e2e: assert the router ingress works on every IP family

internal/e2e/dns_client.go

@@ -0,0 +1,162 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package e2e
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/agent-substrate/substrate/internal/ateclient"
+	"github.com/agent-substrate/substrate/internal/portforward"
+	"k8s.io/client-go/kubernetes"
+)
+
+const (
+	dnsNamespace = "ate-system"
+	dnsService   = "dns"
+	// dnsServicePort is the Service port; the Service exposes 53 twice, once
+	// UDP and once TCP, and the port-forward tunnel is TCP either way.
+	dnsServicePort = 53
+)
+
+// DNSRcode is how the server answered, at the granularity net.Resolver exposes.
+type DNSRcode int
+
+const (
+	// DNSAnswered is NOERROR with at least one address of the queried family.
+	DNSAnswered DNSRcode = iota
+	// DNSEmpty is "this name has no address in this family": NODATA (NOERROR
+	// with an empty answer section) or NXDOMAIN. net.Resolver reports both as
+	// DNSError.IsNotFound and the standard library offers no way to tell them
+	// apart, which is fine here — both are benign to every stub resolver, and
+	// that benign-ness is the property under test.
+	DNSEmpty
+	// DNSFailed is SERVFAIL, REFUSED, a timeout, or a malformed reply: anything
+	// net.Resolver classifies as the server misbehaving. No query into the actor
+	// zone should ever produce it — not a non-A qtype, not a name that fails the
+	// actor regex — and that is the regression these tests exist to catch.
+	DNSFailed
+)
+
+func (r DNSRcode) String() string {
+	switch r {
+	case DNSAnswered:
+		return "answered"
+	case DNSEmpty:
+		return "no-such-host (NODATA or NXDOMAIN)"
+	case DNSFailed:
+		return "server failure (SERVFAIL/REFUSED/timeout)"
+	default:
+		return "unknown"
+	}
+}
+
+// DNSClient resolves names against the ate-system/dns CoreDNS Service over a
+// port-forward.
+//
+// Querying that Service directly, rather than going through the cluster's own
+// resolver, is deliberate: the delegation that would make actor names resolvable
+// cluster-wide is a patch to the kube-system/kube-dns ConfigMap, which only
+// exists on GKE (cmd/atenet/internal/dns/dns.go reconcileKubeDNSConfig hits the
+// IsNotFound branch on kind and upstream Kubernetes). Pointing at the Service is
+// the only way to assert the zone's behavior on every cluster we test on.
+type DNSClient struct {
+	resolver *net.Resolver
+	stop     func()
+}
+
+// NewDNSClient establishes a port-forward to the atenet DNS Service. Call Close
+// to tear it down.
+func NewDNSClient(ctx context.Context) (*DNSClient, error) {
+	config, err := ateclient.LoadConfig(KubeConfig, KubeContext)
+	if err != nil {
+		return nil, fmt.Errorf("loading kubeconfig: %w", err)
+	}
+	clientset, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, fmt.Errorf("creating k8s client: %w", err)
+	}
+
+	localPort, stop, err := portforward.ServicePortForward(ctx, config, clientset, dnsNamespace, dnsService, dnsServicePort)
+	if err != nil {
+		return nil, err
+	}
+	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(localPort))
+
+	return &DNSClient{
+		stop: stop,
+		resolver: &net.Resolver{
+			// PreferGo keeps us on Go's own resolver on every platform. cgo's
+			// would ignore Dial entirely and query the host's nameservers.
+			PreferGo: true,
+			// Surface a per-family failure instead of hiding it behind the
+			// other family's success.
+			StrictErrors: true,
+			Dial: func(ctx context.Context, _, _ string) (net.Conn, error) {
+				// The port-forward is a TCP tunnel, so every query goes over TCP
+				// whatever network the resolver asked for. net.Resolver selects
+				// stream framing for any conn that is not a net.PacketConn, so
+				// returning a TCP conn here is transparent to it. The requested
+				// server address is ignored: there is exactly one server.
+				var d net.Dialer
+				return d.DialContext(ctx, "tcp", addr)
+			},
+		},
+	}, nil
+}
+
+// Close tears down the port-forward.
+func (c *DNSClient) Close() {
+	if c.stop != nil {
+		c.stop()
+	}
+}
+
+// Lookup resolves name in a single address family — network is "ip4" for an A
+// query or "ip6" for a AAAA query — and reports the addresses alongside how the
+// server answered. A DNSFailed result is returned with the underlying error for
+// the failure message; DNSEmpty is returned with a nil error because it is a
+// valid answer, not a fault.
+func (c *DNSClient) Lookup(ctx context.Context, network, name string) ([]string, DNSRcode, error) {
+	// Root the name so the resolver skips the host's search list and ndots
+	// handling, which would otherwise make the query depend on where the test
+	// runs.
+	if !strings.HasSuffix(name, ".") {
+		name += "."
+	}
+
+	lookupCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+
+	addrs, err := c.resolver.LookupNetIP(lookupCtx, network, name)
+	if err == nil {
+		ips := make([]string, 0, len(addrs))
+		for _, a := range addrs {
+			ips = append(ips, a.Unmap().String())
+		}
+		return ips, DNSAnswered, nil
+	}
+
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+		return nil, DNSEmpty, nil
+	}
+	return nil, DNSFailed, fmt.Errorf("%s query for %q: %w", network, name, err)
+}

