Repository: envoyproxy/gateway

Issue:
Flaky: TestE2E/CORSFromHTTPCORSFilter
    --- FAIL: TestE2E/CORSFromHTTPCORSFilter (1.15s)
        --- FAIL: TestE2E/CORSFromHTTPCORSFilter/should_enable_cors_with_Allow_Origin_Exact (0.02s)


https://github.com/envoyproxy/gateway/actions/runs/14944185224/job/41986980698


Discussion:

Solution patch:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6559da345..b1b6b5e96 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,19 +36,23 @@ updates:
       # Ignore github.com/docker/docker, since it should be updated alongside github.com/google/go-containerregistry
       - dependency-name: github.com/docker/docker
     groups:
-      github.com:
+      gomod:
         patterns:
           - "github.com*"
+          - "go.opentelemetry.io*"
+          - "golang*"
+          - "google*"
+          - "fortio.org*"
+          - "gopkg.in*"
+          - "helm.sh*"
+          - "gomodules.xyz"
+        exclude-patterns:
+          # Exclude envoyproxy/go-control-plane, since it needs more work to update
+          - "github.com/envoyproxy/go-control-plane*"
       k8s.io:
         patterns:
           - "k8s.io/*"
           - "sigs.k8s.io/*"
-      go.opentelemetry.io:
-        patterns:
-          - "go.opentelemetry.io*"
-          # Merge golang/google groups into group, since it should be updated alongside opentelemetry
-          - "golang*"
-          - "google*"
   - package-ecosystem: pip
     directories:
       - /tools/src/codespell



Test patch:
diff --git a/test/e2e/tests/cors.go b/test/e2e/tests/cors.go
index 2d27a8efe..29a395a41 100644
--- a/test/e2e/tests/cors.go
+++ b/test/e2e/tests/cors.go
@@ -30,7 +30,7 @@ var CORSFromSecurityPolicyTest = suite.ConformanceTest{
 	Description: "Test CORS from SecurityPolicy",
 	Manifests:   []string{"testdata/cors-security-policy.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
-		testCORS(t, suite, true)
+		runCORStest(t, suite, true)
 	},
 }
 
@@ -39,27 +39,31 @@ var CORSFromHTTPCORSFilterTest = suite.ConformanceTest{
 	Description: "Test CORS from HTTP CORS Filter",
 	Manifests:   []string{"testdata/cors-http-cors-filter.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
-		testCORS(t, suite, false)
+		runCORStest(t, suite, false)
 	},
 }
 
-func testCORS(t *testing.T, suite *suite.ConformanceTestSuite, isSP bool) {
-	t.Run("should enable cors with Allow Origin Exact", func(t *testing.T) {
-		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "http-with-cors-exact", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
-		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
-
-		ancestorRef := gwapiv1a2.ParentReference{
-			Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
-			Kind:      gatewayapi.KindPtr(resource.KindGateway),
-			Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
-			Name:      gwapiv1.ObjectName(gwNN.Name),
-		}
-		if isSP {
-			SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-exact", Namespace: ns}, suite.ControllerName, ancestorRef)
-		}
+func runCORStest(t *testing.T, suite *suite.ConformanceTestSuite, withSecurityPolicy bool) {
+	ns := "gateway-conformance-infra"
+	routeNN := types.NamespacedName{Name: "http-with-cors-exact", Namespace: ns}
+	gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+	gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+
+	ancestorRef := gwapiv1a2.ParentReference{
+		Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
+		Kind:      gatewayapi.KindPtr(resource.KindGateway),
+		Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
+		Name:      gwapiv1.ObjectName(gwNN.Name),
+	}
+
+	if withSecurityPolicy {
+		SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-exact", Namespace: ns}, suite.ControllerName, ancestorRef)
+	}
+	if withSecurityPolicy {
+		SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-exact", Namespace: ns}, suite.ControllerName, ancestorRef)
+	}
 
