[Threat Modeling] End-to-end testing of Envoy filter creation

[TorstenD-SAP]

Description

An end-to-end test has to be implemented to test, if the Envoy filter is created in the right Namespace. User Namespace RateLimit CRs have to lead to Envoy filters in this Namespace, RateLimit CRs in the istio-system Namespace have to lead to Envoy filters applied to the ingress gateway.

Reasons

The only separation between cluster-wide applied rate limits applied on the IngressGateway and namespaced rate limits is the place, where the RateLimit CRs is stored. This is a feature of the operator. We have to ensure this behavior cannot be broken by accident.

DoD:

• Provide unit and integration tests.
• Provide documentation.
• Verify if the solution works for both open-source Kyma and SAP BTP, Kyma runtime.
• If you changed the resource limits, explain why it was needed.
• If the default configuration of Istio Operator has been changed, you performed a manual upgrade test to verify that the change can be rolled out correctly.
• Verify that your contributions don't decrease code coverage. If they do, explain why this is the case.
• Add release notes.

Attachments

part of: #1365