From 700b7710a2f76ede341f6308418efee602bfc091 Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Date: Tue, 28 Jul 2026 07:39:02 +0000 Subject: [PATCH] Deflake Envoy AllowPort spec's allowed-port leg MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AllowPort spec fetched https://example.com exactly once, immediately after workload readiness. The allowed leg needs a working DNS -> TLS -> upstream chain through Envoy's dynamic_forward_proxy, and the first egress request after startup can race the isolation stack's own warm-up, failing instantly with a local error before anything reaches the network. Observed twice on 2026-07-28 (PR heads 1588e6a4 and 5c901a9d, within the same minute): IsError ~40ms and ~190ms after readiness — far too fast for genuine external TLS trouble — while the same spec passed on main minutes later. The property this spec pins is steady-state reachability of an allowed port; first-request-after-boot success is not something the DFP path promises. Retry the allowed leg until the deadline, and surface the fetch tool's error text on failure — the diagnostic that distinguishes a warm-up race from a genuinely broken AllowPort, which the old boolean-only assertion discarded. A broken AllowPort still fails, now with evidence. The blocked port-80 leg is unchanged: denial is enforced locally and deterministically once the stack is warm, which the preceding allowed leg has just proven. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GvBj7nNWqDQ3rKYNeY6aam --- test/e2e/network_isolation_envoy_test.go | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/test/e2e/network_isolation_envoy_test.go b/test/e2e/network_isolation_envoy_test.go index eddea95b13..2121934fda 100644 --- a/test/e2e/network_isolation_envoy_test.go +++ b/test/e2e/network_isolation_envoy_test.go @@ -243,9 +243,27 @@ var _ = Describe("NetworkIsolationEnvoy", Label("proxy", "network", "isolation", server := startFetchServer("port", profile) By("HTTPS request (port 443) must succeed") - httpsResult := fetchThrough(server, "https://example.com", 30*time.Second) - Expect(httpsResult.IsError).To(BeFalse(), - "https://example.com must be allowed (port 443 is in AllowPort)") + // The allowed leg needs a working DNS → TLS → example.com chain through + // Envoy's dynamic_forward_proxy. The very first egress request after + // startup can race the isolation stack's own warm-up (DFP DNS cache, + // the per-workload DNS container), failing instantly with a local 503 + // long before anything has actually reached the network — observed in + // CI as an IsError result within ~40ms of readiness. The property this + // spec pins is steady-state reachability of an allowed port, not + // first-request-after-boot success (which Envoy does not promise), so + // retry until the deadline and surface the tool's error text — the one + // diagnostic that distinguishes a warm-up race from a broken AllowPort. + var lastHTTPSError string + Eventually(func() bool { + httpsResult := fetchThrough(server, "https://example.com", 30*time.Second) + if httpsResult.IsError { + lastHTTPSError = resultText(httpsResult) + return false + } + return true + }, 60*time.Second, 2*time.Second).Should(BeTrue(), func() string { + return "https://example.com must be allowed (port 443 is in AllowPort); last fetch error: " + lastHTTPSError + }) By("HTTP request (port 80) must be blocked") httpResult := fetchThrough(server, "http://example.com", 30*time.Second)