Repository: projectcontour/contour

Issue:
Flaky test: test/e2e/httpproxy/backend_tls_test.go
This test has been flaky lately: https://github.com/projectcontour/contour/blob/main/test/e2e/httpproxy/backend_tls_test.go

Failure example: https://github.com/projectcontour/contour/actions/runs/14871016010/job/41759471393?pr=7020

After we delete the cert and wait for it to be rotated, there are some failures where we get a 200 response but with the old certificate rather than the new one. It is likely that we haven't waited long enough for Contour/Envoy to pick up the rotated cert and it is still using the old one.

We can probably fix this by changing how we make the second request and instead of just waiting for a 200, wait for a 200 and the new cert value in the Envoy->upstream request TLS details.

Discussion:
@tsaarni: > We can probably fix this by changing how we make the second request and instead of just waiting for a 200, wait for a 200 and the new cert value in the Envoy->upstream request TLS details.

Makes sense to me as well. I quickly put together an attempt with that in PR #7031 but if you already did a fix, then I'll close this one!

Solution patch:
diff --git a/.github/workflows/prbuild.yaml b/.github/workflows/prbuild.yaml
index bfbc9401..368f0303 100644
--- a/.github/workflows/prbuild.yaml
+++ b/.github/workflows/prbuild.yaml
@@ -114,11 +114,11 @@ jobs:
         # image to use) for each kubernetes_version value.
         include:
         - kubernetes_version: "kubernetes:latest"
-          node_image: "docker.io/kindest/node:v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027"
+          node_image: "docker.io/kindest/node:v1.33.0@sha256:02f73d6ae3f11ad5d543f16736a2cb2a63a300ad60e81dac22099b0b04784a4e"
         - kubernetes_version: "kubernetes:n-1"
-          node_image: "docker.io/kindest/node:v1.31.4@sha256:2cb39f7295fe7eafee0842b1052a599a4fb0f8bcf3f83d96c7f4864c357c6c30"
+          node_image: "docker.io/kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f"
         - kubernetes_version: "kubernetes:n-2"
-          node_image: "docker.io/kindest/node:v1.30.8@sha256:17cd608b3971338d9180b00776cb766c50d0a0b6b904ab4ff52fd3fc5c6369bf"
+          node_image: "docker.io/kindest/node:v1.31.6@sha256:28b7cbb993dfe093c76641a0c95807637213c9109b761f1d422c2400e22b8e87"
         - config_type: "ConfigmapConfiguration"
           use_config_crd: "false"
         - config_type: "ContourConfiguration"
@@ -173,11 +173,11 @@ jobs:
         # image to use) for each kubernetes_version value.
         include:
         - kubernetes_version: "kubernetes:latest"
-          node_image: "docker.io/kindest/node:v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027"
+          node_image: "docker.io/kindest/node:v1.33.0@sha256:02f73d6ae3f11ad5d543f16736a2cb2a63a300ad60e81dac22099b0b04784a4e"
         - kubernetes_version: "kubernetes:n-1"
-          node_image: "docker.io/kindest/node:v1.31.4@sha256:2cb39f7295fe7eafee0842b1052a599a4fb0f8bcf3f83d96c7f4864c357c6c30"
+          node_image: "docker.io/kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f"
         - kubernetes_version: "kubernetes:n-2"
-          node_image: "docker.io/kindest/node:v1.30.8@sha256:17cd608b3971338d9180b00776cb766c50d0a0b6b904ab4ff52fd3fc5c6369bf"
+          node_image: "docker.io/kindest/node:v1.31.6@sha256:28b7cbb993dfe093c76641a0c95807637213c9109b761f1d422c2400e22b8e87"
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
diff --git a/changelogs/unreleased/7020-sunjayBhatia-small.md b/changelogs/unreleased/7020-sunjayBhatia-small.md
new file mode 100644
index 00000000..77a68ccb
--- /dev/null
+++ b/changelogs/unreleased/7020-sunjayBhatia-small.md
@@ -0,0 +1 @@
+Updates kind node image for e2e tests to Kubernetes 1.33. Supported/tested Kubernetes versions are now 1.33, 1.32 and 1.31.
diff --git a/hack/actions/install-kubernetes-toolchain.sh b/hack/actions/install-kubernetes-toolchain.sh
index 232194bb..7346504e 100755
--- a/hack/actions/install-kubernetes-toolchain.sh
+++ b/hack/actions/install-kubernetes-toolchain.sh
@@ -4,8 +4,8 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-readonly KUBECTL_VERS="v1.32.0"
-readonly KIND_VERS="v0.26.0"
+readonly KUBECTL_VERS="v1.33.0"
+readonly KIND_VERS="v0.27.0"
 
 readonly PROGNAME=$(basename $0)
 readonly CURL=${CURL:-curl}
diff --git a/site/content/resources/compatibility-matrix.md b/site/content/resources/compatibility-matrix.md
index 8e8aca20..c3a98677 100644
--- a/site/content/resources/compatibility-matrix.md
+++ b/site/content/resources/compatibility-matrix.md
@@ -10,7 +10,7 @@ These combinations of versions are specifically tested in CI and supported by th
 
