Skip to content

Fix #7490: Replace cert-manager dependency in e2e tests#7511

Open
ShivamJha2436 wants to merge 1 commit intoprojectcontour:mainfrom
ShivamJha2436:fix/e2e-remove-cert-manager-dependency
Open

Fix #7490: Replace cert-manager dependency in e2e tests#7511
ShivamJha2436 wants to merge 1 commit intoprojectcontour:mainfrom
ShivamJha2436:fix/e2e-remove-cert-manager-dependency

Conversation

@ShivamJha2436
Copy link
Copy Markdown
Contributor

Overview

This PR removes the dependency on cert-manager in the e2e test suite and replaces it with a lightweight in-process certificate generation helper.

Previously, the e2e suite relied on cert-manager CRDs to generate test certificates. Although cert-manager was only used for testing, it was included in go.mod, causing its transitive dependencies (notably gateway-api) to affect Contour’s build.

When cert-manager updated its gateway-api dependency to a newer version, it introduced version conflicts with Contour’s own Gateway API usage, resulting in compilation failures.

What this PR does

  • Introduces a local certificate helper (test/e2e/certs.go) that:

    • Generates X.509 certificates using Go’s crypto libraries
    • Tracks issuers in memory
    • Creates TLS Secrets (kubernetes.io/tls) directly
    • Reconciles managed Secrets to preserve behavior like cert rotation
  • Refactors e2e tests to use the new helper via the shared framework

  • Removes cert-manager usage from e2e tests

  • Removes cert-manager dependency from go.mod

  • Removes cert-manager installation from test/scripts/make-kind-cluster.sh

  • Updates test/scripts/README.md to reflect the new test flow

Why this change

  • Avoids dependency leakage from test-only dependencies
  • Eliminates gateway-api version conflicts introduced by cert-manager
  • Simplifies e2e test setup (no external controller required)
  • Improves test determinism and reduces cluster complexity

Behavior parity

The new helper preserves key behaviors previously provided by cert-manager:

  • Certificate issuance via issuers
  • CA-based signing
  • Secret regeneration when deleted (important for rotation-related tests)

Testing

  • Ran full e2e test suite locally
  • Verified TLS-related tests (backend TLS, mTLS, protocol versions)
  • Confirmed no dependency conflicts remain in module graph

Related Issue

Fixes #7490

Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
@ShivamJha2436 ShivamJha2436 requested a review from a team as a code owner April 7, 2026 13:01
@ShivamJha2436 ShivamJha2436 requested review from sunjayBhatia and tsaarni and removed request for a team April 7, 2026 13:01
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.84%. Comparing base (e505630) to head (01e8a96).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #7511   +/-   ##
=======================================
  Coverage   81.84%   81.84%           
=======================================
  Files         130      130           
  Lines       15722    15722           
=======================================
  Hits        12868    12868           
  Misses       2571     2571           
  Partials      283      283           
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@tsaarni tsaarni added the release-note/none-required Marks a PR as not requiring a release note. Should only be used for very small changes. label Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-note/none-required Marks a PR as not requiring a release note. Should only be used for very small changes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Replace cert-manager as e2e test dependency for test cert generation

2 participants