test: added e2e test for merging headers

Signed-off-by: Kostis Kapelonis <kostis.kapelonis@octopus.com>

Author: kostis-codefresh

test/e2e/chainsaw/httproute-two-headers/assertions/httproute-after-cleanup.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-two-headers
+  namespace: default
+spec:
+  (length(rules)): 1
+  rules:
+    - matches:
+        - headers:
+            - name: X-Security
+              type: Exact
+              value: secret123
+      backendRefs:
+        - name: httproute-two-headers-stable-service
+        - name: httproute-two-headers-canary-service
+          (weight): 0

test/e2e/chainsaw/httproute-two-headers/assertions/httproute-initial.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-two-headers
+  namespace: default
+spec:
+  (length(rules)): 1
+  rules:
+    - matches:
+        - headers:
+            - name: X-Security
+              type: Exact
+              value: secret123
+      backendRefs:
+        - name: httproute-two-headers-stable-service
+        - name: httproute-two-headers-canary-service
+          (weight): 0

test/e2e/chainsaw/httproute-two-headers/assertions/httproute-with-header-route.yaml

@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-two-headers
+  namespace: default
+spec:
+  (length(rules)): 2
+  rules:
+    - matches:
+        - headers:
+            - name: X-Security
+              type: Exact
+              value: secret123
+      backendRefs:
+        - name: httproute-two-headers-stable-service
+          (weight): 50
+        - name: httproute-two-headers-canary-service
+          (weight): 50
+    - name: canary-route1
+      matches:
+        - (length(headers)): 2
+          headers:
+            - name: X-Security
+              type: Exact
+              value: secret123
+            - name: X-QA
+              type: Exact
+              value: "true"
+      backendRefs:
+        - name: httproute-two-headers-canary-service

test/e2e/chainsaw/httproute-two-headers/assertions/rollout-healthy.yaml

@@ -0,0 +1,7 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  name: httproute-two-headers-rollout
+  namespace: default
+status:
+  (phase == 'Healthy'): true

test/e2e/chainsaw/httproute-two-headers/chainsaw-test.yaml

@@ -0,0 +1,84 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: httproute-two-headers
+  labels:
+    route-type: http
+    test-scope: headers
+spec:
+  description: >
+    Verifies header-based routing when the static HTTPRoute already contains a header match
+    (X-Security) and the Rollout's setHeaderRoute uses a different header (X-QA) — the scenario
+    from issue #151. The plugin must merge static-rule headers into the managed rule so that the
+    managed rule has both headers (X-Security + X-QA), giving it higher specificity than the
+    1-header static rule. After the rollout completes the managed rule must be fully removed.
+  namespace: default
+  concurrent: false
+
+  steps:
+    - name: create-resources
+      description: Create the HTTPRoute (with existing X-Security header match) and Rollout.
+      try:
+        - apply:
+            file: resources/services.yaml
+        - apply:
+            file: resources/httproute.yaml
+        - apply:
+            file: resources/rollout.yaml
+
+    - name: assert-initial-state
+      description: Plugin initializes the HTTPRoute with 1 rule (X-Security match) and canary weight 0.
+      try:
+        - assert:
+            timeout: 30s
+            file: assertions/httproute-initial.yaml
+
+    - name: wait-for-initial-healthy
+      description: Wait for the initial rollout to reach Healthy before triggering a canary.
+      try:
+        - assert:
+            timeout: 5m
+            file: assertions/rollout-healthy.yaml
+
+    - name: trigger-canary
+      description: Update the rollout image to start a canary (setWeight:50 -> setHeaderRoute:X-QA -> pause:30s).
+      try:
+        - patch:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Rollout
+              metadata:
+                name: httproute-two-headers-rollout
+                namespace: default
+              spec:
+                template:
+                  spec:
+                    containers:
+                      - name: rollouts-demo
+                        image: argoproj/rollouts-demo:green
+
+    - name: assert-header-routing-active
+      description: >
+        Plugin must merge static-route headers into the managed rule. The managed rule must have
+        exactly 2 headers (X-Security inherited from the static rule + X-QA from setHeaderRoute),
+        ensuring it takes precedence over the 1-header static rule. Key assertion for issue #151.
+      try:
+        - assert:
+            timeout: 2m
+            file: assertions/httproute-with-header-route.yaml
+
+    - name: assert-rollout-healthy
+      description: Wait for the canary to complete (30s pause auto-expires).
+      try:
+        - assert:
+            timeout: 5m
+            file: assertions/rollout-healthy.yaml
+
+    - name: assert-cleanup
+      description: >
+        Plugin must remove the managed X-QA rule after rollout completes. Only the original
+        X-Security rule must remain, with canary weight reset to 0. No orphaned routes.
+      try:
+        - assert:
+            timeout: 60s
+            file: assertions/httproute-after-cleanup.yaml

test/e2e/chainsaw/httproute-two-headers/resources/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-two-headers
+  namespace: default
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: default
+  rules:
+    - matches:
+        - headers:
+            - name: X-Security
+              type: Exact
+              value: secret123
+      backendRefs:
+        - name: httproute-two-headers-stable-service
+          port: 80
+        - name: httproute-two-headers-canary-service
+          port: 80

test/e2e/chainsaw/httproute-two-headers/resources/rollout.yaml

@@ -0,0 +1,45 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  name: httproute-two-headers-rollout
+  namespace: default
+spec:
+  replicas: 2
+  strategy:
+    canary:
+      canaryService: httproute-two-headers-canary-service
+      stableService: httproute-two-headers-stable-service
+      trafficRouting:
+        managedRoutes:
+          - name: canary-route1
+        plugins:
+          argoproj-labs/gatewayAPI:
+            httpRoutes:
+              - name: httproute-two-headers
+                useHeaderRoutes: true
+            namespace: default
+      steps:
+        - setWeight: 50
+        - setHeaderRoute:
+            name: canary-route1
+            match:
+              - headerName: X-QA
+                headerValue:
+                  exact: "true"
+        - pause: {duration: 30s}   # auto-promotes — no promote command needed in tests
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: httproute-two-headers
+  template:
+    metadata:
+      labels:
+        app: httproute-two-headers
+    spec:
+      containers:
+        - name: rollouts-demo
+          image: argoproj/rollouts-demo:red
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP

test/e2e/chainsaw/httproute-two-headers/resources/services.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: httproute-two-headers-stable-service
+spec:
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: httproute-two-headers
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: httproute-two-headers-canary-service
+spec:
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: httproute-two-headers