fix: apply TrafficPolicy timeouts per route at the vhost level#14374
Merged
Conversation
A TrafficPolicy targeting a Gateway HTTP listener section attaches at the Envoy virtual-host level. Timeouts (and other route-action-level settings) are only applied per route, so they were silently dropped for such policies even though the policy reported as Accepted. HTTPS listener and whole-Gateway targeting were unaffected since they attach at the RouteConfiguration level. Generalize ApplyVhostPlugin to apply the full per-route settings to every route in the vhost via a shared applyPerRouteSettings helper, mirroring applyGatewayLevelPerRouteSettings. The existing 'only set if not already set' guards preserve merge precedence. Add gateway translator tests for TrafficPolicy timeout targeting the whole Gateway, an HTTP listener, and an HTTPS listener. Signed-off-by: omar <[email protected]>
gateway-bot
added
do-not-merge/description-invalid
kind/fix
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes TrafficPolicy route-action settings (notably request timeouts, plus other per-route settings like retries, URL rewrite, internal redirect, auto host rewrite, and route tracing) being dropped when a TrafficPolicy targets a Gateway HTTP listener section (vhost-attached). It generalizes the vhost plugin path to apply the full set of per-route settings to each route in the virtual host, matching the existing gateway/HTTPS-listener (RouteConfiguration-attached) behavior.
Changes:
- Introduces a shared
applyPerRouteSettingshelper and reuses it for both gateway-level and vhost-level policy application. - Updates
ApplyVhostPluginto apply all per-route TrafficPolicy settings per-route (instead of only retry). - Adds gateway translator golden tests covering TrafficPolicy request timeouts targeting: whole Gateway, HTTP listener section, and HTTPS listener section.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go | Applies full TrafficPolicy per-route settings to each route for vhost-attached policies via a shared helper. |
| pkg/kgateway/translator/gateway/gateway_translator_test.go | Adds translator test cases for whole-gateway, HTTP-listener, and HTTPS-listener timeout targeting scenarios. |
| pkg/kgateway/translator/gateway/testutils/inputs/traffic-policy/timeout-gateway-whole.yaml | New input fixture for whole-Gateway timeout behavior across HTTP+HTTPS listeners. |
| pkg/kgateway/translator/gateway/testutils/inputs/traffic-policy/timeout-gateway-http-listener.yaml | New input fixture for HTTP listener section timeout behavior. |
| pkg/kgateway/translator/gateway/testutils/inputs/traffic-policy/timeout-gateway-https-listener.yaml | New input fixture for HTTPS listener section timeout behavior. |
| pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/timeout-gateway-whole.yaml | New golden output validating whole-Gateway timeout emission on both listeners’ routes. |
| pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/timeout-gateway-http-listener.yaml | New golden output validating HTTP-listener-section timeout emission on vhost routes. |
| pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/timeout-gateway-https-listener.yaml | New golden output validating HTTPS-listener-section timeout emission on routes. |
Add a gateway translator test where a Gateway HTTP listener timeout (30s) is inherited by one route rule and overridden by a more specific route-level TrafficPolicy timeout (5s) on another rule, mirroring listener-retry.yaml. This exercises the override precedence through applyPerRouteSettings at the vhost level. Signed-off-by: omar <[email protected]>
davidjumani
approved these changes
Jul 10, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 10, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #14360. That PR moved TrafficPolicy retry from the vhost level to per route inside
ApplyVhostPlugin, but only handled retry. TrafficPolicy timeouts (and the other route-action-level settings) were still silently dropped when a policy targeted a Gateway HTTP listener section.The reason: an HTTP listener sharing a port attaches at the Envoy virtual-host level, and
ApplyVhostPluginnever applied timeouts there. The policy reported asAcceptedwithattachedRoutes: 1, but notimeoutwas emitted on the route action, so it had no dataplane effect. Whole-Gateway and HTTPS-listener targeting were unaffected because they attach at the RouteConfiguration level (viaapplyGatewayLevelPerRouteSettings).This generalizes the vhost path to apply the full per-route settings (timeouts, retries, url rewrite, internal redirect, auto host rewrite, route tracing) to every route in the vhost, via a shared
applyPerRouteSettingshelper that mirrorsapplyGatewayLevelPerRouteSettings. The existing "only set if not already set" guards inhandlePerRoutePoliciespreserve merge precedence (a more specific TrafficPolicy or builtin HTTPRoute policy still wins).Also adds gateway-translator tests for TrafficPolicy timeout targeting the whole Gateway, an HTTP listener, and an HTTPS listener. Refreshing all goldens changed no existing output, confirming retry and every other behavior is unchanged.
Change Type
/kind fix
Changelog