gateway-api: Fixes for TLSRoute conformance#44397
Merged
julianwiedmann merged 2 commits intocilium:mainfrom Feb 20, 2026
Merged
gateway-api: Fixes for TLSRoute conformance#44397julianwiedmann merged 2 commits intocilium:mainfrom
julianwiedmann merged 2 commits intocilium:mainfrom
Conversation
19d75b5 to
673a6be
Compare
Contributor
Author
|
/test |
mhofstetter
approved these changes
Feb 17, 2026
Member
mhofstetter
left a comment
There was a problem hiding this comment.
lgtm, only commented on some nits. I expect the conformance tests catch potential issues 😇
also adding @xtineskim - maybe she wants to take a second look too.
This commit adds the new TLSRoute hostname intersection test added to Gateway API in v1.5, which tests behavior that Cilium has had subtly incorrect for some time. This adds a custom sorter for hostnames, which enables the hostname intersection calculation to be correct. This also required changing some details in how the model lists backends, in `model.TLSBackends()`. Signed-off-by: Nick Young <nick@isovalent.com>
673a6be to
8d5b244
Compare
Contributor
Author
|
/test |
xtineskim
reviewed
Feb 18, 2026
...teway/tlsroute-invalid-no-matching-listener/input/tlsroute-invalid-no-matching-listener.yaml
Show resolved
Hide resolved
8d5b244 to
6cffa2f
Compare
Contributor
Author
|
/test |
This commit fixes a bug with Gateway API reconciliation, where TLSRoutes were allowed to attach to HTTPS listeners. By the Gateway API spec, they are only allowed to attach to TLS listeners. Similarly, this updates HTTPRoute and GRPCRoute processing to not be able to attach to TLS listeners - also not allowed by the spec. Signed-off-by: Nick Young <nick@isovalent.com>
6cffa2f to
577d2af
Compare
Contributor
Author
|
/test |
Member
I'll go ahead and set the matching labels then, please double-check if that was the intention. |
3 tasks
21 tasks
Member
|
@youngnick I marked this as backport/author because it introduced too many conflicts during the backport. I don't have much context around this big PR, so I'm not certain that I could resolve the conflict correctly. |
Contributor
Author
|
I'm not surprised, so I'll do it manually. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes some issues that will be a problem when we perform the upgrade to Gateway API v1.5, which includes new conformance tests for TLSRoute behavior.
The new conformance tests are testing behavior that we should always have been doing, so this should be backportable back to v1.18, where we upgraded to Gateway API v1.4.0.
There are two separate changes, each in their own commit. Please review by commits.