fix(status): separate listener programmed state from HTTPRoute Accepted condition#9129
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
💡 Codex Review
gateway/internal/gatewayapi/route.go
Line 2295 in ee64be4
When the only allowed listener is unprogrammed, this shared path now records Accepted=True for every route kind, but processUDPRouteParentRefs and processTCPRouteParentRefs still leave their local accepted flag false until listener.IsReady() succeeds; they then overwrite the condition with Accepted=False / UnsupportedValue and the misleading "Multiple routes on the same ... listener" message. This means the readiness/acceptance split is only correct for HTTP/GRPC/TLS, while valid TCPRoute/UDPRoute bindings to an unprogrammed listener still report rejected with the wrong reason; either those route-specific fallbacks need to distinguish unready listeners, or this shared change should not apply to those route kinds.
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9129 +/- ##
==========================================
- Coverage 74.90% 74.86% -0.04%
==========================================
Files 252 252
Lines 40797 40781 -16
==========================================
- Hits 30559 30531 -28
- Misses 8154 8165 +11
- Partials 2084 2085 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
|
/retest |
1 similar comment
|
/retest |
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
| Added support for authorization path match. | ||
|
|
||
| bug fixes: | | ||
| Fixed HTTPRoute Accepted condition being set to False when an attached listener is not programmed due to a missing TLS certificate ref; listener programmed state is now correctly separated from route acceptance. |
There was a problem hiding this comment.
Nit: can we also mention other Route types that are affected by this PR?
|
Nit: can we remove |
| @@ -63,9 +63,9 @@ tlsRoutes: | |||
| parents: | |||
There was a problem hiding this comment.
Nit: the filename says “not attaching,” but the route status is now Accepted=True.
Can we rename the file to tlsroute-with-tls-listener-missing-mode.in(out).yaml?
zhaohuabing
left a comment
There was a problem hiding this comment.
LGTM, with a few non-blocking nits.
|
65734cd to
4f647cb
Compare
| '@type': type.googleapis.com/envoy.admin.v3.RoutesConfigDump | ||
| ``` | ||
|
|
||
| ### Validating Gateway API Configuration |
There was a problem hiding this comment.
why is this being deleted, output will need to be revised
There was a problem hiding this comment.
That example demonstrated a scenario where an HTTPRoute is Accepted: False due to NoReadyListeners, which this PR prevents from occurring. Per @zhaohuabing suggestion I removed it rather than revising it, since the example's premise no longer applies.
|
ooc, as an application owner, how am I supposed to now know if the listener is working as expected, which will decide if the route works or not |
The listener's Programmed condition on the Gateway or ListenerSet is the right place to check listener health, imo. |
an app dev might not have access to a gateway namespace |
Yes, that is true and a good point. I put a query out to the sig-network-gateway-api channel on the Kubernetes Slack. |
…ed condition Remove the NoReadyListeners block that set Accepted: False on routes when no listeners were programmed. Route acceptance reflects binding validity; listener programmed state is already tracked by the listener's own conditions. Signed-off-by: apkatsikas <[email protected]>
…e Accepted condition Routes with a valid binding to an unprogrammed listener now correctly reach Accepted=True regardless of listener readiness. Moves accepted=true and IncrementAttachedRoutes before the IsReady check so the Accepted condition reflects binding validity only, consistent with the HTTPRoute fix and the Gateway API spec. Signed-off-by: apkatsikas <[email protected]>
…nflicted listener Signed-off-by: apkatsikas <[email protected]>
Signed-off-by: apkatsikas <[email protected]>
…dition fix release note Signed-off-by: apkatsikas <[email protected]>
Signed-off-by: apkatsikas <[email protected]>
4f647cb to
8edd0c2
Compare
Response from Kubernetes team/Nick Young: @arkodg any remaining concerns on this PR? |
Signed-off-by: Arko Dasgupta <[email protected]>
|
thanks for getting this clarified in upstream @apkatsikas ! |
…ed condition (envoyproxy#9129) * fix(status): separate listener programmed state from HTTPRoute Accepted condition Remove the NoReadyListeners block that set Accepted: False on routes when no listeners were programmed. Route acceptance reflects binding validity; listener programmed state is already tracked by the listener's own conditions. Signed-off-by: apkatsikas <[email protected]> * fix(status): separate listener programmed state from TCPRoute/UDPRoute Accepted condition Routes with a valid binding to an unprogrammed listener now correctly reach Accepted=True regardless of listener readiness. Moves accepted=true and IncrementAttachedRoutes before the IsReady check so the Accepted condition reflects binding validity only, consistent with the HTTPRoute fix and the Gateway API spec. Signed-off-by: apkatsikas <[email protected]>
