Commit d685fb3

Two hostname-policy details are worth stating precisely. The **HTTPRoute/TLSRoute/GRPCRoute** policies (`route-hostname-policy.yaml`) and the **legacy-Ingress** policy (`ingress-hostname-policy.yaml`) are fail-closed: a route or Ingress in a tenant namespace missing `namespace.cozystack.io/host` is denied, so an absent label cannot open those layers (the route policies also deny a route that declares no hostnames, since such a route inherits the hostnames of the listener it attaches to rather than matching nothing; the Ingress policy likewise denies hostless rules and `spec.defaultBackend`, and permits external custom domains outside the platform root apex). The **namespace host-label** policy is an immutability guard — it stops an untrusted caller from scrubbing or changing an already-set label, but it does not itself reject a namespace that never carried one. The **Gateway-listener** policy (`gateway-hostname-policy.yaml`) applies the same subdomain rule but its CEL short-circuits to allow when the host label is empty, so it is permissive (fail-open) for a tenant namespace that lacks the label. In normal operation the platform sets that label at tenant creation and the namespace host-label policy keeps it immutable, closing the gap in practice — but the Gateway-side guarantee is conditional on the label being present, not unconditional.

check:

($error == null): true

# A route that declares no hostname at all is the one shape the expression

# used to skip: it opened with `!has(object.spec.hostnames) ||`, so such a

# route satisfied the first operand and was admitted without a single

# hostname being compared. That route is not inert — under Gateway API it

# inherits the hostnames of the listener it attaches to, and parentRefs may

# name a Gateway in another namespace, so it ends up covering whatever that

# listener covers.

#

# Both empty shapes are probed because they reach the hole by different

# routes and one guard does not imply the other: the field being absent is

# caught by has(), while an explicitly empty list satisfies has() and then

# passes because all() over an empty list is vacuously true. Dropping either

# term from the CEL re-admits the whole shape, and the unit suite can only

# pin that the terms are present in the expression — this step is what proves

# the apiserver acts on them.

#

# HTTPRoute carries both cases. The TLSRoute probe is applied at v1alpha2

# because v1 and v1alpha3 mark spec.hostnames required with minItems: 1,

# leaving v1alpha2 the only version where a hostname-less TLSRoute reaches

# admission at all. It and the GRPCRoute probe carry the absent case only,

# and that is a coverage choice rather than a reachability fact: v1alpha2

# sets neither constraint, and the grpcroutes schema sets neither at any

# served version, so an explicitly empty list reaches admission on both

# just as an absent field does. All three policies render one

# byte-identical CEL string, so the HTTPRoute pair above already proves

# the empty-list term end to end.

# Scripted rather than an apply/expect pair so the grep can prove the VAP

# did the denying: a bare "the apply failed" assertion would be satisfied

# by a typo in the manifest.

- name: hostname-less-route-denied

try:

- script:

content: |

# The route is scripted rather than declared in gw-route-probe.yaml

# because it needs the tenant apex interpolated. This suite runs in

# tenant-test, which cozystack-route-hostname-policy matches, so a

# route naming no hostname is denied; the apex is read from the

# namespace label rather than hardcoded so the suite still passes on

# a dev cluster whose host differs from CI's. Same reason and same

# shape as own-apex-route-allowed above.

- script:

content: |

check:

($error == null): true

# Creation and assertions share one step so this reclaim covers both.

# It is needed because chainsaw reclaims what it applied from a file

# but not what a script created, and the suite runs in one long-lived

# namespace. finally runs at the end of its own step, so splitting

# the assertions into a later step would delete the route before they

# ran, and hanging the reclaim off that later step would leak the

# route whenever this one failed after the apply.

finally:

- delete:

ref:

apiVersion: gateway.networking.k8s.io/v1

kind: HTTPRoute

name: httproute-probe

# No hostname on the listener, so it matches whatever hostname the

# route declares. That is what keeps the Accepted and Programmed

# assertions independent of the cluster's apex.

// The redirect route this controller renders is infrastructure,

// not a hostname publication, so it must not drive listener or

// Certificate provisioning. It names the apex and its wildcard

// (see renderHTTPRedirect) to satisfy the route-hostname policy.

//

// Before this route carried hostnames it contributed nothing to

// the claim set; skipping it here restores exactly that. Letting

// its hostnames through instead provisions listeners and

// certificates for them, which fails.

if isHTTPRedirectRoute(route, tgw) {

continue

}

// No isHTTPRedirectRoute filter here, unlike the HTTPRoute loop

// above: this controller renders no TLSRoute, so there is nothing of

// its own to exclude. Add the equivalent guard here alongside the

// first controller-rendered TLSRoute, should one ever appear.

func isHTTPRedirectRoute(route *gatewayv1.HTTPRoute, tgw *gatewayv1alpha1.TenantGateway) bool {

return route.Namespace == tgw.Namespace &&

route.Name == httpRedirectRouteName(tgw) &&

ownedByTenantGateway(route.OwnerReferences, tgw)

}