fix: watch change for the ca cert in the Backend by zhaohuabing · Pull Request #7294 · envoyproxy/gateway

zhaohuabing · 2025-10-21T09:01:41Z

Fixes the missing watch for ca cert in the Backend resource.

Release Notes: No

codecov · 2025-10-21T09:16:18Z

Codecov Report

❌ Patch coverage is 70.37037% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.97%. Comparing base (650fd83) to head (9b0c043).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/predicates.go	70.37%	6 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7294      +/-   ##
==========================================
+ Coverage   70.94%   70.97%   +0.03%     
==========================================
  Files         229      229              
  Lines       41071    41098      +27     
==========================================
+ Hits        29137    29170      +33     
+ Misses      10216    10205      -11     
- Partials     1718     1723       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg

LGTM thanks

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zirain · 2025-10-21T23:16:28Z

internal/provider/kubernetes/predicates.go

 		}
 	}

+	if r.backendCRDExists {


Does the same problem exist for configmap/clustertrustebundle?

Ah we need to do this for cluster trust bundle as well, good catch

It's already handled here?

gateway/internal/provider/kubernetes/predicates.go

Lines 187 to 207 in 650fd83

func (r *gatewayAPIReconciler) validateClusterTrustBundleForReconcile(ctb *certificatesv1b1.ClusterTrustBundle) bool {

if !r.backendAPIDisabled() {

if r.isBackendReferencingClusterTrustBundle(ctb) {

return true

}

}

if r.bTLSPolicyCRDExists {

if r.isBackendTLSPolicyReferencingClusterTrustBundle(ctb) {

return true

}

}

if r.ctpCRDExists {

if r.isCtpReferencingClusterTrustBundle(ctb) {

return true

}

}

return false

}

looks like we missed for ConfigMap?

ConfigMap has also been handled in this PR #7294 (comment)

zirain · 2025-10-22T00:32:35Z

/retest

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zhaohuabing · 2025-10-22T02:22:23Z

internal/provider/kubernetes/predicates.go

 		}
 	}

+	if !r.backendAPIDisabled() {


@arkodg @zirain configMap has been handled here.

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: Lin Moskovitch <lin.moskovitch@sap.com>

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com>

* fix: bug in overlap detection of cert SANs (#7234) Signed-off-by: zirain <zirain2009@gmail.com> * fix(translator): Fix panic with request mirror + grpcroute (#6875) Signed-off-by: Andrew Moreland <andy@andymoreland.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix: watch change for the ca cert in the Backend (#7294) * watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix ipFamily not set in UDPListener (#7313) fix: set ipfamily in udpistener (#7312) Signed-off-by: cong <q1875486458@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * coalesce updates to reduce intermediate updates (#7328) * coalesce updates to reduce redundant processing in subscription handler Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * retain order Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * keep intermediate delete updates Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * minor wording Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * treat delete as normal operations Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * retain the original order of the last updates for each key Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix: port typo (#7397) Signed-off-by: cong <q1875486458@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix: validate EnvoyGateway configuration before reload (#7412) Signed-off-by: zirain <zirain2009@gmail.com> * fix: missing jwt provider when jwt is configured on multiple listeners sharing the same port (#7337) * fix jwt provider missing when jwt is configured at multiple ir listeners Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix: memory leak (#7429) Fix memory leak. Two watchable.Maps were never closed when shutting down the provider: - GatewayClassStatuses.Close() - missing in GatewayAPIStatuses.Close() - BackendTrafficPolicyStatuses.Close() - missing in PolicyStatuses.Close() Each unclosed map leaked 3 goroutines: 1. Internal watchable.Map.coalesce goroutine 2. HandleSubscription goroutine blocked on channel read 3. Error handler goroutine blocked on channel read Signed-off-by: Gonzalo Serrano <boikot@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix gen after cherry-pick Signed-off-by: zirain <zirain2009@gmail.com> * fix watchutil test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Andrew Moreland <andy@andymoreland.com> Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: cong <q1875486458@gmail.com> Signed-off-by: Gonzalo Serrano <boikot@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Andrew Moreland <andy@andymo.org> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: 聪 <q1875486458@gmail.com> Co-authored-by: Gonzalo Serrano <boikot@gmail.com>

zhaohuabing requested a review from a team as a code owner October 21, 2025 09:01

zhaohuabing force-pushed the fix-backend-ca-watch branch from 2576f09 to 2fa9750 Compare October 21, 2025 09:06

zhaohuabing changed the title ~~chore: watch change for the ca cert in the Backend~~ fix: watch change for the ca cert in the Backend Oct 21, 2025

arkodg previously approved these changes Oct 21, 2025

View reviewed changes

arkodg requested review from a team October 21, 2025 17:05

arkodg added the cherrypick/release-v1.5.5 label Oct 21, 2025

watch change for the ca cert in the Backend

1c223e6

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zirain force-pushed the fix-backend-ca-watch branch from 2fa9750 to 1c223e6 Compare October 21, 2025 23:15

zirain approved these changes Oct 21, 2025

View reviewed changes

zirain reviewed Oct 21, 2025

View reviewed changes

zirain previously approved these changes Oct 21, 2025

View reviewed changes

zirain enabled auto-merge (squash) October 21, 2025 23:16

zirain mentioned this pull request Oct 22, 2025

Does the same problem exist for configmap/clustertrustebundle? #7297

Closed

check if backend API is enabled

9b0c043

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zhaohuabing dismissed stale reviews from zirain and arkodg via 9b0c043 October 22, 2025 01:05

zhaohuabing requested review from arkodg and zirain October 22, 2025 01:06

zhaohuabing commented Oct 22, 2025

View reviewed changes

zirain approved these changes Oct 22, 2025

View reviewed changes

arkodg approved these changes Oct 22, 2025

View reviewed changes

arkodg disabled auto-merge October 22, 2025 03:13

arkodg merged commit d307304 into envoyproxy:main Oct 22, 2025
48 of 53 checks passed

zhaohuabing deleted the fix-backend-ca-watch branch October 22, 2025 04:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: watch change for the ca cert in the Backend#7294

fix: watch change for the ca cert in the Backend#7294
arkodg merged 2 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-backend-ca-watch

zhaohuabing commented Oct 21, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 21, 2025 •

edited

Loading

Uh oh!

arkodg left a comment

Uh oh!

zirain Oct 21, 2025

Uh oh!

arkodg Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 •

edited

Loading

Uh oh!

zirain Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025

Uh oh!

zirain commented Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	func (r gatewayAPIReconciler) validateClusterTrustBundleForReconcile(ctb certificatesv1b1.ClusterTrustBundle) bool {
	if !r.backendAPIDisabled() {
	if r.isBackendReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	if r.bTLSPolicyCRDExists {
	if r.isBackendTLSPolicyReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	if r.ctpCRDExists {
	if r.isCtpReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	return false
	}

Conversation

zhaohuabing commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

zirain Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

arkodg Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zirain commented Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zhaohuabing commented Oct 21, 2025 •

edited

Loading

codecov bot commented Oct 21, 2025 •

edited

Loading

zhaohuabing Oct 22, 2025 •

edited

Loading

zhaohuabing Oct 22, 2025 •

edited

Loading