Skip to content

fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies#8153

Merged
arkodg merged 1 commit intoenvoyproxy:mainfrom
zhaohuabing:fix-8151
Feb 4, 2026
Merged

fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies#8153
arkodg merged 1 commit intoenvoyproxy:mainfrom
zhaohuabing:fix-8151

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Feb 2, 2026 •
edited
Loading

fix: #8151

This PR ignores the invalid EnvoyPatchPolicy in the xDS translator and continue pushing the xDS for unrelated resources to the Envoy fleet.

Errors from the invalid EnvoyPatchPolicy are logged in the Envoy Gateway logs, and surfaced in the Programmed condition of the EnvoyPatchPolicy's status.

@zhaohuabing zhaohuabing requested a review from a team as a code owner February 2, 2026 05:18
@netlify
Copy link
Copy Markdown

netlify bot commented Feb 2, 2026 •
edited
Loading

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit 342718d
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6981858efb0afe00088693d2

@zhaohuabing zhaohuabing marked this pull request as draft February 2, 2026 05:19
zhaohuabing
zhaohuabing commented Feb 2, 2026
View reviewed changes
internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-empty-jsonpath.clusters.yaml
- maxRetries: 1024
commonLbConfig:
localityWeightedLbConfig: {}
commonLbConfig: {}
Copy link
Copy Markdown
Member Author

@zhaohuabing zhaohuabing Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This and the other xds test out yaml files were added before and never updated afterward, since the invalid EnvoyPatchPolicies didn't produce any xDS output.

@zhaohuabing zhaohuabing marked this pull request as ready for review February 2, 2026 05:34
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 2, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.69%. Comparing base (79af9fe) to head (342718d).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8153      +/-   ##
==========================================
+ Coverage   73.67%   73.69%   +0.01%     
==========================================
  Files         241      241              
  Lines       36561    36561              
==========================================
+ Hits        26937    26943       +6     
+ Misses       7712     7709       -3     
+ Partials     1912     1909       -3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zhaohuabing zhaohuabing mentioned this pull request Feb 2, 2026
Merged
@arkodg arkodg added this to the v1.7.0 Release milestone Feb 3, 2026
arkodg
arkodg previously approved these changes Feb 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

zirain
zirain previously approved these changes Feb 3, 2026
View reviewed changes
@zirain zirain dismissed stale reviews from arkodg and themself via 342718d February 3, 2026 05:20
@zhaohuabing
Copy link
Copy Markdown
Member Author

zhaohuabing commented Feb 3, 2026

The diff looks good. Thanks! @zirain

@kkk777-7
Copy link
Copy Markdown
Member

kkk777-7 commented Feb 3, 2026

LGTM, thanks!

@arkodg arkodg merged commit 6cf677d into envoyproxy:main Feb 4, 2026
56 of 59 checks passed
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
89e9979 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
1d27a83 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
7fc123a 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
cnvergence added a commit that referenced this pull request Feb 5, 2026
@cnvergence @guydc
@zhaohuabing @dependabot @jukie @zirain @Aditya7880900936 @krishicks @jess-belliveau
[release/v1.7] v1.7.0 cherrypick (#8190)
da2aac9 
* chore(docs): Update Azure Entra link in OIDC guide (#8167)

Update Azure Entra link in OIDC guide

Signed-off-by: Guy Daich <[email protected]>

* fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* build(deps): bump the actions group across 1 directory with 2 updates (#8178)

Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

Updates `github/codeql-action` from 4.32.0 to 4.32.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b20883b...6bc82e0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Isaac Wilson <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* fix: skip provision when IR Infra is invalid (#7754)

* fix: do not trigger IR deletion when EnvoyProxy is invalid

Signed-off-by: zirain <[email protected]>

* add Invalid to ir.Infra

Signed-off-by: zirain <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

* add e2e

Signed-off-by: zirain <[email protected]>

* remove invalid

Signed-off-by: zirain <[email protected]>

* add comments

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

* merge loop

Signed-off-by: zirain <[email protected]>

* move back

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* docs: add HTTP header and method based authentication task (#7990)

* docs: add HTTP header and method based authentication task

Signed-off-by: Aditya Sanskar Srivastav <[email protected]>

* docs: replace api-key examples with user header

Signed-off-by: Aditya Sanskar Srivastav <[email protected]>

* docs: format header and method authentication examples

Signed-off-by: Aditya Sanskar Srivastav <[email protected]>

* docs: add header and method based authorization examples

Signed-off-by: Aditya Sanskar Srivastav <[email protected]>

---------

Signed-off-by: Aditya Sanskar Srivastav <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* fix: Validation of XListenerSet certificateRefs (#8168)

Previously, validateTerminateModeAndGetTLSSecrets would always use the
namespace of the listener's gateway when verifying a cross-namespace
ref.

This meant that if the listener were from an XListenerSet, whether or
not the Secret associated with the certificateRef was in the same
namespace as the XListenerSet, it would not be permitted.

Additionally, and relatedly, this fixes an issue where an XListenerSet
could reference a Secret in the gateway's namespace without a
ReferenceGrant being present.

