Repository navigation
fix: CTP port overlap check fails when gateway name is a prefix of another - #9253
Closed
AruneshDwivedi wants to merge 1 commit into
Closed
AruneshDwivedi wants to merge 1 commit into
AruneshDwivedi wants to merge 1 commit into
Conversation
…lap validation When mergeGateways is enabled and two Gateways exist where one name is a string prefix of the other (e.g. 'gw' and 'gw-b'), a Gateway-wide ClientTrafficPolicy targeting the shorter-named Gateway was incorrectly accepted even though a same-port HTTP listener exists on the other Gateway. The port overlap validation used strings.Index without a trailing slash, causing 'envoy-gateway/gw' to falsely match 'envoy-gateway/gw-b/http'. This fix adds a trailing slash to the gateway name prefix and uses strings.HasPrefix for clarity. Fixes envoyproxy#9226 Signed-off-by: Arunesh Dwivedi <[email protected]>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
AruneshDwivedi
marked this pull request as ready for review
June 19, 2026 08:06
AruneshDwivedi
changed the title
Contributor
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions! |
Member
|
@AruneshDwivedi can you fix a conflict and add a testcase? |
Contributor
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions! |
9 of 11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When mergeGateways is enabled, two gateways with names like
gwandgw-bon the same port should conflict. They don't, because the prefix check invalidatePortOverlapForClientTrafficPolicyusesstrings.Indexwithout a trailing slash, so"envoy-gateway/gw"matches"envoy-gateway/gw-b/http".The same class of bug was fixed in #9026 for
extractListenerSetPrefixFromListenerby adding a trailing slash. Same approach here.Changes:
extractGatewayNameFromListener(irListenerName) + "/"-- adds trailing slash to the prefixstrings.HasPrefix(currName, gatewayName)instead ofstrings.Index(...) != 0-- clearer intent, same behaviorRepro: create gateways
gwandgw-bboth with port 8081, apply a gateway-wide CTP targetinggw. Before this fix it's accepted (wrong). After, it correctly returns an error about multiple listeners on the same port.Fixes #9226