apply TrafficPolicy retry per route instead of per vhost#14360
Merged
Conversation
Apply the retry policy to each route rather than to the virtual host. A route-level retry policy (set by a more specific TrafficPolicy or the builtin HTTPRouteRetry policy) fully overrides the vhost-level one in Envoy, so applying it per route keeps that precedence explicit and consistent with the other per-route settings. Signed-off-by: omar <[email protected]>
puertomontt
changed the title
gateway-bot
added
do-not-merge/description-invalid
kind/feature
Contributor
There was a problem hiding this comment.
Pull request overview
This PR changes how TrafficPolicy retry settings are applied during Gateway translation: instead of setting retries at the Envoy virtual host level, it applies them at the route level. This makes retry precedence explicit and consistent with Envoy semantics, where route-level retry configuration fully overrides vhost-level configuration.
Changes:
- Introduces a shared
applyRetryPolicyhelper that only sets a route retry policy if one is not already present (preserving precedence for builtinHTTPRouteRetryand more-specificTrafficPolicyattachments). - Updates
ApplyVhostPluginto apply retry settings to each route in the vhost rather than to the vhost itself. - Adds a new golden test case (
traffic-policy/http-retry.yaml) and wires it intoTestBasic.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go | Moves retry application from vhost scope to per-route scope and centralizes the “only-if-unset” behavior in applyRetryPolicy. |
| pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/timeout-retry.yaml | Updates golden output to reflect retry policy being present on routes rather than on virtual hosts. |
| pkg/kgateway/translator/gateway/testutils/inputs/traffic-policy/http-retry.yaml | Adds an input fixture covering a TrafficPolicy retry attached directly to an HTTPRoute. |
| pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/http-retry.yaml | Adds the corresponding golden output validating route-level retry policy emission. |
| pkg/kgateway/translator/gateway/gateway_translator_test.go | Adds a test case to execute the new golden input/output pair. |
Add a golden test where a Gateway-listener-attached retry TrafficPolicy (via sectionName) shares a vhost with two routes: one rule with its own route-attached retry and one without. This pins both behaviors of the per-route retry translation independently of the timeout-retry fixture: - the listener retry fans out onto the retry-less route (rule1) - a more specific route-attached retry wins over the listener one (rule0) Signed-off-by: omar <[email protected]>
davidjumani
reviewed
Jul 9, 2026
| } | ||
|
|
||
| p.handlePolicies(pCtx.FilterChainName, &pCtx.TypedFilterConfig, policy.spec) | ||
| p.applyGatewayLevelPerRouteSettings(policy.spec, out) |
davidjumani
approved these changes
Jul 9, 2026
davidjumani
approved these changes
Jul 9, 2026
Contributor
Author
|
context: just making this more consistent since https doesn't carry vhost policies |
This was referenced Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Previously the
TrafficPolicyretry policy was applied at the virtual host level viaApplyVhostPlugin. This changes it to apply the retry policy to each route instead.In Envoy, a route-level retry policy fully overrides the vhost-level one, so a more specific
TrafficPolicy(or the builtinHTTPRouteRetrypolicy) attached at the route level would silently take precedence over a vhost-attachedTrafficPolicyretry. Applying the retry policy per route makes that precedence explicit and consistent with how the other per-route settings are handled.Changes:
applyRetryPolicyhelper that sets the retry policy on a route only when one is not already set (preserving the builtinHTTPRouteRetry/ more-specificTrafficPolicyprecedence).ApplyVhostPluginnow iterates the vhost's routes and applies the retry policy to each, replacinghandlePerVHostPolicies.handlePerRoutePoliciesuses the same helper.traffic-policy/http-retry.yaml) exercising aTrafficPolicyretry attached to anHTTPRoute.Change Type
/kind feature
Changelog