fix: use default when namespace is unset by zirain · Pull Request #7612 · envoyproxy/gateway

zirain · 2025-11-26T23:15:31Z

Signed-off-by: zirain <[email protected]>

codecov · 2025-11-26T23:24:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.33%. Comparing base (f6dfa51) to head (93fe727).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7612      +/-   ##
==========================================
+ Coverage   72.28%   72.33%   +0.05%     
==========================================
  Files         232      232              
  Lines       34114    34115       +1     
==========================================
+ Hits        24658    24677      +19     
+ Misses       7679     7666      -13     
+ Partials     1777     1772       -5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2025-11-27T00:26:07Z

thanks @zirain , can we make similar changes in

gateway/internal/provider/kubernetes/helpers.go

Line 145 in f6dfa51

string(*gc.Spec.ParametersRef.Namespace) == ep.Namespace &&

&

gateway/internal/provider/kubernetes/helpers.go

Line 158 in f6dfa51

gc.Spec.ParametersRef.Namespace != nil &&

Signed-off-by: zirain <[email protected]>

arkodg · 2025-11-27T03:42:45Z

@zirain rereading the spec, https://github.com/kubernetes-sigs/gateway-api/blob/94655a15f0dce840a37cf06a7ebe67257fc29e61/apis/v1/gatewayclass_types.go#L144, we cannot assume nil namespace is default, if nil then the resource is cluster scoped

zirain · 2025-11-27T03:53:25Z

@zirain rereading the spec, https://github.com/kubernetes-sigs/gateway-api/blob/94655a15f0dce840a37cf06a7ebe67257fc29e61/apis/v1/gatewayclass_types.go#L144, we cannot assume nil namespace is default, if nil then the resource is cluster scoped

For EG, envoyproxy is a namespaced resource.
We should either use default when it's unset, or improve the error message.

arkodg · 2025-11-27T03:56:34Z

@zirain rereading the spec, https://github.com/kubernetes-sigs/gateway-api/blob/94655a15f0dce840a37cf06a7ebe67257fc29e61/apis/v1/gatewayclass_types.go#L144, we cannot assume nil namespace is default, if nil then the resource is cluster scoped

For EG, envoyproxy is a namespaced resource. We should either use default when it's unset, or improve the error message.

actually its fine, re-reading, its saying MUST be unset for cluster scoped

* fix: use default when namespace is unset Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix test Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit be2cc73) Signed-off-by: Huabing Zhao <[email protected]>

* fix: use default when namespace is unset Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix test Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]>

* fix(xds-server): clear snapshot on stream close (#6618) * fix(xds-server): clear snapshot on stream close Signed-off-by: Zachary Vacura <[email protected]> * check if there are other active connections before clearning the snapshot Signed-off-by: Zachary Vacura <[email protected]> Signed-off-by: jukie <[email protected]> * fix: oidc authentication endpoint was overwritten by discovered value (#7460) fix: oid authentication endpoint was overriden by discovered value Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: jukie <[email protected]> * ci: add script to free disk space (#7534) * feat: free disk space Signed-off-by: Shreemaan Abhishek <[email protected]> * lint Signed-off-by: Shreemaan Abhishek <[email protected]> * cleanup Signed-off-by: Shreemaan Abhishek <[email protected]> * make target and tools/hack Signed-off-by: Shreemaan Abhishek <[email protected]> * lint Signed-off-by: Shreemaan Abhishek <[email protected]> * modular action Signed-off-by: Shreemaan Abhishek <[email protected]> --------- Signed-off-by: Shreemaan Abhishek <[email protected]> Signed-off-by: jukie <[email protected]> * treat too many addresses as programmed (#7542) Signed-off-by: cong <[email protected]> Signed-off-by: jukie <[email protected]> * feat: reclaim space in release pipeline (#7587) Signed-off-by: Shreemaan Abhishek <[email protected]> Signed-off-by: jukie <[email protected]> * chore: bump golang.org/x/crypto (#7588) * chore: bump golang.org/x/crypto Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> * findOwningGateway should return controller based on linked GatewayClass (#7611) * fix: filter Gateway by controller in findOwningGateway Prevent cross-controller Gateway mutations by validating GatewayClass Signed-off-by: Sudipto Baral <[email protected]> Signed-off-by: jukie <[email protected]> * fix: use default when namespace is unset (#7612) * fix: use default when namespace is unset Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix test Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> * fix: prevent skeleton route status entries for unmanaged GatewayClasses (#7536) * fix: prevent skeleton route status entries for unmanaged GatewayClasses When processing policies (EnvoyExtensionPolicy, SecurityPolicy), the translator was calling GetRouteParentContext for ALL parentRefs in a route, even those referencing gateways with different GatewayClasses not managed by this translator. GetRouteParentContext creates a skeleton RouteParentStatus entry with just the controllerName when called on a parentRef that hasn't been processed yet. Since all GatewayClass instances share the same controller name, these skeleton entries persisted in status without conditions. The fix checks if a parentRef context already exists before attempting to apply policy configuration to it. If the context doesn't exist, it means this parentRef wasn't processed by this translator and should be skipped. Signed-off-by: Raj Singh <[email protected]> * fix: also prevent skeleton entries in BackendTrafficPolicy processing The same issue exists in BackendTrafficPolicy route processing - calling GetRouteParentContext for all parentRefs creates skeleton status entries. Apply the same fix: check if parentRef context exists before adding to list. Signed-off-by: Raj Singh <[email protected]> --------- Signed-off-by: Raj Singh <[email protected]> Signed-off-by: jukie <[email protected]> * lint Signed-off-by: jukie <[email protected]> --------- Signed-off-by: Zachary Vacura <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Shreemaan Abhishek <[email protected]> Signed-off-by: cong <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Sudipto Baral <[email protected]> Signed-off-by: Raj Singh <[email protected]> Co-authored-by: Zach Vacura <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: shreealt <[email protected]> Co-authored-by: 聪 <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Sudipto Baral <[email protected]> Co-authored-by: Raj Singh <[email protected]>

