CI: ci-gateway-api: TestConformance/BackendTLSPolicyInvalidCACertificateRef/BackendTLSPolicy_nonexistent-ca-certificate-ref #44043
Description
CI failure
~5% of tests have been failing. Here are some example:
- https://github.com/cilium/cilium/actions/runs/21393905247
- https://github.com/cilium/cilium/actions/runs/21379010830
- https://github.com/cilium/cilium/actions/runs/21370758573
- https://github.com/cilium/cilium/actions/runs/21356207596
The error we are seeing:
--- FAIL: TestConformance/BackendTLSPolicyInvalidCACertificateRef (31.15s)
--- FAIL: TestConformance/BackendTLSPolicyInvalidCACertificateRef/BackendTLSPolicy_nonexistent-ca-certificate-ref (31.01s)
--- FAIL: TestConformance/BackendTLSPolicyInvalidCACertificateRef/BackendTLSPolicy_nonexistent-ca-certificate-ref/HTTP_Request_to_backend_targeted_by_an_invalid_BackendTLSPolicy_receive_a_5xx (30.00s)
http.go:276: 2026-01-26T19:25:18.384495396Z: Response expectation failed for request: {URL: {Scheme:http
Opaque: User: Host:172.18.255.192 Path:/backendtlspolicy-nonexistent-ca-certificate-ref RawPath:
OmitHost:false ForceQuery:false RawQuery: Fragment: RawFragment:}, Host: abc.example.com, Protocol:
HTTP, Method: GET, Headers: map[X-Echo-Set-Header:[]], UnfollowRedirect: false, Server: , CertPem:
<truncated>, KeyPem: <truncated>} not ready yet: expected status code to be one of [500 502 503], got 400.
CRes: &{400 -1 HTTP/1.1 map[Date:[Mon, 26 Jan 2026 19:25:18 GMT] Server:[envoy] X-Envoy-Upstream-Service-Time:[0]] <nil> []} (after 29.116602977s)
http.go:257: 2026-01-26T19:25:19.264837252Z: timeout while waiting after 30 attempts, 0/3 successes
The test helper retried got a 400 (expects 500/502/503) response from Envoy (X-Envoy-Upstream-Service-Time: 0), appearing to seem Envoy handled the request locally and did not forward it upstream (upstream time = 0 ms).
Zip files from https://github.com/cilium/cilium/actions/runs/21370758573/job/61514420755
cilium-sysdumps-Gateway API Conformance Test (experimental, true) (1).zip