Add end-to-end coverage for HTTPS and WebSocket egress - #1634
Open
Adhita Selvaraj (swiftdiaries) wants to merge 2 commits into
Open
Add end-to-end coverage for HTTPS and WebSocket egress#1634Adhita Selvaraj (swiftdiaries) wants to merge 2 commits into
Adhita Selvaraj (swiftdiaries) wants to merge 2 commits into
Conversation
Contributor
Author
|
/assign haiyanmeng |
|
|
||
| // TestActorEgressHTTPSNonStandardPort verifies HTTP/1.1 inside TLS while | ||
| // preserving the original destination port through the egress tunnel. | ||
| func TestActorEgressHTTPSNonStandardPort(t *testing.T) { |
Contributor
Author
There was a problem hiding this comment.
review note: this is the only major file where we have the test cases that were asked for. others are all test setup code.
test case 1: Actor connects to 8443, verifies TLS, uses HTTP/1.1, and receives the expected response.
| assertProtocolGateway(t, ctx, since, actorName, target.Address()) | ||
| } | ||
|
|
||
| func TestActorEgressWebSocket(t *testing.T) { |
Contributor
Author
There was a problem hiding this comment.
review note:
- test case 2: Actor sends an HTTP/1.1 upgrade request on 80, receives 101 Switching Protocols, then exchanges three text messages.
| assertWebSocketExchange(t, got, messages, false) | ||
| } | ||
|
|
||
| func TestActorEgressSecureWebSocket(t *testing.T) { |
Contributor
Author
There was a problem hiding this comment.
review note:
- test case 3: Actor establishes verified TLS on 443, performs the HTTP/1.1 upgrade inside TLS, receives 101, then exchanges three text messages.
| // assertWebSocketExchange checks the outbound handshake and every reply on | ||
| // the same connection. want lists the sent messages in order; wantTLS states | ||
| // whether the actor must have verified the origin certificate. | ||
| func assertWebSocketExchange(t *testing.T, got egressWebSocketResponse, want []string, wantTLS bool) { |
Contributor
Author
There was a problem hiding this comment.
review note: equivalent for assertProtocolGateway
Contributor
Author
|
The test setup part ended up being bigger than I would have liked. Please let me know if there's something that I can trim down or reuse. I'm re-checking for this myself as well. |
haiyanmeng
self-requested a review
September 13, 2026 14:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1017
PR Description
Adds actor egress coverage for HTTPS/1.1 on port 8443, HTTP upgrade to WebSocket, and HTTPS upgrade to WebSocket. Each test owns its actor and origin, checks the negotiated protocol and verified TLS where applicable, and matches the gateway destination and actor SPIFFE identity. WebSocket cases also verify three ordered text echoes after the 101 upgrade.
Extends the egress demo and test origins with request-scoped CA trust, TLS and WebSocket support, plus Service IP allocation and endpoint readiness helpers. No product behavior changes are included.
Validation
make verify:metricsandspellcheckwasn't run