Skip to content

conformance: add Zentinel v0.6.1 report for Gateway API v1.4.1 #4711

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
raffaelschneider wants to merge 1 commit into
base: main
Choose a base branch
from
+44 −0
Open

conformance: add Zentinel v0.6.1 report for Gateway API v1.4.1 #4711

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions conformance/reports/v1.4.1/zentinelproxy-zentinel/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Zentinel

[Zentinel](https://github.com/zentinelproxy/zentinel) is a security-first reverse proxy built on Cloudflare's Pingora framework. It emphasizes predictability, transparency, and operational simplicity.

## Table of Contents

| API channel | Implementation version | Mode | Report |
|-------------|-------------------------------------------------------------------------------|---------|----------------------------------------------------------------|
| standard | [v0.6.1](https://github.com/zentinelproxy/zentinel/releases/tag/v0.6.1) | default | [v0.6.1 report](./standard-v0.6.1-default-report.yaml) |

## Reproduce

Clone the Zentinel repository and run the conformance test script:

```shell
git clone https://github.com/zentinelproxy/zentinel.git && cd zentinel
./scripts/conformance-test.sh --report
Copy link
Copy Markdown
Contributor

@howardjohn howardjohn Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the fact the test is setting GATEWAY_ADDRESS=127.0.0.1 makes me think the test script is not really passing the tests in good faith and instead just an AI taking the shortest path to getting a green checkmark on the test. Which is not the intention of the conformance program.

Copy link
Copy Markdown
Author

@raffaelschneider raffaelschneider Mar 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GATEWAY_ADDRESS is an env var override only used for kind testing, in production, the controller discovers the address from the proxy Service LoadBalancer IP. The kind cluster maps 127.0.0.1:80 → NodePort 30080 → proxy pod port 8080, so the full data plane path is exercised. This is the same pattern used by other implementations testing on kind (e.g. the conformance suite 's own WaitForGatewayAddress reads from status.addresses). Happy to add a comment in the README clarifying this.

Copy link
Copy Markdown
Author

@raffaelschneider raffaelschneider Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. PR #4687 was opened prematurely. At that point only 31/33 tests passed (HTTPRouteHTTPSListener and HTTPRouteServiceTypes were failing). We closed it and fixed the underlying bugs:

HTTPRouteServiceTypes: The controller had no EndpointSlice watcher, so headless service pod IPs were not picked up when endpoints appeared after the HTTPRoute. Also missing RBAC for discovery.k8s.io/endpointslices.

HTTPRouteHTTPSListener: Multiple issues. Pingora's TLS stack did not support dynamic cert resolution (we added TlsSettings::from_server_config() to our fork), the translator was dropping HTTPS listeners sharing a port instead of merging SNI certs, the KDL config writer was not emitting SNI blocks, and wildcard listeners (no hostname) incorrectly filtered route hostnames.

The fixes span the gateway controller, proxy, Helm RBAC, and our Pingora fork. All are on main. You are right that the v0.6.1 tag is missing, we will push it before this merges.

```

Prerequisites: Docker, kind, kubectl, helm, Go 1.22+.

The script creates a kind cluster, builds the gateway controller and proxy images, installs Gateway API CRDs (v1.4.1), deploys Zentinel via Helm, and runs the official conformance suite. The report is written to `conformance/reports/standard-v0.6.1-default-report.yaml`.
22 changes: 22 additions & 0 deletions conformance/reports/v1.4.1/zentinelproxy-zentinel/standard-v0.6.1-default-report.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: gateway.networking.k8s.io/v1
date: "2026-03-21T06:37:35-07:00"
gatewayAPIChannel: standard
gatewayAPIVersion: v1.4.1
implementation:
contact:
- '@zentinelproxy'
organization: zentinelproxy
project: zentinel
url: https://github.com/zentinelproxy/zentinel
version: 0.6.1
Copy link
Copy Markdown
Member

@snorwin snorwin Mar 30, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@raffaelschneider can you please explain how the tag v0.6.1 (which by the way does not even exist on your repo) now passes all tests when it was failing many of them in #4687?

kind: ConformanceReport
mode: default
profiles:
- core:
result: success
statistics:
Failed: 0
Passed: 33
Skipped: 0
name: GATEWAY-HTTP
summary: Core tests succeeded.