TEST/MEDIUM: collect HUG debug artifacts on conformance MR failures

Add a conformance-collect-debug-mr task that retrieves pod logs,
haproxy.cfg, and map files from a running HUG pod after
the conformance run, storing them as CI artifacts to ease post-mortem
analysis of failures (e.g. HTTPRouteHTTPSListener flakiness).

Collection is opt-in via HUG_LABEL_COLLECT_LOGS, a pod label selector
(e.g. "run=hug-4ff08ccae6d535c8", where the sha is derived from the
gateway namespace/name). When the variable is empty (the default) the
task exits immediately and nothing is collected.

The deployer intentionally does not delete the matching pod when its
gateway is removed: it skips the Deployment and Service deletion for
that one pod and excludes it from WaitForCleanup, so the pod stays
alive between conformance test teardown and cluster deletion, giving
this task a window to pull the artifacts.

Author: hdurand0710

.aspell.yml

@@ -138,3 +138,4 @@ allowed:
   - runnable
   - statx
   - patref
+  - ccae

.gitlab/conformance-tests.yml

@@ -67,6 +67,14 @@ conformance-MR-GW-API-1_5_0:
     CONFORMANCE_JUNIT_HTML_OUTPUT: "${CI_PROJECT_DIR}/conformance-junit-1.5.0.html"
     CONFORMANCE_RUN_TEST: ""
     HUG_SERVICE_TYPE: "ClusterIP"
+    # Pod label selector for conformance-collect-debug-mr.
+    # When set, that task collects logs, haproxy.cfg and map files from the
+    # matching HUG pod after the conformance run. The deployer intentionally
+    # does NOT delete the pod when its gateway is removed, keeping it alive
+    # so artifacts can be retrieved here before the cluster is torn down.
+    # Leave empty (default) to skip collection entirely.
+    # Example: "run=hug-4ff08ccae6d535c8"  (sha derived from gateway ns/name)
+    HUG_LABEL_COLLECT_LOGS: ""
     CONFORMANCE_SKIP_TESTS: "\
       HTTPRouteHeaderMatching,\
       HTTPRouteInvalidBackendRefUnknownKind,\
@@ -95,12 +103,14 @@ conformance-MR-GW-API-1_5_0:
     - task conformance-build-test-image
     - task conformance-run-job
   after_script:
+    - task conformance-collect-debug-mr || true
     - task kind-delete
   artifacts:
     when: always
     paths:
       - conformance-report-1.5.0.yaml
       - conformance-junit-1.5.0.xml
       - conformance-junit-1.5.0.html
+      - debug-hug/
     reports:
       junit: conformance-junit-1.5.0.xml

taskfile/conformance.yml

@@ -185,6 +185,53 @@ tasks:
 
         exit ${JOB_STATUS}
 
+  conformance-collect-debug-mr:
+    desc: "collect HUG pod logs and HAProxy config/maps for post-mortem debugging (MR CI job)"
+    deps:
+      - task: check-kubectl
+    vars:
+      kubectl: "{{.TMP}}/kubectl/{{.KUBECTL_VERSION}}/kubectl"
+      DEBUG_DIR: '{{default "debug-hug" .DEBUG_DIR}}'
+      HUG_NS: "haproxy-unified-gateway"
+      # HUG_LABEL_COLLECT_LOGS: pod label selector for debug artifact collection.
+      # When set, collects logs, haproxy.cfg and map files from the matching HUG pod.
+      # The deployer intentionally does NOT delete the pod when its gateway is removed,
+      # keeping it alive so artifacts can be retrieved here before cluster teardown.
+      # Leave empty (default) to skip collection entirely.
+      # Example: "run=hug-4ff08ccae6d535c8"  (sha derived from gateway ns/name)
+      HUG_LABEL_COLLECT_LOGS: '{{default "" .HUG_LABEL_COLLECT_LOGS}}'
+    cmds:
+      - |
+        if [ -z "{{.HUG_LABEL_COLLECT_LOGS}}" ]; then
+          echo "HUG_LABEL_COLLECT_LOGS is not set — skipping debug collection"
+          exit 0
+        fi
+      - mkdir -p "{{.DEBUG_DIR}}"
+      - |
+        POD=$(/{{.kubectl}} get pod -n {{.HUG_NS}} -l {{.HUG_LABEL_COLLECT_LOGS}} \
+          -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+        if [ -z "$POD" ]; then
+          echo "No pod with label {{.HUG_LABEL_COLLECT_LOGS}} found — skipping debug collection"
+          exit 0
+        fi
+        echo "Collecting debug artifacts from pod: $POD (label: {{.HUG_LABEL_COLLECT_LOGS}})"
+        /{{.kubectl}} logs -n {{.HUG_NS}} "$POD" > "{{.DEBUG_DIR}}/hug-pod.log" 2>&1 || true
+        /{{.kubectl}} exec -n {{.HUG_NS}} "$POD" -- cat /usr/local/hug/haproxy.cfg \
+          > "{{.DEBUG_DIR}}/haproxy.cfg" 2>/dev/null || true
+        MAP_DIR=/usr/local/hug/maps/hug_https_443
+        for MAP in \
+          listener_exact_match.map \
+          listener_wildcard_match.map \
+          listener_route_exact_match.map \
+          listener_route_wildcard_match.map \
+          path_exact.map \
+          path_prefix.map \
+          path_regex.map; do
+          /{{.kubectl}} exec -n {{.HUG_NS}} "$POD" -- cat "${MAP_DIR}/${MAP}" \
+            > "{{.DEBUG_DIR}}/${MAP}" 2>/dev/null || true
+        done
+        echo "Debug artifacts written to {{.DEBUG_DIR}}"
+
   ### -----------------
   ### Tasks used for local tests
   ### Conformance tester runs outside the cluster

test/conformance/deployer/deployer.go

@@ -50,6 +50,12 @@ const (
 
 	defaultControllerNS    = "haproxy-unified-gateway"
 	defaultControllerLabel = "haproxy-unified-gateway"
+
+	// debugPreservedResource is the resource name of the HUG pod kept alive after
+	// its gateway is deleted so that the CI debug-collection task can retrieve
+	// haproxy.cfg and map files from it before the cluster is torn down.
+	// Corresponds to gateway-conformance-infra/same-namespace-with-https-listener.
+	debugPreservedResource = "hug-4ff08ccae6d535c8"
 )
 
 // Config holds the parameters for the Gateway deployer.
@@ -243,6 +249,10 @@ func (r *GatewayReconciler) reconcileService(ctx context.Context, gw *gatewayv1.
 // deleteResources removes the Deployment and Service created for a Gateway.
 func (r *GatewayReconciler) deleteResources(ctx context.Context, gwNS, gwName string) error {
 	name := resourceName(gwNS, gwName)
+	if name == debugPreservedResource {
+		_, _ = fmt.Fprintf(os.Stderr, "deployer: preserving %s/%s for post-mortem debug collection\n", r.Config.DeployerNs, name)
+		return nil
+	}
 	ns := r.Config.DeployerNs
 
 	deploy := &appsv1.Deployment{}
@@ -451,6 +461,8 @@ func WaitForCleanup(ctx context.Context, restCfg *rest.Config, deployerNs, gatew
 		); err != nil {
 			return err
 		}
+		deploys.Items = slices.DeleteFunc(deploys.Items, func(d appsv1.Deployment) bool { return d.Name == debugPreservedResource })
+		svcs.Items = slices.DeleteFunc(svcs.Items, func(s corev1.Service) bool { return s.Name == debugPreservedResource })
 		if len(deploys.Items) == 0 && len(svcs.Items) == 0 {
 			return nil
 		}