 22 commits October 30, 2025 17:34

add ip port namespace test

d2ed324

Signed-off-by: gaoxiaojian123 <[email protected]>

test header and host allow

a14abf4

Signed-off-by: gaoxiaojian123 <[email protected]>

fix header and host authz test cases

8bc5f68

Signed-off-by: xiaojiangao123 <[email protected]>

enable ipsec for e2e test

b19aa84

Signed-off-by: xiaojiangao123 <[email protected]>

fix kmeshctl

1c08200

Signed-off-by: xiaojiangao123 <[email protected]>

add ipsec test

6f5f2c7

Signed-off-by: xiaojiangao123 <[email protected]>

check httpbin and sleep pod ready

4fed714

Signed-off-by: xiaojiangao123 <[email protected]>

check ip policy spi

a64254f

Signed-off-by: xiaojiangao123 <[email protected]>

fix ip rules check for ipv6

38d2e80

Signed-off-by: xiaojiangao123 <[email protected]>

fix ipv6 bug in ipsec test

a46c7e9

Signed-off-by: xiaojiangao123 <[email protected]>

create new echo pod for test

9deb864

Signed-off-by: xiaojiangao123 <[email protected]>

add proposal

e15eb4e

Signed-off-by: xiaojiangao123 <[email protected]>

fix proposal typo

6a1692f

Signed-off-by: xiaojiangao123 <[email protected]>

fix test typo

552d7bf

Signed-off-by: xiaojiangao123 <[email protected]>

fix deploy function

c660617

Signed-off-by: xiaojiangao123 <[email protected]>

add secret create

433c9c9

Signed-off-by: xiaojiangao123 <[email protected]>

add ipsec waiting

d3cf855

Signed-off-by: xiaojiangao123 <[email protected]>

split ipsec test

34a4826

Signed-off-by: xiaojiangao123 <[email protected]>

split ipsec test

4fcb513

Signed-off-by: xiaojiangao123 <[email protected]>

fix proposal doc

10f65a6

Signed-off-by: xiaojiangao123 <[email protected]>

delete duplicated case

f5f1c33

Signed-off-by: xiaojiangao123 <[email protected]>

fix note ans import

93b6b85

Signed-off-by: xiaojiangao123 <[email protected]>

xiaojiangao123 force-pushed the main branch from 5d507a7 to 93b6b85 Compare October 30, 2025 09:34

kmesh-bot removed the lgtm label Oct 30, 2025

kmesh-bot added the lgtm label Oct 30, 2025

kmesh-bot added the approved label Oct 30, 2025

kmesh-bot merged commit 1296155 into kmesh-net:main Oct 30, 2025
14 of 15 checks passed

	t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))
	t.Fatalf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity")

	t.Fatal(fmt.Errorf("need at least 2 clients"))
	t.Fatalf("need at least 2 clients")


		For the Offload Authorization feature, E2E test cases are designed for IP, Port, Header, namespace, and hosts authorization.

		The test environment requires at least a 2-node Kubernetes cluster using httpbin and sleep or fortio as test applications.

add authz and ipsec E2E test #1489

add authz and ipsec E2E test #1489

Uh oh!

Conversation

xiaojiangao123 commented Aug 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 17, 2025

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Aug 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

YaoZengzeng commented Sep 4, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

xiaojiangao123 commented Aug 17, 2025 •

edited

Loading

codecov bot commented Aug 17, 2025 •

edited

Loading