With this change we add a new GetNamespace() method to
gatewayapi.ListenerContext which returns the listener's gateway's
namespace for a listener added directly to the gateway, or the
XListenerSet's namespace otherwise. This is similar to some of the other
methods that were added to ListenerContext in support of XListenerSets.

The new method is used when creating the `crossNamespaceFrom` to
determine if the certificateRef is permitted. If the Secret and
XListenerSet are in the same namespace, it is permitted. If that is not
the case a ReferenceGrant from the XListenerSet to the Secret will be
properly searched for.

Signed-off-by: krishicks <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* fix: Remove whitespace for nodeSelector in deployment YAML - helm chart change (#8185)

Remove whitespace for nodeSelector in deployment YAML

Signed-off-by: Jess Belliveau <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* [release/v1.7.0] release notes (#8188)

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Guy Daich <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: Aditya Sanskar Srivastav <[email protected]>
Signed-off-by: krishicks <[email protected]>
Signed-off-by: Jess Belliveau <[email protected]>
Co-authored-by: Guy Daich <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Isaac Wilson <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Aditya Sanskar Srivastav <[email protected]>
Co-authored-by: krishicks <[email protected]>
Co-authored-by: Jess Belliveau <[email protected]>
zirain pushed a commit to zirain/gateway that referenced this pull request Feb 9, 2026
@zhaohuabing @zirain
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
96f6d6a 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
@zhaohuabing zhaohuabing deleted the fix-8151 branch February 11, 2026 01:34
zirain added a commit that referenced this pull request Feb 11, 2026
@zirain @Aditya7880900936
@arkodg @zhaohuabing @jukie
[release-1.6] cherry pick for v1.6.4 (#8218)
0838745 
* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API (#7793)

* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API

Signed-off-by: Aditya7880900936 <[email protected]>

* fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <[email protected]>

* gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs

Signed-off-by: Aditya7880900936 <[email protected]>

* Update internal/gatewayapi/backendtlspolicy.go

Co-authored-by: Arko Dasgupta <[email protected]>
Signed-off-by: Aditya Sanskar Srivastav <[email protected]>

* gatewayapi: align BackendTLSPolicy invalid CA status and formatting

Signed-off-by: Aditya7880900936 <[email protected]>

* gatewayapi: align BackendTLSPolicy invalid CA error message with validation output

Signed-off-by: Aditya7880900936 <[email protected]>

* testdata: regenerate BackendTLSPolicy invalid CA output

Signed-off-by: Aditya7880900936 <[email protected]>

* fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind

Signed-off-by: Aditya7880900936 <[email protected]>

* chore(gatewayapi): fix import grouping in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <[email protected]>

---------

Signed-off-by: Aditya7880900936 <[email protected]>
Signed-off-by: Aditya Sanskar Srivastav <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>

* feat: Ignore ready and stats listener metrics in shutdown manager calculation (#7985)

* feat: Ignore ready and stats listener metrics in shutdown manager calculation

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

* refactor

Signed-off-by: zirain <[email protected]>

* remove USE_SERVER_CONNECTIONS

Signed-off-by: zirain <[email protected]>

* address review comment

Signed-off-by: zirain <[email protected]>

* display the real value

Signed-off-by: zirain <[email protected]>

* comment for worker thread

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>

* fix: custom response should be put at the first of the filter chain (#8061)

* fix: custom response should be put before oauth2

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* move the custom response filter to first

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* add release note

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix: route idle timeout (#8058)

* fix: route idle timeout

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* address comments

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* add test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix: remove global logger in message package (#8131)

* fix: remove global logger in message package

Signed-off-by: zirain <[email protected]>

* fix: TCPRoute mTLS didn't work (#8152)

* fix: remove auto HTTP config on TCP cluster

Signed-off-by: zirain <[email protected]>

* fix lint

Signed-off-by: zirain <[email protected]>

* add e2e

Signed-off-by: zirain <[email protected]>

* fix e2e

Signed-off-by: zirain <[email protected]>

* fix comment

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

* fix resource name

Signed-off-by: zirain <[email protected]>

* address Arko's comment

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>

* fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

* fix: controller cache-sync readiness check (#7430)

Signed-off-by: zirain <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

* release notes for v1.6.4 (#8221)

* release notes for v1.6.4

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>

* update VERSION

Signed-off-by: zirain <[email protected]>

* update release notes

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: Aditya7880900936 <[email protected]>
Signed-off-by: Aditya Sanskar Srivastav <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Aditya Sanskar Srivastav <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Isaac Wilson <[email protected]>
Inode1 pushed a commit to Inode1/gateway that referenced this pull request Feb 23, 2026
@zhaohuabing
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
1901085 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zirain zirain zirain approved these changes

@kkk777-7 kkk777-7 kkk777-7 approved these changes

@arkodg arkodg arkodg left review comments

Assignees

No one assigned

Labels

cherrypick/release-v1.6.4

Projects

None yet

Milestone

v1.7.0 Release

Development

Successfully merging this pull request may close these issues.

EnvoyPatchPolicy with JSONPatch blocks xDS updates when target objects don’t exist (control plane stuck)

4 participants

@zhaohuabing @kkk777-7 @zirain @arkodg