disable HTTP/2 of admin api in e2e if Kong < 3.0.0

test/e2e/all_in_one_test.go

@@ -47,10 +47,21 @@ func TestDeployAllInOneDBLESSLegacy(t *testing.T) {
 	forDeployment := metav1.ListOptions{
 		LabelSelector: fmt.Sprintf("app=%s", deployment.Name),
 	}
-	podList, err := env.Cluster().Client().CoreV1().Pods(deployment.Namespace).List(ctx, forDeployment)
-	require.NoError(t, err)
-	require.Equal(t, 1, len(podList.Items))
-	pod := podList.Items[0]
+
+	var pod corev1.Pod
+	require.Eventually(
+		t, func() bool {
+			podList, err := env.Cluster().Client().CoreV1().Pods(deployment.Namespace).List(ctx, forDeployment)
+			require.NoError(t, err)
+			if len(podList.Items) == 1 && podList.Items[0].Status.Phase == corev1.PodRunning {
+				pod = podList.Items[0]
+				return true
+			}
+			return false
+		},
+		time.Minute, time.Second,
+		"should have only one 'Running' pod in deployment",
+	)
 
 	t.Log("running ingress tests to verify all-in-one deployed ingress controller and proxy are functional")
 	deployIngressWithEchoBackends(ctx, t, env, numberOfEchoBackends)

test/e2e/helpers_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/blang/semver/v4"
 	"github.com/google/uuid"
 	"github.com/kong/deck/dump"
-	gokong "github.com/kong/go-kong/kong"
+	"github.com/kong/go-kong/kong"
 	"github.com/kong/kubernetes-testing-framework/pkg/clusters"
 	"github.com/kong/kubernetes-testing-framework/pkg/clusters/addons/loadimage"
 	"github.com/kong/kubernetes-testing-framework/pkg/clusters/addons/metallb"
@@ -280,6 +280,16 @@ func (d ManifestDeploy) Run(ctx context.Context, t *testing.T, env environments.
 	t.Log("waiting for controller to be ready")
 	deployments := getManifestDeployments(d.Path)
 
+	adminAPINoHTTP2Range := kong.MustNewRange("<" + adminAPIHTTP2MinimalKongVersion.String())
+	kongVersion, err := getKongVersionFromOverrideImageTag()
+	if err == nil && adminAPINoHTTP2Range(kongVersion) {
+		t.Logf(
+			"Kong version %s is below %s, should disable HTTP/2 on admin API",
+			kongVersion.String(), adminAPIHTTP2MinimalKongVersion.String(),
+		)
+		removeAdminListenHTTP2(ctx, t, env, deployments.ProxyNN)
+	}
+
 	waitForDeploymentRollout(ctx, t, env, deployments.ControllerNN.Namespace, deployments.ControllerNN.Name)
 	waitForDeploymentRollout(ctx, t, env, deployments.ProxyNN.Namespace, deployments.ProxyNN.Name)
 
@@ -535,7 +545,7 @@ func verifyIngressWithEchoBackendsPath(
 func verifyIngressWithEchoBackendsInAdminAPI(
 	ctx context.Context,
 	t *testing.T,
-	kongClient *gokong.Client,
+	kongClient *kong.Client,
 	noReplicas int,
 ) {
 	t.Helper()

test/e2e/utils_test.go

@@ -45,6 +45,8 @@ const (
 var (
 	// gatewayDiscoveryMinimalVersion is the minimal version of KIC that enables gateway discovery.
 	gatewayDiscoveryMinimalVersion = semver.Version{Major: 2, Minor: 9} // 2.9.0
+	// adminAPIHTTP2MinimalKongVersion is the minimal version of Kong gateway version that supports `http2` on admin APIs.
+	adminAPIHTTP2MinimalKongVersion = semver.Version{Major: 3, Minor: 0} // 3.0.0
 	// statusReadyProbeMinimalKongVersion is the minimal version of kong gateway version that enables /status/ready probe.
 	statusReadyProbeMinimalKongVersion = semver.Version{Major: 3, Minor: 3} // 3.3.0
 )
@@ -114,6 +116,48 @@ func exposeAdminAPI(ctx context.Context, t *testing.T, env environments.Environm
 	}, time.Minute, time.Second)
 }
 
+func removeAdminListenHTTP2(ctx context.Context, t *testing.T, env environments.Environment, proxyDeployment k8stypes.NamespacedName) {
+	t.Helper()
+	t.Log("updating the proxy container KONG_ADMIN_LISTEN to disable the admin API listen on HTTP2")
+	deployment, err := env.Cluster().Client().AppsV1().Deployments(proxyDeployment.Namespace).Get(ctx, proxyDeployment.Name, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	var kongAdminListenValue string
+	for _, containerSpec := range deployment.Spec.Template.Spec.Containers {
+		if containerSpec.Name == proxyContainerName {
+			for _, envVar := range containerSpec.Env {
+				if envVar.Name == "KONG_ADMIN_LISTEN" {
+					value := envVar.Value
+					kongAdminListenValue = strings.ReplaceAll(value, " http2", "")
+				}
+			}
+		}
+	}
+	_, err = env.Cluster().Client().AppsV1().Deployments(proxyDeployment.Namespace).Patch(
+		ctx, deployment.Name,
+		k8stypes.StrategicMergePatchType,
+		[]byte(fmt.Sprintf(
+			`{
+				"spec": {
+					"template":{
+						"spec":{
+							"containers":[
+								{
+									"name":"%s","env":[{"name":"KONG_ADMIN_LISTEN","value":"%s"}]
+								}
+							]
+						}
+					}
+				}
+			}`,
+			proxyContainerName,
+			kongAdminListenValue,
+		)),
+		metav1.PatchOptions{},
+	)
+	require.NoError(t, err)
+}
+
 // getTestManifest gets a manifest io.Reader, applying optional patches to the base manifest provided.
 // In case of any failure while patching, the base manifest is returned.
 // If skipTestPatches is true, no patches are applied (useful when untouched manifest is needed, e.g. in upgrade tests).
@@ -162,8 +206,8 @@ func getTestManifest(t *testing.T, baseManifestPath string, skipTestPatches bool
 		}
 
 		if kongImageOverride != "" {
-			patchReadinessProbeRange := kong.MustNewRange("<" + statusReadyProbeMinimalKongVersion.String())
 			kongVersion, err := getKongVersionFromOverrideImageTag()
+			patchReadinessProbeRange := kong.MustNewRange("<" + statusReadyProbeMinimalKongVersion.String())
 			// If we could not get version from kong image, assume they are latest.
 			// So we do not patch the readiness probe path to the legacy path `/status`.
 			if err == nil && patchReadinessProbeRange(kongVersion) {