+	t.Run("should enable cors with Allow Origin Exact", func(t *testing.T) {
 		expectedResponse := http.ExpectedResponse{
 			Request: http.Request{
 				Path:   "/cors-exact",
@@ -92,35 +96,10 @@ func testCORS(t *testing.T, suite *suite.ConformanceTestSuite, isSP bool) {
 			},
 			Namespace: "",
 		}
-
-		req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
-		cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
-		if err != nil {
-			t.Errorf("failed to get expected response: %v", err)
-		}
-
-		if err := http.CompareRequest(t, &req, cReq, cResp, expectedResponse); err != nil {
-			t.Errorf("failed to compare request and response: %v", err)
-		}
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 	})
 
 	t.Run("should enable cors with Allow Origin Regex", func(t *testing.T) {
-		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "http-with-cors-exact", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
-		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
-
-		ancestorRef := gwapiv1a2.ParentReference{
-			Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
-			Kind:      gatewayapi.KindPtr(resource.KindGateway),
-			Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
-			Name:      gwapiv1.ObjectName(gwNN.Name),
-		}
-
-		if isSP {
-			SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-exact", Namespace: ns}, suite.ControllerName, ancestorRef)
-		}
-
 		expectedResponse := http.ExpectedResponse{
 			Request: http.Request{
 				Path:   "/cors-exact",
@@ -154,34 +133,10 @@ func testCORS(t *testing.T, suite *suite.ConformanceTestSuite, isSP bool) {
 			Namespace: "",
 		}
 
-		req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
-		cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
-		if err != nil {
-			t.Errorf("failed to get expected response: %v", err)
-		}
-
-		if err := http.CompareRequest(t, &req, cReq, cResp, expectedResponse); err != nil {
-			t.Errorf("failed to compare request and response: %v", err)
-		}
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 	})
 
 	t.Run("should not contain cors headers when Origin not registered", func(t *testing.T) {
-		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "http-with-cors-exact", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
-		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
-
-		ancestorRef := gwapiv1a2.ParentReference{
-			Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
-			Kind:      gatewayapi.KindPtr(resource.KindGateway),
-			Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
-			Name:      gwapiv1.ObjectName(gwNN.Name),
-		}
-
-		if isSP {
-			SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-exact", Namespace: ns}, suite.ControllerName, ancestorRef)
-		}
-
 		expectedResponse := http.ExpectedResponse{
 			Request: http.Request{
 				Path:   "/cors-exact",
@@ -209,34 +164,10 @@ func testCORS(t *testing.T, suite *suite.ConformanceTestSuite, isSP bool) {
 			Namespace: "",
 		}
 
-		req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
-		cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
-		if err != nil {
-			t.Errorf("failed to get expected response: %v", err)
-		}
-
-		if err := http.CompareRequest(t, &req, cReq, cResp, expectedResponse); err != nil {
-			t.Errorf("failed to compare request and response: %v", err)
-		}
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 	})
 
 	t.Run("should enable cors with wildcard matching", func(t *testing.T) {
-		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "http-with-cors-wildcard", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
-		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
-
-		ancestorRef := gwapiv1a2.ParentReference{
-			Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
-			Kind:      gatewayapi.KindPtr(resource.KindGateway),
-			Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
-			Name:      gwapiv1.ObjectName(gwNN.Name),
-		}
-
-		if isSP {
-			SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "cors-wildcard", Namespace: ns}, suite.ControllerName, ancestorRef)
-		}
-
 		expectedResponse := http.ExpectedResponse{
 			Request: http.Request{
 				Path:   "/cors-wildcard",
@@ -270,14 +201,6 @@ func testCORS(t *testing.T, suite *suite.ConformanceTestSuite, isSP bool) {
 			Namespace: "",
 		}
 
-		req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
-		cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
-		if err != nil {
-			t.Errorf("failed to get expected response: %v", err)
-		}
-
-		if err := http.CompareRequest(t, &req, cReq, cResp, expectedResponse); err != nil {
-			t.Errorf("failed to compare request and response: %v", err)
-		}
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 	})
 }