fix: report BackendTrafficPolicy TargetNotFound when it attaches to no target#9416
fix: report BackendTrafficPolicy TargetNotFound when it attaches to no target#9416vishalsolanki-fs wants to merge 2 commits into
Conversation
…o target A BackendTrafficPolicy that resolves to zero targets left its status stale: - targetRef/targetRefs pointing at a nonexistent object kept Accepted=True with an out-of-date observedGeneration, and emitted no negative condition (envoyproxy#8926). The policy was added to the result set but processing returned early once the target object could not be resolved, so no ancestor status was ever written. - targetSelectors that match no objects never added the policy to the result set at all, so its status was never reconciled and stayed stale (envoyproxy#8927). After all target-processing loops, report any policy that resolved to zero ancestors with Accepted=False, reason TargetNotFound, and the current generation. Policies using explicit targetRefs use the unresolved target as the ancestor ref; selector-only policies reference the policy itself. Fixes envoyproxy#8926 Fixes envoyproxy#8927 Signed-off-by: Vishal <[email protected]> Co-authored-by: Cursor <[email protected]>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f799e2f21
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| } | ||
| // If the policy attached to at least one target, it already has ancestor | ||
| // status set by the processing loops above; leave it untouched. | ||
| if len(policy.Status.Ancestors) > 0 { |
There was a problem hiding this comment.
Do not treat copied ancestors as current attachments
Because backendTrafficPolicyCopiesWithStatusDeepCopy preserves the policy's existing status, an unattached policy that previously had any ancestor (for example, a selector that used to match or a targetRef edited to a missing route) reaches this branch with stale ancestors even though none of the processing loops handled it. This continue leaves the old Accepted=True condition and observedGeneration in the returned status, so the stale-status scenario this block is meant to fix still reproduces for existing policies; only brand-new policies with empty status get TargetNotFound.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fair point, inferring "attached" from existing ancestor status is fragile since the copies preserve prior status. Pushed a fix, the process funcs now return whether they actually attached, and any unattached policy has its carried-over ancestors cleared before TargetNotFound is set. Added a golden with pre-existing stale status to cover it. @codex review
There was a problem hiding this comment.
Codex Review: Didn't find any major issues. Hooray!
Reviewed commit: 751ff5e35c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Track whether each policy actually attached to a target during translation instead of inferring it from the presence of ancestor status. A policy that carries ancestor status from a previous generation (e.g. it used to match a target but its targetRef/targetSelectors were then changed to match nothing) would otherwise skip the TargetNotFound handling and keep its stale Accepted=True condition. Now any policy not attached to a target this pass has its carried-over ancestors cleared before TargetNotFound is set with the current generation. Adds a golden case exercising a policy with pre-existing stale status. Signed-off-by: Vishal <[email protected]> Co-authored-by: Cursor <[email protected]>
|
instead of the status generation layer, we probably should clean up older stale statuses in cc @zhaohuabing |
Thanks @arkodg , A couple of things I ran into while prototyping the
|
I opened #9420 as an alternative implementation. |
What this fixes
A
BackendTrafficPolicythat resolves to zero targets currently leaves its status stale. This PR makes the translator report such policies explicitly. It addresses two separate issues with the same symptom but different root causes:targetRef/targetRefspointing at a nonexistent object. The policy is added to the result set, butprocessBackendTrafficPolicyForRoute/processBackendTrafficPolicyForGatewayreturn early once the target object cannot be resolved (targetedRoute == nil/targetedGateway == nil), so no ancestor status is ever written. The result:Accepted=Truepersists with a staleobservedGenerationand no negative condition.targetSelectorsthat match no objects. The policy is never added to the result set at all (selector resolution returns nothing), so its status is never reconciled and stays stale.The fix
After all target-processing loops in
ProcessBackendTrafficPolicies, any policy that resolved to zero ancestors is now reported with:Accepted = FalseTargetNotFoundmetadata.generationasobservedGenerationPolicies that attached to at least one target are left untouched. Selector-only policies that matched nothing are added to the result set so their status is published.
Follows an existing pattern in the repo
This change reuses the status-reporting building blocks already used across the codebase rather than introducing new ones:
gwapiv1.PolicyReasonTargetNotFoundreason is already used in the repo for the "section within an existing target not found" case (e.g.validate.goandresolveClientTrafficPolicyTargetRefinclienttrafficpolicy.go). This PR extends that same reason to the "target object entirely missing / zero targets matched" case.status.SetConditionForPolicyAncestorhelper, the same helper already used throughoutProcessBackendTrafficPolicies.Design note — ancestor reference for unattached policies
Per the Gateway API, each
PolicyAncestorStatusentry must carry anancestorRef. When aBackendTrafficPolicyresolves to zero targets there is no resolvedGatewayto use as the ancestor, so this PR chooses one deterministically:targetRef/targetRefs, the (unresolved) target is used as theancestorRef, so the reported status points directly at the missing object.targetSelectors(which reference no named object), the policy references itself as theancestorRef.I'd appreciate maintainer confirmation that this ancestor convention is acceptable, since the Gateway API doesn't prescribe one for the "attached to nothing" case.
Scope
This PR is intentionally scoped to
BackendTrafficPolicyto keep it focused on the two filed issues. The same early-return / never-added gap exists in the sibling policy types (SecurityPolicy,ClientTrafficPolicy, and others). If the maintainers are happy with the approach and the ancestor convention above, I'm glad to generalize it across the other policy types in a follow-up PR.Testing
backendtrafficpolicy-targetref-not-found(BackendTrafficPolicy status does not report missing targetRef and leaves stale observedGeneration #8926)backendtrafficpolicy-selector-no-match(BackendTrafficPolicy status becomes stale when targetSelectors change from matching routes to matching no routes #8927)backendtrafficpolicy-status-conditions— four not-found policies that previously producedancestors: nullnow reportTargetNotFound.policy-cross-namespace-targetselector-missing-referencegrant-{gateway,route}— the policy previously vanished from output entirely and is now reported.go test ./internal/gatewayapi/...passes;go vetandgofmtare clean.Release note
Added
release-notes/current/bug_fixes/8926-btp-status-target-not-found.md.Made with Cursor