fix: exclude unmanaged route parents from xPolicy status ancestors by zhaohuabing · Pull Request #8321 · envoyproxy/gateway

zhaohuabing · 2026-02-22T15:26:56Z

This PR fixes xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs.

When an HTTPRoute has both:

a parent Gateway managed by Envoy Gateway, and
a parent Gateway from a different GatewayClass,

xPolicy.status.ancestors should only include the Envoy Gateway-managed parent(s).
Before this change, unmanaged parents could appear in xPolicy.status.ancestors.

Example:

Given:

managed-gateway with gatewayClassName: envoy-gateway-class
unmanaged-gateway with gatewayClassName: other-gateway-class
HTTPRoute mixed-parents-route with both parentRefs
SecurityPolicy route-policy targeting mixed-parents-route

Before this PR, SecurityPolicy.status.ancestors could include both gateways:

status:
  ancestors:
  - ancestorRef:
      name: managed-gateway
      kind: Gateway
      group: gateway.networking.k8s.io
      namespace: default
      sectionName: http
  - ancestorRef:
      name: unmanaged-gateway
      kind: Gateway
      group: gateway.networking.k8s.io
      namespace: default
      sectionName: http

After this PR, only EG-managed ancestors are reported:

  status:
    ancestors:
    - ancestorRef:
        name: managed-gateway
        kind: Gateway
        group: gateway.networking.k8s.io
        namespace: default
        sectionName: http

Fixes: #8320

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

netlify · 2026-02-22T15:27:02Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`d5ea0a4`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/699bafecef762e0008dd0d69

codecov · 2026-02-22T15:36:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.67%. Comparing base (7031394) to head (d5ea0a4).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8321      +/-   ##
==========================================
+ Coverage   73.66%   73.67%   +0.01%     
==========================================
  Files         242      242              
  Lines       37007    37014       +7     
==========================================
+ Hits        27261    27270       +9     
  Misses       7826     7826              
+ Partials     1920     1918       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-02-22T15:48:22Z

internal/gatewayapi/testdata/securitypolicy-mixed-managed-unmanaged-route-parents.out.yaml

+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: unmanaged-gateway


The unmanaged-gateway should not be in status.

…nged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]>

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

kkk777-7 · 2026-02-23T06:59:58Z

LGTM, thanks!

…nvoyproxy#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]>

…nvoyproxy#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix up release notes Signed-off-by: Karol Szwaj <[email protected]> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <[email protected]> * polish Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add e2e test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <[email protected]> * remove skipped tests Signed-off-by: zirain <[email protected]> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <[email protected]> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix gen-check Signed-off-by: Karol Szwaj <[email protected]> * add release notes Signed-off-by: Karol Szwaj <[email protected]> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Tejasriram Parvathaneni <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Kris Hicks <[email protected]> Co-authored-by: Felipe Sabadini Facina <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: Kris Hicks <[email protected]>

…nvoyproxy#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]>

…nvoyproxy#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]>

* fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <[email protected]> * remove skipped tests Signed-off-by: zirain <[email protected]> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <[email protected]> * polish Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add e2e test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix test race (#8180) * fix test race Signed-off-by: zirain <[email protected]> * use io.Discard Signed-off-by: zirain <[email protected]> * use sync.WaitGroup Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Isaac Wilson <[email protected]> Co-authored-by: Isaac Wilson <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix gen check Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: y-rabie <[email protected]> Signed-off-by: Tejasriram Parvathaneni <[email protected]> Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Isaac Wilson <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: y-rabie <[email protected]> Co-authored-by: Teja079 <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Co-authored-by: Felipe Sabadini <[email protected]> Co-authored-by: Isaac Wilson <[email protected]>

add test for mixed managed and unmanaged Gateway parents

5d887f2

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing requested a review from a team as a code owner February 22, 2026 15:26

zhaohuabing marked this pull request as draft February 22, 2026 15:27

zhaohuabing changed the title ~~add test for mixed managed and unmanaged Gateway parents~~ Fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs. Feb 22, 2026

zhaohuabing changed the title ~~Fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs.~~ fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs. Feb 22, 2026

zhaohuabing changed the title ~~fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs.~~ fix: exclude unmanaged route parents from xPolicy status ancestors Feb 22, 2026

zhaohuabing added cherrypick/release-v1.7.1 cherrypick/release-v1.6.5 labels Feb 22, 2026

zhaohuabing commented Feb 22, 2026

View reviewed changes

fix the policy status when the targeting routes have managed and unma…

d347e43

…nged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing force-pushed the fix-policy-status-mixed-parents branch from 00d163f to d347e43 Compare February 22, 2026 15:57

fix test

d5ea0a4

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing force-pushed the fix-policy-status-mixed-parents branch from 6ec20c0 to d5ea0a4 Compare February 23, 2026 01:39

zhaohuabing marked this pull request as ready for review February 23, 2026 01:45

zhaohuabing requested a review from arkodg February 23, 2026 03:13

kkk777-7 approved these changes Feb 23, 2026

View reviewed changes

zirain approved these changes Feb 24, 2026

View reviewed changes

cnvergence approved these changes Feb 24, 2026

View reviewed changes

cnvergence merged commit 26fa4e6 into envoyproxy:main Feb 24, 2026
57 of 59 checks passed

zhaohuabing deleted the fix-policy-status-mixed-parents branch March 2, 2026 05:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: exclude unmanaged route parents from xPolicy status ancestors#8321

fix: exclude unmanaged route parents from xPolicy status ancestors#8321
cnvergence merged 3 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-policy-status-mixed-parents

zhaohuabing commented Feb 22, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

zhaohuabing Feb 22, 2026

Uh oh!

kkk777-7 commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

zhaohuabing commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

kkk777-7 commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

zhaohuabing commented Feb 22, 2026 •

edited

Loading

netlify bot commented Feb 22, 2026 •

edited

Loading

codecov bot commented Feb 22, 2026 •

edited

Loading