* fix: oidc authentication endpoint was overwritten by discovered value (#7460) fix: oid authentication endpoint was overriden by discovered value Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 50dcb15) Signed-off-by: Huabing Zhao <[email protected]> * fix: do not return 500 for all requests when part of BackendRefs are invalid (#7488) * do not return 500 for all requests when part of BackendRefs are invalid Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 2899416) Signed-off-by: Huabing Zhao <[email protected]> * fix: prevent skeleton route status entries for unmanaged GatewayClasses (#7536) * fix: prevent skeleton route status entries for unmanaged GatewayClasses When processing policies (EnvoyExtensionPolicy, SecurityPolicy), the translator was calling GetRouteParentContext for ALL parentRefs in a route, even those referencing gateways with different GatewayClasses not managed by this translator. GetRouteParentContext creates a skeleton RouteParentStatus entry with just the controllerName when called on a parentRef that hasn't been processed yet. Since all GatewayClass instances share the same controller name, these skeleton entries persisted in status without conditions. The fix checks if a parentRef context already exists before attempting to apply policy configuration to it. If the context doesn't exist, it means this parentRef wasn't processed by this translator and should be skipped. Signed-off-by: Raj Singh <[email protected]> * fix: also prevent skeleton entries in BackendTrafficPolicy processing The same issue exists in BackendTrafficPolicy route processing - calling GetRouteParentContext for all parentRefs creates skeleton status entries. Apply the same fix: check if parentRef context exists before adding to list. Signed-off-by: Raj Singh <[email protected]> --------- Signed-off-by: Raj Singh <[email protected]> (cherry picked from commit ff13742) Signed-off-by: Huabing Zhao <[email protected]> * treat too many addresses as programmed (#7542) Signed-off-by: cong <[email protected]> (cherry picked from commit 7cb5f72) Signed-off-by: Huabing Zhao <[email protected]> * bechmark: fix cpu sampling (#7581) use fixed duration for cpu rate Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit 536486f) Signed-off-by: Huabing Zhao <[email protected]> * chore: bump golang.org/x/crypto (#7588) * chore: bump golang.org/x/crypto Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 70fa59a) Signed-off-by: Huabing Zhao <[email protected]> * findOwningGateway should return controller based on linked GatewayClass (#7611) * fix: filter Gateway by controller in findOwningGateway Prevent cross-controller Gateway mutations by validating GatewayClass Signed-off-by: Sudipto Baral <[email protected]> (cherry picked from commit ba8e0e2) Signed-off-by: Huabing Zhao <[email protected]> * fix: use default when namespace is unset (#7612) * fix: use default when namespace is unset Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix test Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit be2cc73) Signed-off-by: Huabing Zhao <[email protected]> * bump Gateway API v1.4.1 (#7653) Signed-off-by: zirain <[email protected]> (cherry picked from commit 0fa26d7) Signed-off-by: Huabing Zhao <[email protected]> * update release note Signed-off-by: Huabing Zhao <[email protected]> * fix gen check Signed-off-by: Huabing Zhao <[email protected]> * ci: add script to free disk space (#7534) * feat: free disk space Signed-off-by: Shreemaan Abhishek <[email protected]> * lint Signed-off-by: Shreemaan Abhishek <[email protected]> * cleanup Signed-off-by: Shreemaan Abhishek <[email protected]> * make target and tools/hack Signed-off-by: Shreemaan Abhishek <[email protected]> * lint Signed-off-by: Shreemaan Abhishek <[email protected]> * modular action Signed-off-by: Shreemaan Abhishek <[email protected]> --------- Signed-off-by: Shreemaan Abhishek <[email protected]> (cherry picked from commit 4312f38) Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Raj Singh <[email protected]> Signed-off-by: cong <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Sudipto Baral <[email protected]> Signed-off-by: Shreemaan Abhishek <[email protected]> Co-authored-by: Raj Singh <[email protected]> Co-authored-by: 聪 <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Sudipto Baral <[email protected]> Co-authored-by: shreealt <[email protected]>

fix: use default when namespace is unset

d42518c

Signed-off-by: zirain <[email protected]>

zirain requested a review from a team as a code owner November 26, 2025 23:15

zirain added 2 commits November 27, 2025 08:44

fix

3f3bdca

Signed-off-by: zirain <[email protected]>

fix test

93fe727

Signed-off-by: zirain <[email protected]>

arkodg approved these changes Nov 27, 2025

View reviewed changes

arkodg requested review from a team November 27, 2025 03:57

arkodg added cherrypick/release-v1.6.1 cherrypick/release-v1.5.6 labels Nov 27, 2025

zhaohuabing approved these changes Nov 27, 2025

View reviewed changes

zirain merged commit be2cc73 into envoyproxy:main Nov 27, 2025
51 of 55 checks passed

zirain deleted the gc-paramref-ns branch November 27, 2025 06:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use default when namespace is unset#7612

fix: use default when namespace is unset#7612
zirain merged 3 commits intoenvoyproxy:mainfrom
zirain:gc-paramref-ns

zirain commented Nov 26, 2025

Uh oh!

codecov bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

zirain commented Nov 27, 2025

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

zirain commented Nov 26, 2025

Uh oh!

codecov bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

zirain commented Nov 27, 2025

Uh oh!

arkodg commented Nov 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Nov 26, 2025 •

edited

Loading