Add conformance test for isolation of HTTP listeners

[pleshakov]

What type of PR is this? /kind test /area conformance

What this PR does / why we need it:

Listener isolation was clarified in https://github.com/kubernetes-sigs/gateway-api/pull/2465 This PR adds the corresponding extended feature and the conformance test.

The test includes two subtests:

• the one where hostnames are only configured in listeners
• the one where hostnames are configured both in listeners and HTTPRoutes, where HTTPRoutes try to "steal" requests bound to different listeners, but fail to do so because of the listener isolation.

Note: I added only tests for HTTP listeners. I believe the fix for this issue https://github.com/kubernetes-sigs/gateway-api/issues/2417 might define the tests for the isolation for HTTPS listeners - those will also involve setting SNI.

Which issue(s) this PR fixes:

Fixes #2416

Does this PR introduce a user-facing change?:

Adds an extended feature GatewayHTTPListenerIsolation with the corresponding conformance test GatewayHTTPListenerIsolation

[k8s-ci-robot]

Hi @pleshakov. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[robscott]

Thanks @pleshakov! This is going to require some careful review from multiple people.

/cc @arkodg @mlavacca @sunjayBhatia /ok-to-test /hold

[arkodg]

thanks for adding this @pleshakov, your test approach looks good, added a minor non blocking comment

[arkodg]

@sunjayBhatia do you want to take another look at this PR, or should we get this in ?

[robscott]

I've been meaning to take a look at this too, sorry I lost track of it! Will aim to get some feedback in this week.

/assign

[sunjayBhatia]

@sunjayBhatia do you want to take another look at this PR, or should we get this in ?

yep I'll take another look tmr 👍🏽

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arkodg, mlavacca, pleshakov, sunjayBhatia

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~conformance/OWNERS~~ [arkodg,mlavacca,sunjayBhatia]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[arkodg]

@robscott I'd love to see this one into v1.1, this conformance test will benefit a lot of implementations and not supporting this is lapse in security, to make some progress, can we get this into v1.1 and add a follow up to optimize manifests / resources, this test is opt in, so shouldnt negatively affect anyone by default

[robscott]

@arkodg that makes sense to me, @pleshakov can you rebase this PR? RC2 is scheduled to go out tomorrow, if this PR is ready before that, I'll merge it.

[robscott]

Covered by #3047, closing this one out.