Skip to content

fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API#7793

Merged
zirain merged 14 commits intoenvoyproxy:mainfrom
Aditya7880900936:fix-backendtlspolicy-resolvedrefs
Jan 28, 2026
Merged

fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API#7793
zirain merged 14 commits intoenvoyproxy:mainfrom
Aditya7880900936:fix-backendtlspolicy-resolvedrefs

Conversation

@Aditya7880900936
Copy link
Copy Markdown
Contributor

What type of PR is this?

fix: correct BackendTLSPolicy ResolvedRefs reason


What this PR does / why we need it:

Envoy Gateway was setting the ResolvedRefs=False condition reason to
InvalidKind for BackendTLSPolicy when a referenced CA certificate could
not be resolved.

According to Gateway API conformance and the BackendTLSPolicy specification,
this scenario must use the InvalidCACertificateRef reason. This PR updates
the status reason and adjusts golden test outputs to align with the expected
behavior.


Which issue(s) this PR fixes:

Fixes #7790


Release Notes: No

@Aditya7880900936 Aditya7880900936 requested a review from a team as a code owner December 21, 2025 17:08
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936 Aditya7880900936 force-pushed the fix-backendtlspolicy-resolvedrefs branch from 9c94d61 to 96c0aab Compare December 21, 2025 17:28
@codecov
Copy link
Copy Markdown

codecov bot commented Dec 21, 2025

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 73.74%. Comparing base (a97d57a) to head (dd29001).
⚠️ Report is 85 commits behind head on main.

Files with missing lines Patch % Lines
internal/gatewayapi/backendtlspolicy.go 94.11% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #7793   +/-   ##
=======================================
  Coverage   73.73%   73.74%           
=======================================
  Files         237      237           
  Lines       35653    35712   +59     
=======================================
+ Hits        26290    26336   +46     
- Misses       7507     7520   +13     
  Partials     1856     1856           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

The conformance test failures appear to be related to GatewayClass acceptance timing (proxy-config not found / context deadline exceeded) and not BackendTLSPolicy behavior.

My change only affects BackendTLSPolicy status reason mapping and does not touch GatewayClass, EnvoyProxy, or control-plane startup logic.

Happy to re-run or adjust if maintainers think this is related.

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Dec 26, 2025

instead of deleting the logic, is there an issue with the current logic of

	if errors.Is(err, ErrBackendTLSPolicyInvalidKind) {
			reason = gwapiv1.BackendTLSPolicyReasonInvalidKind
		}

is the right err being returned ?

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Hi @arkodg ,
Good question — the error is being returned, but it’s semantically overloaded.

ErrBackendTLSPolicyInvalidKind is currently returned from getCaCertsFromCARefs when no CA bundle could be resolved (e.g. missing key, missing object, empty result), not when the reference kind itself is invalid.

Because of that, the error does not reliably indicate an invalid reference kind per the Gateway API semantics. In practice it represents a CA resolution failure, which the spec and conformance tests map to InvalidCACertificateRef.

That’s why I removed the conditional mapping — keying ResolvedRefs on this error was causing valid CA-resolution failures to be reported as InvalidKind.

If you think we should distinguish these cases more explicitly, I’m happy to follow up with a separate change that introduces a dedicated error for truly invalid reference kinds.

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Dec 27, 2025

needs to be improved to better decipher between invalid kind and other failure cases

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

That makes sense 👍

I’ll update getCaCertsFromCARefs to explicitly return an error for truly invalid
reference kinds and use a separate error for CA resolution failures. That should
allow ResolvedRefs to correctly distinguish InvalidKind vs
InvalidCACertificateRef.

I’ll push an updated revision shortly.

…LSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936 Aditya7880900936 force-pushed the fix-backendtlspolicy-resolvedrefs branch from 0cb18bc to 6f18744 Compare December 29, 2025 20:09
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Hi @arkodg
Thanks for the review and the clarification.

I’ve updated the error classification for CA resolution failures so that missing or unusable CA bundles use a more accurate error, allowing the status to consistently report InvalidCACertificateRef without altering validation logic.

All tests pass locally (go test ./..., make test).

@jukie
Copy link
Copy Markdown
Contributor

jukie commented Dec 29, 2025

This looks good, thanks! Could you confirm that the new conformance test in kubernetes-sigs/gateway-api#4360 passes here?

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Hi @jukie @arkodg
Thanks for the heads-up.

It looks like the current CI failures are occurring during Helm chart linting, before the Gateway API conformance assertions run. I’ve updated the branch to pick up the latest changes from main and will confirm the result once the conformance tests complete.

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936 Aditya7880900936 force-pushed the fix-backendtlspolicy-resolvedrefs branch from 08aff65 to 947113b Compare January 2, 2026 17:13
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Aditya7880900936 commented Jan 2, 2026

Hi @arkodg ,
Thanks for the review!
I’ve updated the implementation to distinguish invalid CA kinds vs missing/empty CA bundles, updated the expected test output, and ensured DCO compliance.
All gatewayapi tests are passing locally. Please let me know if you’d like this handled differently.

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 7, 2026

can you add a test case

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Hi @arkodg, thanks for the note.

I’ve added coverage through the existing Gateway API golden tests. The file
internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml now covers both cases:

supported CA ref kinds where the CA data is missing, and

unsupported / invalid CA ref kinds.

This validates the updated status reasons end-to-end with the expected output.
Happy to add or adjust anything further if you had something else in mind.

Thanks!

@netlify
Copy link
Copy Markdown

netlify bot commented Jan 9, 2026

Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit dd29001
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/697708d4e0d6d80008206dd4

Aditya7880900936 and others added 2 commits January 12, 2026 14:36
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Friendly Ping @arkodg ,
i just wanna know is there any thing need to be updated .

