Gateway API conformance evidence¶
Use the report for your HAPTIC release to check Gateway API coverage. A passing regression shard doesn't establish conformance: each report requires one complete run against the published controller image.
Coverage¶
The report contains three profiles. Extended results may be partial; inspect the named skipped tests and unsupported features before relying on an extension.
| Surface | Evidence and limits |
|---|---|
| HTTPRoute | GATEWAY-HTTP core and extended results |
| GRPCRoute | GATEWAY-GRPC core and extended results |
| TLSRoute | GATEWAY-TLS core and extended results |
| TCPRoute | HAPTIC's separate end-to-end tests; no profile in this report |
| Independent backend certificate SAN matching | BackendTLSPolicySANValidation remains skipped because HAProxy verifies the SNI hostname; unsupported policy identities are rejected |
Mesh and UDPRoute |
Unsupported; excluded from the declared feature set |
The backend identity limit is tracked in HAProxy issue 3452. A generated report isn't an accepted upstream submission. Upstream review and the Gateway API implementations listing are separate evidence.
Release artifacts¶
The release-gateway-conformance job runs after the release controller and chart
are published. Its artifacts have no scheduled expiration:
| File | Contents |
|---|---|
report.yaml |
Unmodified upstream report, including partial coverage |
provenance.json |
Source commit and hash, chart digest, controller image and binary digests, running controller identities, Kubernetes and Gateway API versions, and test exit code |
SHA256SUMS |
Checksums of the report and provenance |
Successful evidence requires a clean checkout at the release tag, a published
image digest, matching image version and source hash, matching running binaries,
all three passing core profiles, and no failed extended tests. Missing or
incomplete reports fail the job. Failed jobs retain available artifacts with
verified: false; they don't establish conformance.
The manual gateway-conformance-report job produces candidate evidence for a
pipeline snapshot. Its version identifies that pipeline's image. It doesn't
claim to test the released version in VERSION.
Download artifacts from the release job using the GitLab CLI, unzip, and
sha256sum:
read -r -p 'Release conformance job ID: ' job_id
artifact_dir="$(mktemp -d)"
glab api "projects/haproxy-haptic%2Fhaptic/jobs/${job_id}/artifacts" >"$artifact_dir/evidence.zip"
unzip -q "$artifact_dir/evidence.zip" -d "$artifact_dir"
cd "$artifact_dir/build/gateway-conformance"
sha256sum --check SHA256SUMS
python3 - <<'PY'
import json
from pathlib import Path
p = json.loads(Path('provenance.json').read_text())
assert p['verified'] and p['release_evidence'] and p['test_exit_code'] == 0, p['errors']
print(p['controller']['version'], p['git_commit'])
print(json.dumps(p['profiles'], indent=2))
PY
For generation and upstream submission, see the repository's conformance instructions.