fix(egctl): skip missing CRDs in `x status` bulk modes by jeremiahsnapp · Pull Request #9099 · envoyproxy/gateway

jeremiahsnapp · 2026-05-28T02:56:04Z

What type of PR is this?

fix(egctl)

What this PR does / why we need it:

egctl x status all (and the related xroute / xpolicy bulk modes) aborts with an error when any of the Gateway API CRDs it iterates over is not installed in the cluster. For example, clusters that don't install TCPRoute see the entire command fail rather than returning status for the kinds that are installed — a poor UX for the "give me everything you can find" intent of all.

This PR detects the meta.NoMatchError returned by the controller-runtime client when a kind has no RESTMapping (i.e. the CRD isn't installed) and skips that kind in the bulk loops. When -v is set, a one-line notice is written to stderr so users can tell why a kind is missing from the output. Explicit single-resource invocations (e.g. egctl x status tcproute) are unchanged — they still error loudly so users get a clear signal when the kind they asked for is unavailable.

Release Notes: Yes

netlify · 2026-05-28T02:56:08Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`be95bed`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a1985bbdcd2040008ddd20c
😎 Deploy Preview	https://deploy-preview-9099--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

`egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]>

Signed-off-by: zirain <[email protected]>

codecov · 2026-05-29T12:35:37Z

Codecov Report

❌ Patch coverage is 0% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.74%. Comparing base (0edf51a) to head (be95bed).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/cmd/egctl/status.go	0.00%	12 Missing ⚠️

❌ Your patch check has failed because the patch coverage (0.00%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9099      +/-   ##
==========================================
- Coverage   74.82%   74.74%   -0.08%     
==========================================
  Files         252      252              
  Lines       40612    40624      +12     
==========================================
- Hits        30386    30365      -21     
- Misses       8154     8183      +29     
- Partials     2072     2076       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg

LGTM thanks !

`egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]> Signed-off-by: zirain <[email protected]>

* fix: encode TLS secrets with canonical PEM formatting (#8744) * exclude non-ready https Signed-off-by: Karol Szwaj <[email protected]> * prevent BoringSSL errors Signed-off-by: Karol Szwaj <[email protected]> * Add trailing newline to testdata PEMs Signed-off-by: Karol Szwaj <[email protected]> * add release notes Signed-off-by: Karol Szwaj <[email protected]> * use shallow copy instead of DeepCopy Signed-off-by: Karol Szwaj <[email protected]> * use maps.Clone for the data and split the PRs Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: zirain <[email protected]> * fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <[email protected]> * add release note Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: zirain <[email protected]> * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode (#8959) * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode Signed-off-by: nguyenptk <[email protected]> * extract loadServerTLSConfig helper and add tests Signed-off-by: nguyenptk <[email protected]> --------- Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> Signed-off-by: zirain <[email protected]> * fix(helm): correct typo in HPA maxReplicas required message (#9032) Signed-off-by: benjaminch <[email protected]> Signed-off-by: zirain <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target (#9068) * add passing testcase showing wildcard overriding sectioned backendTLSPolicy Signed-off-by: AlecDiraimondo <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target When two BackendTLSPolicies target the same backend — one with sectionName set, one without — the wildcard wins whenever it sorts earlier, since policies are iterated in creationTimestamp order with no specificity preference. The sectioned policy is silently dropped: never selected by the translator, no status written. Make getBackendTLSPolicy prefer policies with an explicit sectionName match before falling back to wildcard matches. Matches the specificity ordering SecurityPolicy already implements. Refs #9035 Signed-off-by: AlecDiraimondo <[email protected]> * update release notes Signed-off-by: AlecDiraimondo <[email protected]> * fixes from review: dedup helper, return early if backendTarget has no section specified Signed-off-by: AlecDiraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: zirain <[email protected]> * fix(egctl): skip missing CRDs in `x status` bulk modes (#9099) `egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]> Signed-off-by: zirain <[email protected]> * fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites (#9131) gatewayapi: reject BackendRef URLRewrite path modifiers Signed-off-by: Aditya7880900936 <[email protected]> Signed-off-by: zirain <[email protected]> * fix: force HTTP1 for Service/ServiceImport with websocket appProtocol (#9138) force HTTP1 for Service/ServiceImport with websocket appProtocol Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> Signed-off-by: benjaminch <[email protected]> Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Signed-off-by: Jeremiah Snapp <[email protected]> Signed-off-by: Aditya7880900936 <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: Nguyên (Harry) <[email protected]> Co-authored-by: BenjaminCh <[email protected]> Co-authored-by: Alec Diraimondo <[email protected]> Co-authored-by: Jeremiah Snapp <[email protected]> Co-authored-by: Aditya Sanskar Srivastav <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]>

* fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <[email protected]> * add release note Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> (cherry picked from commit 9430ab9) Signed-off-by: jukie <[email protected]> * fix: applyBackendTLSSetting panic (#8998) * fix: applyBackendTLSSetting panic Signed-off-by: zirain <[email protected]> (cherry picked from commit b754b68) Signed-off-by: jukie <[email protected]> * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode (#8959) * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode Signed-off-by: nguyenptk <[email protected]> * extract loadServerTLSConfig helper and add tests Signed-off-by: nguyenptk <[email protected]> --------- Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> (cherry picked from commit 35c5a12) Signed-off-by: jukie <[email protected]> * fix(helm): correct typo in HPA maxReplicas required message (#9032) Signed-off-by: benjaminch <[email protected]> (cherry picked from commit 8da6dc7) Signed-off-by: jukie <[email protected]> * fix: allow IANA cipher names (#9073) allow IANA cipher names Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit ea41d6f) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target (#9068) * add passing testcase showing wildcard overriding sectioned backendTLSPolicy Signed-off-by: AlecDiraimondo <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target When two BackendTLSPolicies target the same backend — one with sectionName set, one without — the wildcard wins whenever it sorts earlier, since policies are iterated in creationTimestamp order with no specificity preference. The sectioned policy is silently dropped: never selected by the translator, no status written. Make getBackendTLSPolicy prefer policies with an explicit sectionName match before falling back to wildcard matches. Matches the specificity ordering SecurityPolicy already implements. Refs #9035 Signed-off-by: AlecDiraimondo <[email protected]> * update release notes Signed-off-by: AlecDiraimondo <[email protected]> * fixes from review: dedup helper, return early if backendTarget has no section specified Signed-off-by: AlecDiraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> (cherry picked from commit 07ec95c) Signed-off-by: jukie <[email protected]> * fix: encode TLS secrets with canonical PEM formatting (#8744) * exclude non-ready https Signed-off-by: Karol Szwaj <[email protected]> * prevent BoringSSL errors Signed-off-by: Karol Szwaj <[email protected]> * Add trailing newline to testdata PEMs Signed-off-by: Karol Szwaj <[email protected]> * add release notes Signed-off-by: Karol Szwaj <[email protected]> * use shallow copy instead of DeepCopy Signed-off-by: Karol Szwaj <[email protected]> * use maps.Clone for the data and split the PRs Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Karol Szwaj <[email protected]> (cherry picked from commit 560a262) Signed-off-by: jukie <[email protected]> * fix: MaxStreamDuration should worked for non-route cluster (#9028) * fix: MaxStreamDuration should worked on commonHttpProtocolOptions Signed-off-by: zirain <[email protected]> * should only worked for non-route cluster Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 0edf51a) Signed-off-by: jukie <[email protected]> * fix(egctl): skip missing CRDs in `x status` bulk modes (#9099) `egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]> (cherry picked from commit 3ab110e) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites (#9131) gatewayapi: reject BackendRef URLRewrite path modifiers Signed-off-by: Aditya7880900936 <[email protected]> (cherry picked from commit acaf4cd) Signed-off-by: jukie <[email protected]> * fix: force HTTP1 for Service/ServiceImport with websocket appProtocol (#9138) force HTTP1 for Service/ServiceImport with websocket appProtocol Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit b1aa5d9) Signed-off-by: jukie <[email protected]> * fix: move validation admission policy outside of crds directory (#9024) * move validation admission policy outside of crds directory Signed-off-by: Huabing Zhao <[email protected]> * fix upgrade Signed-off-by: Huabing Zhao <[email protected]> * add release note Signed-off-by: Huabing Zhao <[email protected]> * fix Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * update relese note Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * fix gen Signed-off-by: Huabing Zhao <[email protected]> * use a more general name for this option Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> * rename Signed-off-by: Huabing Zhao <[email protected]> * update test Signed-off-by: Huabing Zhao <[email protected]> * update release note Signed-off-by: Huabing Zhao <[email protected]> * fix gen Signed-off-by: Huabing Zhao <[email protected]> * rename supportingResources to safeUpgradePolicy Signed-off-by: Huabing Zhao <[email protected]> * update Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: zirain <[email protected]> (cherry picked from commit 35ad8f2) Signed-off-by: jukie <[email protected]> * fix: alway include the controller namespace in the watched namespaces (#9100) * always include the controller namespace in the k8s provider Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330) * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> * minor changes Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix lint Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> (cherry picked from commit 5266322) Signed-off-by: jukie <[email protected]> * test(helm): regenerate safe-upgrade-policy-disabled golden for release/v1.8 The safe-upgrade-policy-disabled test case added in #9024 shipped a golden rendered against main's chart templates, which include features not present on release/v1.8 (automountServiceAccountToken, expanded HPA RBAC verbs, serviceaccount securityContext, ArgoCD/Flux hook comment). Regenerate the golden against the release branch templates and restore the release-pinned ratelimit image tag (ff287602). Signed-off-by: jukie <[email protected]> * regen Signed-off-by: jukie <[email protected]> * chore: bump golang to 1.26.4 (#9147) Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> Signed-off-by: benjaminch <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: Jeremiah Snapp <[email protected]> Signed-off-by: Aditya7880900936 <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Nguyên (Harry) <[email protected]> Co-authored-by: BenjaminCh <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Alec Diraimondo <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Co-authored-by: Jeremiah Snapp <[email protected]> Co-authored-by: Aditya Sanskar Srivastav <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>

`egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]>

jeremiahsnapp requested a review from a team as a code owner May 28, 2026 02:56

jeremiahsnapp force-pushed the fix/egctl-status-skip-missing-crds branch from 877f5ea to 90080a4 Compare May 29, 2026 10:55

zirain previously approved these changes May 29, 2026

View reviewed changes

Merge branch 'main' into fix/egctl-status-skip-missing-crds

be95bed

Signed-off-by: zirain <[email protected]>

zirain dismissed their stale review via be95bed May 29, 2026 12:25

zirain approved these changes May 29, 2026

View reviewed changes

arkodg approved these changes May 31, 2026

View reviewed changes

arkodg added cherrypick/release-v1.7.4 cherrypick/release-v1.8.1 labels May 31, 2026

arkodg merged commit 3ab110e into envoyproxy:main May 31, 2026
55 of 65 checks passed

zirain mentioned this pull request Jun 3, 2026

[release-1.7] cherry pick for v1.7.4 #9152

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(egctl): skip missing CRDs in `x status` bulk modes#9099

fix(egctl): skip missing CRDs in `x status` bulk modes#9099
arkodg merged 2 commits into
envoyproxy:mainfrom
jeremiahsnapp:fix/egctl-status-skip-missing-crds

jeremiahsnapp commented May 28, 2026

Uh oh!

netlify Bot commented May 28, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 29, 2026 •

edited

Loading

Uh oh!

arkodg left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jeremiahsnapp commented May 28, 2026

Uh oh!

netlify Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented May 28, 2026 •

edited

Loading

codecov Bot commented May 29, 2026 •

edited

Loading