Description

BuildGWStatus (and the other report builders) stamped each condition's ObservedGeneration from the live object re-read by the status syncer (s.mgr.GetClient(), the controller-runtime cache), while the report that triggers the sync is produced by translation from a separate cache (the istio KRT cache backing GatewayIndex.Gateways).

The status syncer is driven only by report changes. When those two caches skew — translation observes a new generation and enqueues a report, but the syncer's live read still returns the old generation — the sync fires once, stamps the stale generation, and nothing re-triggers it. observedGeneration then freezes at the old value.

This was masked before #14295: report-map equality was pointer-identity (always unequal), so status re-synced on every translation tick and a later tick eventually stamped the current generation. #14295 made report equality a deep value comparison, so status now only re-syncs on a real report diff — exposing the freeze.

It surfaced as the GatewayObservedGenerationBump conformance test hanging for its full 300s budget (and pushing the suite past the Go test timeout, producing a panic: test timed out) instead of passing in ~3s. The failure is intermittent because it depends on which informer wins the cache race at sync time.

What changed

Source the ObservedGeneration stamp from the report's generation instead of the live object, across all report builders, so the value that triggers the sync and the value that is published always agree:

• BuildGWStatus — gateway and listener conditions (gwReport.observedGeneration).
• BuildRouteStatus — parentRef conditions (routeReport.observedGeneration).
• BuildBackendStatus — report.observedGeneration.
• BuildListenerSetStatus — listener and listener-set conditions (lsReport.observedGeneration).
• BuildPolicyStatus — already report-driven; no change.

This is also more correct: observedGeneration should reflect the generation that was actually translated, not whatever the live cache happens to show.

pkg/reports/observed_generation_test.go replaces the prior "FromCurrentObject" tests with skew regression tests covering both directions (report ahead of a stale live read, and report behind the live read) for Gateway, Route, Backend, and ListenerSet.

Notes for reviewers

• This reverses the intent of the *RefreshesObservedGenerationFromCurrentObject tests (added in Implement BackendTLSPolicy core conformance #13801). Report-driven stamping is the correct semantics: because the syncer is triggered only by report changes, stamping from the live read is exactly what enables the freeze.
• agentgateway's equivalent control plane already stamps from the report and builds status inside its translation collection (no separate cross-cache syncer read), which is why it doesn't exhibit this bug — this change brings kgateway's stamping in line.

Change Type

/kind fix

Changelog

Fixed a bug where a Gateway, Route, Backend, or ListenerSet status observedGeneration could intermittently freeze at a stale value after a spec change, due to a skew between the translation cache and the status syncer's cache.