fix: skip provision when IR Infra is invalid by zirain · Pull Request #7754 · envoyproxy/gateway

zirain · 2025-12-17T03:27:03Z

This patch follow up #7009, contains two fixes:

Gateway with valid EnvoyPorxy and GatewayClass with invalid EnvoyProxy should be provisioned
Failed gateways should not trigger IR deletion for Setting invalid values in EnvoyProxy deletes Deployment all together #7735

codecov · 2025-12-17T03:36:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.71%. Comparing base (79af9fe) to head (422b0d6).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7754      +/-   ##
==========================================
+ Coverage   73.67%   73.71%   +0.03%     
==========================================
  Files         241      241              
  Lines       36561    36569       +8     
==========================================
+ Hits        26937    26957      +20     
+ Misses       7712     7704       -8     
+ Partials     1912     1908       -4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2025-12-19T05:21:17Z

internal/gatewayapi/runner/runner.go

+				// For https://github.com/envoyproxy/gateway/issues/7735, if a gateway/gatewayclass
+				// referenced an invalid EnvoyProxy, it's part of failed gateways, we shouldn't delete
+				// the IR.
+				for _, gtw := range result.Gateways {


feel like a workaround, can we address this in a better way in the translator to populate Status w/o trckling down error to downstream callers

what about add a invalid/valid into Infra?

type Infra struct { Invalid *bool // Proxy defines managed proxy infrastructure. Proxy *ProxyInfra `json:"proxy" yaml:"proxy"` }

github-actions · 2026-01-18T08:02:48Z

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions!

netlify · 2026-01-20T05:59:30Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`422b0d6`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6982dbb68258be0008aa23ff

arkodg · 2026-01-24T16:25:12Z

internal/infrastructure/runner/runner.go

 				}
 			} else {
 				// Manage the proxy infra.
+				// Skip creating or updating infra if the Infra IR is invalid.


trying to better understand why this is needed

a failedGateway in the gateway API layer impacts Status of the Gateway

if we fail, we dont insert any invalid values in the IR

we have validations in the infra layer deal with errors

we are trying to allow partial valid IRs to go through

we dont insert any invalid values in the IR

if we do this, there will be a delete event in Infra layer.

can you elaborate here

#7735 (comment) showed the delete event.

thats because it most likely deleted the infra IR instead of creating an Infra IR with unset stat val

that's what I did in internal/gatewayapi/translator.go L474.

arkodg · 2026-01-30T03:01:17Z

internal/ir/infra.go

 type Infra struct {
+	// Invalid indicates whether the IR is invalid.
+	// This is an optional bool so that we won't update all existing files.
+	Invalid *bool `json:"invalid,omitempty" yaml:"invalid,omitempty"`


is this needed anymore ?

internal/gatewayapi/translator.go

zhaohuabing · 2026-02-02T09:31:31Z

internal/gatewayapi/translator.go


 // InitIRs checks if mergeGateways is enabled in EnvoyProxy config and initializes XdsIR and InfraIR maps with adequate keys.
-func (t *Translator) InitIRs(gateways []*GatewayContext) (map[string]*ir.Xds, map[string]*ir.Infra) {
+func (t *Translator) InitIRs(acceptedGateways, failedGateways []*GatewayContext) (map[string]*ir.Xds, map[string]*ir.Infra) {


Nit: the two loops inside this method are exact the same and can be a bit confusing when reading the code(I expected there are different behaviors when I reviewed the code at the first time).

It can be simplified as:

func (t *Translator) InitIRs(gateways []*GatewayContext) (map[string]*ir.Xds, map[string]*ir.Infra) {

with one loop.

Also, it would be good to add a line of comment to the caller to explain why the Infra IRs of failed Gateways also need to be created.

we shouldn't merge them, in most of the cases, we just need acceptedGateways.
failedGateways will be removed in the next iteration.

internal/infrastructure/runner/runner.go

zhaohuabing

LGTM thanks!

Signed-off-by: zirain <[email protected]>

arkodg · 2026-02-04T05:08:49Z

internal/gatewayapi/translator.go

 		}
 		gCtx.attachEnvoyProxy(resources, envoyproxyMap)

+		if gateway.Spec.GatewayClassName != t.GatewayClassName {


why does this need to be moved down

arkodg · 2026-02-04T05:10:12Z

internal/cmd/egctl/testdata/translate/out/invalid-envoyproxy.all.yaml

+      port: 8080
+      protocol: HTTP
+  status:
+    conditions:


follow up, should this be Accepted:True and ResolvedRefs:False ?
cc @zhaohuabing

should we use RefNotPermitted here?