internal/e2e/ipfamily.go

@@ -0,0 +1,69 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// clusterIPsByFamily splits a Service's cluster IPs into its IPv4 and IPv6
+// entries, returning "" for a family the Service does not have. A Service with
+// no ipFamilyPolicy is SingleStack, so on a dual-stack cluster it still has
+// exactly one ClusterIP and one of the two return values is empty — which is
+// what makes this the right thing to gate a dual-stack assertion on.
+//
+// Spec.ClusterIPs is preferred over the singular Spec.ClusterIP, with a
+// fallback for the latter because a Service object built by hand (or by a fake
+// client) may only set the scalar.
+func clusterIPsByFamily(svc *corev1.Service) (v4, v6 string) {
+	ips := svc.Spec.ClusterIPs
+	if len(ips) == 0 && svc.Spec.ClusterIP != "" {
+		ips = []string{svc.Spec.ClusterIP}
+	}
+	for _, ip := range ips {
+		if ip == "" || ip == corev1.ClusterIPNone {
+			continue
+		}
+		// netip rather than net.IP: net.IP.To4 returns non-nil for a v4-mapped
+		// v6 address and would misfile it as IPv4.
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			continue
+		}
+		switch {
+		case addr.Is4() && v4 == "":
+			v4 = ip
+		case addr.Is6() && !addr.Is4In6() && v6 == "":
+			v6 = ip
+		}
+	}
+	return v4, v6
+}
+
+// RouterClusterIPs returns the atenet-router Service's IPv4 and IPv6
+// ClusterIPs. Either may be "".
+func RouterClusterIPs(ctx context.Context) (v4, v6 string, err error) {
+	svc, err := GetClients().K8s.CoreV1().Services(RouterNamespace).Get(ctx, RouterService, metav1.GetOptions{})
+	if err != nil {
+		return "", "", fmt.Errorf("getting Service %s/%s: %w", RouterNamespace, RouterService, err)
+	}
+	v4, v6 = clusterIPsByFamily(svc)
+	return v4, v6, nil
+}

internal/e2e/router_client.go

@@ -36,8 +36,11 @@ import (
 )
 
 const (
-	routerNamespace = "ate-system"
-	routerService   = "atenet-router"
+	// RouterNamespace and RouterService locate the atenet router. Exported so
+	// that suites addressing the same Service or its pods do not have to
+	// redeclare them.
+	RouterNamespace = "ate-system"
+	RouterService   = "atenet-router"
 	// routerConnectServicePort is atenet-router's Service port for
 	// CONNECT-tunneled traffic (see manifests/ate-install/atenet-router.yaml).
 	// It is a distinct listener from the plain HTTP one Get/PostJSON use:
@@ -79,7 +82,7 @@ func NewRouterClient(ctx context.Context) (*RouterClient, error) {
 		return nil, fmt.Errorf("creating k8s client: %w", err)
 	}
 
-	localPort, stop, err := portforward.ServicePortForward(ctx, config, clientset, routerNamespace, routerService, 80)
+	localPort, stop, err := portforward.ServicePortForward(ctx, config, clientset, RouterNamespace, RouterService, 80)
 	if err != nil {
 		return nil, err
 	}
@@ -183,7 +186,7 @@ func (c *RouterClient) Connect(ctx context.Context, actorRef resources.ActorRef,
 // in one test don't each pay for a fresh port-forward.
 func (c *RouterClient) ensureConnectPortForward(ctx context.Context) error {
 	c.connectOnce.Do(func() {
-		localPort, stop, err := portforward.ServicePortForward(ctx, c.config, c.clientset, routerNamespace, routerService, routerConnectServicePort)
+		localPort, stop, err := portforward.ServicePortForward(ctx, c.config, c.clientset, RouterNamespace, RouterService, routerConnectServicePort)
 		if err != nil {
 			c.connectErr = fmt.Errorf("port-forwarding to the router's CONNECT listener: %w", err)
 			return

internal/e2e/statusz.go

@@ -51,7 +51,7 @@ func NewStatuszClient(ctx context.Context) (*StatuszClient, error) {
 		return nil, fmt.Errorf("creating k8s client: %w", err)
 	}
 
-	localPort, stop, err := portforward.ServicePortForward(ctx, config, clientset, routerNamespace, routerService, routerStatusPort)
+	localPort, stop, err := portforward.ServicePortForward(ctx, config, clientset, RouterNamespace, RouterService, routerStatusPort)
 	if err != nil {
 		return nil, err
 	}