* fix rate limit validation on K8s 1.36 (#9166) fixi: rate limit validation on K8s 1.36 Starting with K8s 1.36 the int range and maximum are validated against each other, which breaks the BTP tests. This can be fixed validating the field as uint32. Signed-off-by: Clemens Beck <[email protected]> Co-authored-by: Clemens Beck <[email protected]> (cherry picked from commit a21fd29) Signed-off-by: jukie <[email protected]> * fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges (#9050) * fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges and loadBalancerIP Signed-off-by: Marc 'risson' Schmitt <[email protected]> (cherry picked from commit 3c1d7b9) Signed-off-by: jukie <[email protected]> * fix: allow Backend TLS to disable ALPN with an empty list (#9162) * Fixed Backend TLS to disable upstream ALPN instead of inheriting EnvoyProxy BackendTLS defaults. Signed-off-by: Huabing Zhao <[email protected]> * add test case for envoyproxy without tls Signed-off-by: Huabing Zhao <[email protected]> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> (cherry picked from commit 21eb101) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): sort api key auth credentials (#9042) * fix(gatewayapi): sort api key auth credentials Signed-off-by: Alexej Disterhoft <[email protected]> * docs(release-notes): add api key auth fix note Signed-off-by: Alexej Disterhoft <[email protected]> --------- Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: zirain <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: zirain <[email protected]> (cherry picked from commit b96a2d3) Signed-off-by: jukie <[email protected]> * fix(status): separate listener programmed state from HTTPRoute Accepted condition (#9129) * fix(status): separate listener programmed state from HTTPRoute Accepted condition Remove the NoReadyListeners block that set Accepted: False on routes when no listeners were programmed. Route acceptance reflects binding validity; listener programmed state is already tracked by the listener's own conditions. Signed-off-by: apkatsikas <[email protected]> * fix(status): separate listener programmed state from TCPRoute/UDPRoute Accepted condition Routes with a valid binding to an unprogrammed listener now correctly reach Accepted=True regardless of listener readiness. Moves accepted=true and IncrementAttachedRoutes before the IsReady check so the Accepted condition reflects binding validity only, consistent with the HTTPRoute fix and the Gateway API spec. Signed-off-by: apkatsikas <[email protected]> (cherry picked from commit e9c3ac5) Signed-off-by: jukie <[email protected]> * fix: reject ExternalName Service as a route backend (#9190) fix: reject Service as a route backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit ee16b3f) Signed-off-by: jukie <[email protected]> * fix(status): fall back to service externalIPs for Gateway addresses (#9209) When the Envoy service is of type LoadBalancer but no load balancer controller assigns an ingress address (e.g. bare-metal clusters), the Gateway status had no addresses and stayed Programmed=False with reason AddressNotAssigned, even when reachable addresses were configured via spec.externalIPs (e.g. through an EnvoyProxy service patch). Use spec.externalIPs as a fallback when the load balancer ingress list is empty. Ingress addresses keep priority when present, so behavior is unchanged for clusters with a working load balancer controller. Fixes #8987 Signed-off-by: Jules Dutel <[email protected]> (cherry picked from commit f2c0921) Signed-off-by: jukie <[email protected]> * fix: don't duplicate ValidatingAdmissionPolicy in install.yaml (#9182) * Fix duplicate VAP in install.yaml Signed-off-by: jukie <[email protected]> * Add regression check and release notes Signed-off-by: jukie <[email protected]> --------- Signed-off-by: jukie <[email protected]> (cherry picked from commit 332081c) Signed-off-by: jukie <[email protected]> * fix(listenerset): implement hostname conflict listener precedence (#9192) * fix(listenerset): implement hostname conflict listener precedence - In Gateway, multiple listeners with the same hostname all get marked Conflicted (no winner). In ListenerSet, a Gateway-owned listener wins over ListenerSet listeners; among ListenerSet listeners the first in processing order wins. - Conflicted ListenerSet listeners now get Accepted=False and Programmed=False with the conflict reason (HostnameConflict or ProtocolConflict), matching the Gateway API conformance expectation. - AttachedListenerSets on the Gateway status is now incremented only for ListenerSets that have at least one accepted listener, aligning with the spec definition of "successfully attached". Signed-off-by: zirain <[email protected]> * ListenerSet conflict Signed-off-by: zirain <[email protected]> * fix and improve message Signed-off-by: zirain <[email protected]> * better display gateway listener Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 9271654) Signed-off-by: jukie <[email protected]> * fix: correct the config hot reload validation order (#9214) Co-authored-by: Nimisha Mehta <[email protected]> (cherry picked from commit 7e4492d) Signed-off-by: jukie <[email protected]> * feat(helm): add CRDs dependency toggle (#8850) * feat(helm): add CRDs dependency toggle Allow skipping installation of the `crds` dependency on the gateway-helm chart by providing a conditional `crds.enabled` variable. This boolean defaults to `true` and toggles the inclusion of the dependency on the parent chart. ref: #8560 Signed-off-by: Gaston Festari <[email protected]> * docs: update Helm installation steps Use the `crds.enabled` variable in the examples instead of the `--skip-crds` flag. Update crds.enabled variable description. Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Gaston Festari <[email protected]> --------- Signed-off-by: Gaston Festari <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 62e01ce) Signed-off-by: jukie <[email protected]> * fix: validate API Key auth ExtractFrom (#9250) * fix: validate API Key auth ExtractFrom Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 50b1339) Signed-off-by: jukie <[email protected]> * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum (#9224) * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum The constant held "Disabled" but the CRD enum specifies "Off", causing xRateLimitHeaders: "Off" to silently fall through the translator switch and always emit X-RateLimit headers. Fixes #9223 Signed-off-by: gianniskt <[email protected]> * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum The constant held "Disabled" but the CRD enum specifies "Off", causing xRateLimitHeaders: "Off" to silently fall through the translator switch and always emit X-RateLimit headers. Fixes #9223 Signed-off-by: gianniskt <[email protected]> * fix: add release note for XRateLimitHeadersOptionDisabled fix Signed-off-by: gianniskt <[email protected]> --------- Signed-off-by: gianniskt <[email protected]> Signed-off-by: Ioannis Koutroumpis <[email protected]> (cherry picked from commit 43c9d8e) Signed-off-by: jukie <[email protected]> * fix(ratelimit): shared global ratelimit with cost not working (#9245) * fix(ratelimit): shared global ratelimit with cost not working Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix mixed shared rule Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 7997791) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): http retry without backoff (#9238) * fix http retry without backoff Signed-off-by: zirain <[email protected]> * release notes Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 4872e53) Signed-off-by: jukie <[email protected]> * fix: panic with empty deploy (#9365) Signed-off-by: zirain <[email protected]> (cherry picked from commit 42a0c2c) Signed-off-by: jukie <[email protected]> * chore: restore current.yaml after cherry-picks The cherry-picked bug-fix commits appended their release-note entries to release-notes/current.yaml. Those notes are already finalized in release-notes/v1.8.2.yaml, so restore current.yaml to its prior state to avoid duplicating them in the next release cycle. Signed-off-by: jukie <[email protected]> * [release-1.8] bump ratelimit image to 1e50889b Bump the Envoy Ratelimit image from ff287602 to 1e50889b in source and the gateway-helm chart, and note the bump under security updates in the v1.8.2 release notes. Signed-off-by: jukie <[email protected]> * testdata Signed-off-by: jukie <[email protected]> * fix: use int64 format for ratelimit Requests field (#9377) Signed-off-by: jukie <[email protected]> --------- Signed-off-by: Clemens Beck <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: Marc 'risson' Schmitt <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: apkatsikas <[email protected]> Signed-off-by: Jules Dutel <[email protected]> Signed-off-by: Gaston Festari <[email protected]> Signed-off-by: gianniskt <[email protected]> Signed-off-by: Ioannis Koutroumpis <[email protected]> Co-authored-by: Clemens Beck <[email protected]> Co-authored-by: Clemens Beck <[email protected]> Co-authored-by: Marc 'risson' Schmitt <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Alexej Disterhoft <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Andrew Katsikas <[email protected]> Co-authored-by: jvlxz <[email protected]> Co-authored-by: Mengjia Liang <[email protected]> Co-authored-by: Nimisha Mehta <[email protected]> Co-authored-by: Gaston Festari <[email protected]> Co-authored-by: Ioannis Koutroumpis <[email protected]>
What type of PR is this?
fix
What this PR does / why we need it:
When a route is attached to a listener that has a missing TLS certificate ref, Envoy Gateway was incorrectly setting
Accepted: Falsewith reasonNoReadyListenerson the route. The ListenerSet and its listener entry both correctly remainAccepted: Truein this scenario; only the listener'sProgrammedcondition isFalse.Route acceptance reflects binding validity: whether the route matches a listener by hostname,
allowedRoutes, andsectionName. The Gateway API spec defines valid reasons forAccepted: Falseon a route (NotAllowedByListeners,NoMatchingListenerHostname,NoMatchingParent, etc.); none reference listener programmed state. There is no spec-defined route condition that represents listener readiness, and the listener's ownProgrammed: Falseis sufficient to surface the unready state.This change:
HasReadyListenerblock that setAccepted: False / NoReadyListenerson routes when no listeners were programmed. Routes with a valid binding now correctly reachAccepted: Trueregardless of listener programmed state.processTCPRouteParentRefsandprocessUDPRouteParentRefs, which had the same conflation:acceptedwas only set totrueafterIsReady()succeeded, causing valid TCPRoute/UDPRoute bindings to an unprogrammed listener to receiveAccepted: False / UnsupportedValuewith a misleading "Multiple routes on the same listener" message.Accepted: Falsenow assertAccepted: True, which is the correct expected state; they continue to validate listener-level conditions which are unchanged.Which issue(s) this PR fixes:
Fixes #9128 #9012
Release Notes: Yes