// This condition indicates whether the controller was able to resolve all // the object references for the Gateway that are not part of a specific // Listener configuration, and also provides a positive-polarity summary of // Listener's "ResolvedRefs" condition. This condition does not directly // impact the Gateway's Accepted or Programmed conditions. // // Possible reasons for this condition to be True are: // // * "ResolvedRefs" // // Possible reasons for this condition to be False are: // // * "RefNotPermitted" // * "InvalidClientCertificateRef" // * "ListenersNotResolved" // // Controllers may raise this condition with other reasons, but should // prefer to use the reasons listed above to improve interoperability. // // Note: This condition is considered Experimental and may change in future // releases of the API.

probably ListenersNotResolved, from https://github.com/kubernetes-sigs/gateway-api/blob/8ecfe98081f74aec9eb8c44ef265380e2edb9094/apis/v1/gateway_types.go#L1323
RefNotPermitted seems more scoped to ReferenceGrant issues

internal/gatewayapi/translator.go

Signed-off-by: zirain <[email protected]>

zirain · 2026-02-04T07:36:17Z

/retest

cnvergence

lgtm

* fix: do not trigger IR deletion when EnvoyProxy is invalid Signed-off-by: zirain <[email protected]> * add Invalid to ir.Infra Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> * remove invalid Signed-off-by: zirain <[email protected]> * add comments Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> * merge loop Signed-off-by: zirain <[email protected]> * move back Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]>

* fix: do not trigger IR deletion when EnvoyProxy is invalid Signed-off-by: zirain <[email protected]> * add Invalid to ir.Infra Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> * remove invalid Signed-off-by: zirain <[email protected]> * add comments Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> * merge loop Signed-off-by: zirain <[email protected]> * move back Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Karol Szwaj <[email protected]>

* chore(docs): Update Azure Entra link in OIDC guide (#8167) Update Azure Entra link in OIDC guide Signed-off-by: Guy Daich <[email protected]> * fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153) continue processing the remaining xDS with invalid EnvoyPatchPolicies Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * build(deps): bump the actions group across 1 directory with 2 updates (#8178) Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `docker/login-action` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) Updates `github/codeql-action` from 4.32.0 to 4.32.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b20883b...6bc82e0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Isaac Wilson <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: skip provision when IR Infra is invalid (#7754) * fix: do not trigger IR deletion when EnvoyProxy is invalid Signed-off-by: zirain <[email protected]> * add Invalid to ir.Infra Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> * remove invalid Signed-off-by: zirain <[email protected]> * add comments Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> * merge loop Signed-off-by: zirain <[email protected]> * move back Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * docs: add HTTP header and method based authentication task (#7990) * docs: add HTTP header and method based authentication task Signed-off-by: Aditya Sanskar Srivastav <[email protected]> * docs: replace api-key examples with user header Signed-off-by: Aditya Sanskar Srivastav <[email protected]> * docs: format header and method authentication examples Signed-off-by: Aditya Sanskar Srivastav <[email protected]> * docs: add header and method based authorization examples Signed-off-by: Aditya Sanskar Srivastav <[email protected]> --------- Signed-off-by: Aditya Sanskar Srivastav <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: Validation of XListenerSet certificateRefs (#8168) Previously, validateTerminateModeAndGetTLSSecrets would always use the namespace of the listener's gateway when verifying a cross-namespace ref. This meant that if the listener were from an XListenerSet, whether or not the Secret associated with the certificateRef was in the same namespace as the XListenerSet, it would not be permitted. Additionally, and relatedly, this fixes an issue where an XListenerSet could reference a Secret in the gateway's namespace without a ReferenceGrant being present. With this change we add a new GetNamespace() method to gatewayapi.ListenerContext which returns the listener's gateway's namespace for a listener added directly to the gateway, or the XListenerSet's namespace otherwise. This is similar to some of the other methods that were added to ListenerContext in support of XListenerSets. The new method is used when creating the `crossNamespaceFrom` to determine if the certificateRef is permitted. If the Secret and XListenerSet are in the same namespace, it is permitted. If that is not the case a ReferenceGrant from the XListenerSet to the Secret will be properly searched for. Signed-off-by: krishicks <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: Remove whitespace for nodeSelector in deployment YAML - helm chart change (#8185) Remove whitespace for nodeSelector in deployment YAML Signed-off-by: Jess Belliveau <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * [release/v1.7.0] release notes (#8188) Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Guy Daich <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Aditya Sanskar Srivastav <[email protected]> Signed-off-by: krishicks <[email protected]> Signed-off-by: Jess Belliveau <[email protected]> Co-authored-by: Guy Daich <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Isaac Wilson <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Aditya Sanskar Srivastav <[email protected]> Co-authored-by: krishicks <[email protected]> Co-authored-by: Jess Belliveau <[email protected]>

