@@ -208,38 +208,37 @@ func assertTrafficOnlyReachesToExpectedPodsDP(
208208 if err := gwhttp .CompareRoundTrip (t , & r , cReq , cRes , expected ); err != nil {
209209 return fmt .Errorf ("expectation failed: %w" , err )
210210 }
211- // Enforce no leakage to non-selected pods (ports/ranks are internal) .
211+ // Enforce no leakage to non-selected pods.
212212 if ! slices .Contains (expectedPodNames , cReq .Pod ) {
213213 return fmt .Errorf ("unexpected pod %q (expected one of %v)" , cReq .Pod , expectedPodNames )
214214 }
215215
216- // Validate X-Echo-HTTP-Port vs EPP intent for the pod's IP.
217- portHdr := getHeaderValue (cRes .Headers , "X-Echo-HTTP-Port" ) // Header set by backend echo server
218- if portHdr == "" {
219- return errors .New ("missing X-Echo-HTTP-Port response header" )
216+ // Validate httpPort from JSON response body vs EPP intent.
217+ if cReq .HTTPPort == "" {
218+ return errors .New ("missing httpPort in echo JSON body response" )
220219 }
221220 ip := podNameToIP [cReq .Pod ]
222221 allowed , ok := ipToAllowedPorts [ip ]
223222 if ! ok {
224223 return fmt .Errorf ("pod %q (IP %s) not present in EPP selection" , cReq .Pod , ip )
225224 }
226225 if len (allowed ) > 0 {
227- if _ , ok := allowed [portHdr ]; ! ok {
228- return fmt .Errorf ("unexpected X-Echo-HTTP-Port %q for IP %s (allowed: %v)" , portHdr , ip , keys (allowed ))
226+ if _ , ok := allowed [cReq . HTTPPort ]; ! ok {
227+ return fmt .Errorf ("unexpected httpPort %q for IP %s (allowed: %v)" , cReq . HTTPPort , ip , keys (allowed ))
229228 }
230229 } else {
231- if _ , ok := dpPorts [portHdr ]; ! ok {
232- return fmt .Errorf ("unexpected X-Echo-HTTP-Port %q for IP %s (expected one of DP ports %v)" , portHdr , ip , keys (dpPorts ))
230+ if _ , ok := dpPorts [cReq . HTTPPort ]; ! ok {
231+ return fmt .Errorf ("unexpected httpPort %q for IP %s (expected one of ports %v)" , cReq . HTTPPort , ip , keys (dpPorts ))
233232 }
234233 }
235234
236235 return nil
237236 })
238237 }
239238 if err := g .Wait (); err != nil {
240- t .Fatalf ("Requests were not confined to expected pods (DP) or failed port-header checks: %v" , err )
239+ t .Fatalf ("Requests were not confined to expected pods or failed port checks: %v" , err )
241240 }
242- t .Logf ("DP traffic restricted to %v and port header validated against EPP selection" , expectedPodNames )
241+ t .Logf ("Traffic restricted to %v and httpPort validated against EPP selection" , expectedPodNames )
243242}
244243
245244type portSet map [string ]struct {}
@@ -258,19 +257,8 @@ func keys(m portSet) []string {
258257 return out
259258}
260259
261- // getHeaderValue is a case-insensitive header lookup on headers using the key.
262- func getHeaderValue (headers map [string ][]string , key string ) string {
263- for k , v := range headers {
264- if strings .EqualFold (k , key ) && len (v ) > 0 {
265- return v [0 ]
266- }
267- }
268- return ""
269- }
270-
271- // buildEPPHeader builds the test EPP header (HeaderTestEppEndPointSelectionKey) from ip->ports.
272- // Empty portSet => emit just "IP". Non-empty => emit "IP:port" for each port.
273- // Sorted for determinism.
260+ // buildEPPHeader builds the test EPP header from ip->ports. AN empty portSet => emit just "IP".
261+ // A non-empty => emit "IP:port" for each port. Sorted for determinism.
274262func buildEPPHeader (ipToPorts map [string ]portSet ) string {
275263 ips := make ([]string , 0 , len (ipToPorts ))
276264 for ip := range ipToPorts {
0 commit comments