Documentation menu
Introduction
Kong
Operations
Reference

Home › Docs › End-to-end tests

End-to-end tests

A Kubernetes environment with Vault, jwks-bridge and Kong Gateway Enterprise in hybrid mode, and a Go test suite that rotates keys under traffic.

Environment

NamespaceWorkload
vaultVault dev server with Kubernetes auth and a read-only policy.
jwksjwks-bridge from the local Helm chart, two replicas, TLS and Basic auth.
kongPostgreSQL, one control plane and two data planes (Kong Helm chart).
backendgo-httpbin, which echoes the re-signed token.

What the tests check

  • Both data planes sign with the active key from Vault, and the token verifies against the JWKS served by Kong.
  • The public JWKS served through Kong has no private members.
  • A full stage, promote, remove rotation under continuous traffic through both data planes causes no verification failure. Each data plane's tokens are verified by a simulated backend that caches the JWKS and does not refetch on an unknown kid.
  • The bridge exposes its Prometheus metrics.

Run it

Needs Docker, kind, kubectl, Helm, Go, jq, openssl and a Kong Enterprise license (jwt-signer is an Enterprise plugin).

export KONG_LICENSE_DATA='{"license":{...}}'
make e2e                     # create kind cluster, deploy, test, delete

./test/e2e/run.sh up         # or step by step
./test/e2e/run.sh test
./test/e2e/run.sh down

To use an existing cluster set E2E_KUBE_CONTEXT, and E2E_LOAD_IMAGE to the command that loads jwks-bridge:e2e into it.

Guided demo

On an environment created with run.sh up, test/e2e/demo.sh walks through the whole flow and pauses before each step: the keyset in Vault, the protected private keyset, the public JWKS, both data planes signing with the same key, then a stage, promote and remove rotation while a client calls both data planes. It ends with the request count per signing key, the Prometheus metrics and a W3C trace id found in the bridge logs.

./test/e2e/run.sh up
./test/e2e/demo.sh            # Enter advances each step
DEMO_AUTO=1 ./test/e2e/demo.sh  # no pauses

Telemetry to an existing backend

run.sh o11y installs an OpenTelemetry Collector in the test cluster and sends traces to Jaeger, metrics to Prometheus (remote write) and pod logs to Loki 3 (OTLP). It sets the OTLP endpoint on the bridge, turns on tracing in the Kong data planes and adds the opentelemetry and prometheus plugins.

export E2E_O11Y_JAEGER=jaeger.example.internal
export E2E_O11Y_PROMETHEUS=prometheus.example.internal
export E2E_O11Y_LOKI=loki.example.internal
./test/e2e/run.sh o11y

Exported data carries cluster (metrics) and k8s.cluster.name (traces, logs), set from E2E_O11Y_CLUSTER. Bridge log lines keep their trace_id, so Loki and Jaeger can link to each other. Import the Grafana dashboard to follow the demo.

CI

The GitHub Actions workflow runs the same script on kind when the KONG_LICENSE_DATA repository secret is set.

← PreviousSecurity