Increased validating webhook timeout in tests and added note to full …

…envoy validation option

projects/gloo/api/v1/settings.proto

@@ -918,6 +918,10 @@ message GatewayOptions {
         //
         // This feature is disabled by default and is not recommended for production deployments unless
         // the performance implications are well understood and acceptable.
+        //
+        // Large configurations can take more than 10 seconds to validate, causing the validating webhook to timeout.
+        // When enabling this feature, consider increasing the timeout for the validating webhook
+        // (`.Values.gateway.validation.webhook.timeoutSeconds`).
         google.protobuf.BoolValue full_envoy_validation = 14;
     }
 

test/kubernetes/e2e/features/validation/validation_reject_invalid/suite.go

@@ -221,13 +221,13 @@ func (s *testingSuite) TestRejectTransformation() {
 	// this should be rejected
 	output, err = s.testInstallation.Actions.Kubectl().ApplyFileWithOutput(s.ctx, validation.VSTransformationExtractors, "-n", s.testInstallation.Metadata.InstallNamespace)
 	s.Assert().Error(err)
-	s.Assert().Contains(output, "envoy validation mode output: error initializing configuration '': Failed to parse response template: group 1 requested for regex with only 0 sub groups")
+	s.Assert().Contains(output, "Failed to parse response template: group 1 requested for regex with only 0 sub groups")
 
 	// Single replace mode -- rejects invalid subgroup in transformation
 	// note that the regex has no subgroups, but we are trying to extract the first subgroup
 	// this should be rejected
 	output, err = s.testInstallation.Actions.Kubectl().ApplyFileWithOutput(s.ctx, validation.VSTransformationSingleReplace, "-n", s.testInstallation.Metadata.InstallNamespace)
 	s.Assert().Error(err)
-	s.Assert().Contains(output, "envoy validation mode output: error initializing configuration '': Failed to parse response template: group 1 requested for regex with only 0 sub groups")
+	s.Assert().Contains(output, "Failed to parse response template: group 1 requested for regex with only 0 sub groups")
 
 }

test/kubernetes/e2e/tests/manifests/full-envoy-validation-helm.yaml

@@ -4,4 +4,6 @@ gateway:
     allowWarnings: true # These tests to not need to fail on warnings
     # transformation validation is disabled because full envoy validation is enabled.
     disableTransformationValidation: true
+    webhook:
+      timeoutSeconds: 30 # We are seeing Envoy take 10s of seconds to validate some of the larger configurations
     fullEnvoyValidation: true