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 19, 2026

does a YAML test case exist that verifies the code path you added

@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Yes — the existing golden test
internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
already covers the code path added in this PR.

It includes:

  • an invalid CA ref kind, which triggers ErrBackendTLSPolicyInvalidKind, and

  • a valid ref kind with no CA data, which triggers ErrBackendTLSPolicyNoValidCACertificate.

The expected status output in the golden file was updated as part of this change to reflect the new branching logic.

If you’d prefer this to be split into a more explicit test case or renamed for clarity, I’m happy to do that.

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 22, 2026

CI is failing

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Hi @arkodg ,
I ran make lint and make generate locally.
Since this change only affects BackendTLSPolicy logic and testdata, no generated artifacts were included.
All relevant gatewayapi tests are passing.

…dation output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 24, 2026

here is the error from the CI, it is expecting a specific order, you can use make testdata to generate this

===========> ERROR: Some files need to be updated
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
index 2b0a7f3..fb88e9b 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -59,12 +59,14 @@ backendTLSPolicies:
         sectionName: http
       conditions:
       - lastTransitionTime: null
-        message: Unsupported reference kind, supported kinds are ConfigMap, Secret, and ClusterTrustBundle.
+        message: Unsupported reference kind, supported kinds are ConfigMap, Secret,
+          and ClusterTrustBundle.
         reason: InvalidKind
         status: "False"
         type: Accepted
       - lastTransitionTime: null
-        message: Unsupported reference kind, supported kinds are ConfigMap, Secret, and ClusterTrustBundle.
+        message: Unsupported reference kind, supported kinds are ConfigMap, Secret,
+          and ClusterTrustBundle.
         reason: InvalidKind
         status: "False"
         type: ResolvedRefs
         ```

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Thanks @arkodg! I regenerated the testdata using make testdata to match the expected order and pushed the updated output.

@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 25, 2026

TestGatewayAPIConformance/BackendTLSPolicyInvalidKind/BackendTLSPolicy_with_a_single_invalid_CACertificateRef_has_a_Accepted_Condition_with_status_False_and_Reason_NoValidCACertificate

is failing

…alid CA ref kind

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@Aditya7880900936
Copy link
Copy Markdown
Contributor Author

Thanks @arkodg , found the issue. For invalid CA ref kind, Accepted must still use NoValidCACertificate while ResolvedRefs uses InvalidKind. Fixed the logic and regenerated testdata.

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
@arkodg arkodg added this to the v1.7.0 Release milestone Jan 28, 2026
@arkodg arkodg requested review from a team January 28, 2026 06:23
@zirain zirain merged commit 2635b7a into envoyproxy:main Jan 28, 2026
36 checks passed
SadmiB pushed a commit to SadmiB/gateway that referenced this pull request Jan 30, 2026
…API (envoyproxy#7793)

* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* Update internal/gatewayapi/backendtlspolicy.go

Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* gatewayapi: align BackendTLSPolicy invalid CA status and formatting

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: align BackendTLSPolicy invalid CA error message with validation output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* testdata: regenerate BackendTLSPolicy invalid CA output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* chore(gatewayapi): fix import grouping in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>
@zirain
Copy link
Copy Markdown
Member

zirain commented Feb 9, 2026

Remove this from v1.5, this's need Gateway API v1.4.

zirain pushed a commit to zirain/gateway that referenced this pull request Feb 9, 2026
…API (envoyproxy#7793)

* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* Update internal/gatewayapi/backendtlspolicy.go

Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* gatewayapi: align BackendTLSPolicy invalid CA status and formatting

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: align BackendTLSPolicy invalid CA error message with validation output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* testdata: regenerate BackendTLSPolicy invalid CA output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* chore(gatewayapi): fix import grouping in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
zirain added a commit that referenced this pull request Feb 11, 2026
* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API (#7793)

* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* Update internal/gatewayapi/backendtlspolicy.go

Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* gatewayapi: align BackendTLSPolicy invalid CA status and formatting

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: align BackendTLSPolicy invalid CA error message with validation output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* testdata: regenerate BackendTLSPolicy invalid CA output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* chore(gatewayapi): fix import grouping in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>

* feat: Ignore ready and stats listener metrics in shutdown manager calculation (#7985)

* feat: Ignore ready and stats listener metrics in shutdown manager calculation

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* refactor

Signed-off-by: zirain <zirain2009@gmail.com>

* remove USE_SERVER_CONNECTIONS

Signed-off-by: zirain <zirain2009@gmail.com>

* address review comment

Signed-off-by: zirain <zirain2009@gmail.com>

* display the real value

Signed-off-by: zirain <zirain2009@gmail.com>

* comment for worker thread

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: custom response should be put at the first of the filter chain (#8061)

* fix: custom response should be put before oauth2

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* move the custom response filter to first

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix: route idle timeout (#8058)

* fix: route idle timeout

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix: remove global logger in message package (#8131)

* fix: remove global logger in message package

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: TCPRoute mTLS didn't work (#8152)

* fix: remove auto HTTP config on TCP cluster

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

* add e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* fix e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* fix comment

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix resource name

Signed-off-by: zirain <zirain2009@gmail.com>

* address Arko's comment

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: controller cache-sync readiness check (#7430)

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* release notes for v1.6.4 (#8221)

* release notes for v1.6.4

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* update VERSION

Signed-off-by: zirain <zirain2009@gmail.com>

* update release notes

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix invalid ResolvedRefs condition in BackendTLSPolicy

4 participants