fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API#7793
Conversation
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
9c94d61 to
96c0aab
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #7793 +/- ##
=======================================
Coverage 73.73% 73.74%
=======================================
Files 237 237
Lines 35653 35712 +59
=======================================
+ Hits 26290 26336 +46
- Misses 7507 7520 +13
Partials 1856 1856 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
The conformance test failures appear to be related to GatewayClass acceptance timing ( My change only affects BackendTLSPolicy status reason mapping and does not touch GatewayClass, EnvoyProxy, or control-plane startup logic. Happy to re-run or adjust if maintainers think this is related. |
|
instead of deleting the logic, is there an issue with the current logic of is the right |
|
Hi @arkodg ,
Because of that, the error does not reliably indicate an invalid reference kind per the Gateway API semantics. In practice it represents a CA resolution failure, which the spec and conformance tests map to That’s why I removed the conditional mapping — keying If you think we should distinguish these cases more explicitly, I’m happy to follow up with a separate change that introduces a dedicated error for truly invalid reference kinds. |
| needs to be improved to better decipher between invalid kind and other failure cases |
|
That makes sense 👍 I’ll update I’ll push an updated revision shortly. |
…LSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
0cb18bc to
6f18744
Compare
|
Hi @arkodg I’ve updated the error classification for CA resolution failures so that missing or unusable CA bundles use a more accurate error, allowing the status to consistently report InvalidCACertificateRef without altering validation logic. All tests pass locally (go test ./..., make test). |
|
This looks good, thanks! Could you confirm that the new conformance test in kubernetes-sigs/gateway-api#4360 passes here? |
|
Hi @jukie @arkodg It looks like the current CI failures are occurring during Helm chart linting, before the Gateway API conformance assertions run. I’ve updated the branch to pick up the latest changes from main and will confirm the result once the conformance tests complete. |
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
08aff65 to
947113b
Compare
|
Hi @arkodg , |
|
can you add a test case |
|
Hi @arkodg, thanks for the note. I’ve added coverage through the existing Gateway API golden tests. The file supported CA ref kinds where the CA data is missing, and unsupported / invalid CA ref kinds. This validates the updated status reasons end-to-end with the expected output. Thanks! |
✅ Deploy Preview for cerulean-figolla-1f9435 canceled.
|
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
|
Friendly Ping @arkodg , |
|
does a YAML test case exist that verifies the code path you added |
|
Yes — the existing golden test It includes:
The expected status output in the golden file was updated as part of this change to reflect the new branching logic. If you’d prefer this to be split into a more explicit test case or renamed for clarity, I’m happy to do that. |
|
CI is failing |
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
|
Hi @arkodg , |
…dation output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
|
here is the error from the CI, it is expecting a specific order, you can use |
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
|
Thanks @arkodg! I regenerated the testdata using |
is failing |
…alid CA ref kind Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
|
Thanks @arkodg , found the issue. For invalid CA ref kind, Accepted must still use NoValidCACertificate while ResolvedRefs uses InvalidKind. Fixed the logic and regenerated testdata. |
Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
…API (envoyproxy#7793) * fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * Update internal/gatewayapi/backendtlspolicy.go Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * gatewayapi: align BackendTLSPolicy invalid CA status and formatting Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: align BackendTLSPolicy invalid CA error message with validation output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * testdata: regenerate BackendTLSPolicy invalid CA output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * chore(gatewayapi): fix import grouping in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> --------- Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>
|
Remove this from v1.5, this's need Gateway API v1.4. |
…API (envoyproxy#7793) * fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * Update internal/gatewayapi/backendtlspolicy.go Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * gatewayapi: align BackendTLSPolicy invalid CA status and formatting Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: align BackendTLSPolicy invalid CA error message with validation output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * testdata: regenerate BackendTLSPolicy invalid CA output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * chore(gatewayapi): fix import grouping in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> --------- Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API (#7793) * fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * Update internal/gatewayapi/backendtlspolicy.go Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * gatewayapi: align BackendTLSPolicy invalid CA status and formatting Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * gatewayapi: align BackendTLSPolicy invalid CA error message with validation output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * testdata: regenerate BackendTLSPolicy invalid CA output Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> * chore(gatewayapi): fix import grouping in BackendTLSPolicy Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> --------- Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> * feat: Ignore ready and stats listener metrics in shutdown manager calculation (#7985) * feat: Ignore ready and stats listener metrics in shutdown manager calculation Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * refactor Signed-off-by: zirain <zirain2009@gmail.com> * remove USE_SERVER_CONNECTIONS Signed-off-by: zirain <zirain2009@gmail.com> * address review comment Signed-off-by: zirain <zirain2009@gmail.com> * display the real value Signed-off-by: zirain <zirain2009@gmail.com> * comment for worker thread Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> * fix: custom response should be put at the first of the filter chain (#8061) * fix: custom response should be put before oauth2 Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * move the custom response filter to first Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix: route idle timeout (#8058) * fix: route idle timeout Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix: remove global logger in message package (#8131) * fix: remove global logger in message package Signed-off-by: zirain <zirain2009@gmail.com> * fix: TCPRoute mTLS didn't work (#8152) * fix: remove auto HTTP config on TCP cluster Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> * add e2e Signed-off-by: zirain <zirain2009@gmail.com> * fix e2e Signed-off-by: zirain <zirain2009@gmail.com> * fix comment Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * fix resource name Signed-off-by: zirain <zirain2009@gmail.com> * address Arko's comment Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> * fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153) continue processing the remaining xDS with invalid EnvoyPatchPolicies Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * fix: controller cache-sync readiness check (#7430) Signed-off-by: zirain <zirain2009@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * release notes for v1.6.4 (#8221) * release notes for v1.6.4 Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> * update VERSION Signed-off-by: zirain <zirain2009@gmail.com> * update release notes Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>
What type of PR is this?
fix: correct BackendTLSPolicy ResolvedRefs reason
What this PR does / why we need it:
Envoy Gateway was setting the
ResolvedRefs=Falsecondition reason toInvalidKindfor BackendTLSPolicy when a referenced CA certificate couldnot be resolved.
According to Gateway API conformance and the BackendTLSPolicy specification,
this scenario must use the
InvalidCACertificateRefreason. This PR updatesthe status reason and adjusts golden test outputs to align with the expected
behavior.
Which issue(s) this PR fixes:
Fixes #7790
Release Notes: No