BackendTLSPolicySANValidation conformance test failing on main since at least Aug 3
#9.687 aberto em 6 de ago. de 2026
Métricas do repositório
- Stars
- (2.871 estrelas)
- Métricas de merge de PR
- (Métricas PR pendentes)
Description
Description:
TestGatewayAPIConformance/BackendTLSPolicySANValidation has been failing on every main run I checked, going back to at least 2026-08-03. Every PR inherits the failure, so red CI is currently hard to read.
Main runs, all with the same failing test:
| run | date | conformance jobs failing on this test |
|---|---|---|
| 31067661691 | 08-06 | 3 |
| 31064863693 | 08-06 | 2 |
| 31059844487 | 08-06 | 1 |
| 30817198225 | 08-03 | 2 |
The failure splits cleanly by expectation:
--- FAIL: .../valid_BackendTLSPolicy_containing_dns_SAN_should_succeed (30.00s)
--- PASS: .../mismatched_dns_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_uri_SAN_should_succeed (30.01s)
--- PASS: .../mismatched_uri_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_multi_SAN_should_succeed (30.00s)
--- PASS: .../mismatched_multi_SAN_should_return_an_HTTP_error
Every "valid SAN should succeed" case gets 503 for the whole 30s window (30/30 attempts on both /backendtlspolicy-san-dns and /backendtlspolicy-san-uri):
expected status code to be one of [200], got 503
The mismatch cases pass because they only assert that the request fails, so they would also pass if SAN validation rejected everything.
The BackendTLSPolicy e2e tests look affected too — TestE2E/HTTPRouteMixedProtocols (which applies policy-btls and backend-tls-ca) and TestE2E/HTTPRouteMixedBackends are failing on main and on PR branches in the same runs.
I have not root-caused it, so I am not sure whether the upstream TLS handshake or the SAN matcher is at fault. Filing this so it is tracked, and happy to dig in if nobody is on it already.