* fix: do not trigger IR deletion when EnvoyProxy is invalid Signed-off-by: zirain <[email protected]> * add Invalid to ir.Infra Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> * remove invalid Signed-off-by: zirain <[email protected]> * add comments Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> * merge loop Signed-off-by: zirain <[email protected]> * move back Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]>

zirain marked this pull request as ready for review December 17, 2025 03:27

zirain requested a review from a team as a code owner December 17, 2025 03:27

arkodg reviewed Dec 19, 2025

View reviewed changes

github-actions bot added stale and removed stale labels Jan 18, 2026

zirain force-pushed the fix/7735 branch from 0834813 to 491ff99 Compare January 20, 2026 05:59

zirain force-pushed the fix/7735 branch from 3f4763b to b0fe06d Compare January 20, 2026 06:15

zirain changed the title ~~fix: do not trigger IR deletion when EnvoyProxy is invalid~~ fix: skip provision when IR Infra is invalid Jan 20, 2026

zirain requested a review from arkodg January 20, 2026 11:10

zirain force-pushed the fix/7735 branch 2 times, most recently from 03445f7 to 93c06e9 Compare January 20, 2026 12:31

arkodg reviewed Jan 24, 2026

View reviewed changes

arkodg added this to the v1.7.0 Release milestone Jan 28, 2026

zirain force-pushed the fix/7735 branch from 93c06e9 to ca7ca39 Compare January 29, 2026 09:27

arkodg reviewed Jan 30, 2026

View reviewed changes

internal/gatewayapi/translator.go Show resolved Hide resolved

zirain force-pushed the fix/7735 branch 2 times, most recently from 8fceb39 to e5af1ce Compare January 30, 2026 05:37

zhaohuabing reviewed Feb 2, 2026

View reviewed changes

internal/infrastructure/runner/runner.go Show resolved Hide resolved

zhaohuabing previously approved these changes Feb 3, 2026

View reviewed changes

zirain requested a review from arkodg February 3, 2026 03:40

zirain dismissed zhaohuabing’s stale review via 9c6e4bc February 3, 2026 05:08

zirain added 4 commits February 3, 2026 13:25

fix: do not trigger IR deletion when EnvoyProxy is invalid

57ec432

Signed-off-by: zirain <[email protected]>

add Invalid to ir.Infra

c839278

Signed-off-by: zirain <[email protected]>

fix gen

92c9522

Signed-off-by: zirain <[email protected]>

add e2e

48a3d9c

Signed-off-by: zirain <[email protected]>

zirain added 4 commits February 3, 2026 13:25

remove invalid

740ec80

Signed-off-by: zirain <[email protected]>

add comments

051d32d

Signed-off-by: zirain <[email protected]>

update

c74d004

Signed-off-by: zirain <[email protected]>

merge loop

fb98dea

Signed-off-by: zirain <[email protected]>

zirain force-pushed the fix/7735 branch from 9c6e4bc to fb98dea Compare February 3, 2026 05:26

arkodg reviewed Feb 4, 2026

View reviewed changes

internal/gatewayapi/translator.go Show resolved Hide resolved

move back

422b0d6

Signed-off-by: zirain <[email protected]>

arkodg approved these changes Feb 4, 2026

View reviewed changes

zirain requested a review from zhaohuabing February 4, 2026 08:13

cnvergence approved these changes Feb 4, 2026

View reviewed changes

zirain merged commit 93da4ca into envoyproxy:main Feb 4, 2026
78 of 82 checks passed

zirain deleted the fix/7735 branch February 4, 2026 09:58

Conversation

zirain commented Dec 17, 2025

Uh oh!

codecov bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 18, 2026

Uh oh!

netlify bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zhaohuabing Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zhaohuabing left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zirain commented Feb 4, 2026

Uh oh!

cnvergence left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Dec 17, 2025 •

edited

Loading

netlify bot commented Jan 20, 2026 •

edited

Loading

zhaohuabing Feb 2, 2026 •

edited

Loading