 | Contour Version | Envoy Version        | Kubernetes Versions | Gateway API Version |
 | --------------- | :------------------- | ------------------- | --------------------|
-| main            | [1.34.0][66]         | 1.32, 1.31, 1.30    | [1.2.1][112]        |
+| main            | [1.34.0][66]         | 1.33, 1.32, 1.31    | [1.2.1][112]        |
 | 1.31.0          | [1.34.0][66]         | 1.32, 1.31, 1.30    | [1.2.1][112]        |
 | 1.30.3          | [1.31.6][71]         | 1.30, 1.29, 1.28    | [1.1.0][111]        |
 | 1.30.2          | [1.31.5][69]         | 1.30, 1.29, 1.28    | [1.1.0][111]        |
diff --git a/versions.yaml b/versions.yaml
index ff915c39..31cc3844 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -9,9 +9,9 @@ versions:
     dependencies:
       envoy: "1.34.0"
       kubernetes:
+        - "1.33"
         - "1.32"
         - "1.31"
-        - "1.30"
       gateway-api:
         - "1.2.1"
   - version: v1.31.0



Test patch:
diff --git a/test/conformance/gatewayapi/gateway_conformance_test.go b/test/conformance/gatewayapi/gateway_conformance_test.go
index b560d0a1..9019eb85 100644
--- a/test/conformance/gatewayapi/gateway_conformance_test.go
+++ b/test/conformance/gatewayapi/gateway_conformance_test.go
@@ -148,6 +148,7 @@ func TestGatewayConformance(t *testing.T) {
 		for _, f := range features.UDPRouteFeatures {
 			supportedFeatures.Delete(f)
 		}
+		options.SupportedFeatures = make(sets.Set[features.FeatureName])
 		for f := range supportedFeatures {
 			options.SupportedFeatures.Insert(f.Name)
 		}
diff --git a/test/e2e/httpproxy/backend_tls_test.go b/test/e2e/httpproxy/backend_tls_test.go
index 2dc6281b..a671072b 100644
--- a/test/e2e/httpproxy/backend_tls_test.go
+++ b/test/e2e/httpproxy/backend_tls_test.go
@@ -120,22 +120,20 @@ func testBackendTLS(namespace string) {
 			return clientSecret.UID != oldUID
 		}, time.Second*10, time.Millisecond*50)
 
-		// Send HTTP request again.
-		res, ok = f.HTTP.RequestUntil(&e2e.HTTPRequestOpts{
-			Host:      p.Spec.VirtualHost.Fqdn,
-			Condition: e2e.HasStatusCode(200),
-		})
-		require.NotNil(f.T(), res, "request never succeeded")
-		require.Truef(f.T(), ok, "expected 200 response code, got %d", res.StatusCode)
-
-		// Get cert presented to backend app.
-		tlsInfo = new(responseTLSDetails)
-		require.NoError(f.T(), json.Unmarshal(res.Body, tlsInfo))
-		require.Len(f.T(), tlsInfo.TLS.PeerCertificates, 1)
-
-		// Get value of client cert Envoy should have presented.
-		require.NoError(f.T(), f.Client.Get(context.TODO(), clientSecretKey, clientSecret))
-
-		assert.Equal(f.T(), tlsInfo.TLS.PeerCertificates[0], string(clientSecret.Data["tls.crt"]))
+		// Send HTTP request again until we get a 200 and new cert is presented.
+		require.Eventually(f.T(), func() bool {
+			res, ok = f.HTTP.RequestUntil(&e2e.HTTPRequestOpts{
+				Host:      p.Spec.VirtualHost.Fqdn,
+				Condition: e2e.HasStatusCode(200),
+			})
+			if ok {
+				// Get cert presented to backend app.
+				tlsInfo = new(responseTLSDetails)
+				require.NoError(f.T(), json.Unmarshal(res.Body, tlsInfo))
+				require.Len(f.T(), tlsInfo.TLS.PeerCertificates, 1)
+				return tlsInfo.TLS.PeerCertificates[0] == string(clientSecret.Data["tls.crt"])
+			}
+			return false
+		}, time.Second*10, time.Millisecond*50)
 	})
 }
diff --git a/test/scripts/make-kind-cluster.sh b/test/scripts/make-kind-cluster.sh
index 2a2402f5..99edbc3f 100755
--- a/test/scripts/make-kind-cluster.sh
+++ b/test/scripts/make-kind-cluster.sh
@@ -27,7 +27,7 @@ readonly KUBECTL=${KUBECTL:-kubectl}
 readonly MULTINODE_CLUSTER=${MULTINODE_CLUSTER:-"false"}
 readonly IPV6_CLUSTER=${IPV6_CLUSTER:-"false"}
 readonly SKIP_GATEWAY_API_INSTALL=${SKIP_GATEWAY_API_INSTALL:-"false"}
-readonly NODEIMAGE=${NODEIMAGE:-"docker.io/kindest/node:v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027"}
+readonly NODEIMAGE=${NODEIMAGE:-"docker.io/kindest/node:v1.33.0@sha256:02f73d6ae3f11ad5d543f16736a2cb2a63a300ad60e81dac22099b0b04784a4e"}
 readonly CLUSTERNAME=${CLUSTERNAME:-contour-e2e}
 readonly WAITTIME=${WAITTIME:-5m}