Skip to content

fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies#8153

Merged
arkodg merged 1 commit intoenvoyproxy:mainfrom
zhaohuabing:fix-8151
Feb 4, 2026
Merged

fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies#8153
arkodg merged 1 commit intoenvoyproxy:mainfrom
zhaohuabing:fix-8151

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Feb 2, 2026 •
edited
Loading

fix: #8151

This PR ignores the invalid EnvoyPatchPolicy in the xDS translator and continue pushing the xDS for unrelated resources to the Envoy fleet.

Errors from the invalid EnvoyPatchPolicy are logged in the Envoy Gateway logs, and surfaced in the Programmed condition of the EnvoyPatchPolicy's status.

@zhaohuabing zhaohuabing requested a review from a team as a code owner February 2, 2026 05:18
@netlify
Copy link
Copy Markdown

netlify bot commented Feb 2, 2026 •
edited
Loading

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit 342718d
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6981858efb0afe00088693d2

@zhaohuabing zhaohuabing marked this pull request as draft February 2, 2026 05:19
zhaohuabing
zhaohuabing commented Feb 2, 2026
View reviewed changes
internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-empty-jsonpath.clusters.yaml
- maxRetries: 1024
commonLbConfig:
localityWeightedLbConfig: {}
commonLbConfig: {}
Copy link
Copy Markdown
Member Author

@zhaohuabing zhaohuabing Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This and the other xds test out yaml files were added before and never updated afterward, since the invalid EnvoyPatchPolicies didn't produce any xDS output.

@zhaohuabing zhaohuabing marked this pull request as ready for review February 2, 2026 05:34
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 2, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.69%. Comparing base (79af9fe) to head (342718d).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8153      +/-   ##
==========================================
+ Coverage   73.67%   73.69%   +0.01%     
==========================================
  Files         241      241              
  Lines       36561    36561              
==========================================
+ Hits        26937    26943       +6     
+ Misses       7712     7709       -3     
+ Partials     1912     1909       -3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zhaohuabing zhaohuabing mentioned this pull request Feb 2, 2026
Merged
@arkodg arkodg added this to the v1.7.0 Release milestone Feb 3, 2026
arkodg
arkodg previously approved these changes Feb 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

zirain
zirain previously approved these changes Feb 3, 2026
View reviewed changes
@zhaohuabing @zirain
continue processing the remaining xDS with invalid EnvoyPatchPolicies
342718d 
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zirain zirain dismissed stale reviews from arkodg and themself via 342718d February 3, 2026 05:20
@zhaohuabing
Copy link
Copy Markdown
Member Author

zhaohuabing commented Feb 3, 2026

The diff looks good. Thanks! @zirain

@kkk777-7
Copy link
Copy Markdown
Member

kkk777-7 commented Feb 3, 2026

LGTM, thanks!

@arkodg arkodg merged commit 6cf677d into envoyproxy:main Feb 4, 2026
56 of 59 checks passed
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
89e9979 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
1d27a83 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Feb 5, 2026
@zhaohuabing @cnvergence
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
7fc123a 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence added a commit that referenced this pull request Feb 5, 2026
@cnvergence @guydc
@zhaohuabing @dependabot @jukie @zirain @Aditya7880900936 @krishicks @jess-belliveau
[release/v1.7] v1.7.0 cherrypick (#8190)
da2aac9 
* chore(docs): Update Azure Entra link in OIDC guide (#8167)

Update Azure Entra link in OIDC guide

Signed-off-by: Guy Daich <guy.daich@sap.com>

* fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* build(deps): bump the actions group across 1 directory with 2 updates (#8178)

Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

Updates `github/codeql-action` from 4.32.0 to 4.32.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b20883b...6bc82e0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: skip provision when IR Infra is invalid (#7754)

* fix: do not trigger IR deletion when EnvoyProxy is invalid

Signed-off-by: zirain <zirain2009@gmail.com>

* add Invalid to ir.Infra

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* add e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* remove invalid

Signed-off-by: zirain <zirain2009@gmail.com>

* add comments

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

* merge loop

Signed-off-by: zirain <zirain2009@gmail.com>

* move back

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* docs: add HTTP header and method based authentication task (#7990)

* docs: add HTTP header and method based authentication task

Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* docs: replace api-key examples with user header

Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* docs: format header and method authentication examples

Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* docs: add header and method based authorization examples

Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

---------

Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: Validation of XListenerSet certificateRefs (#8168)

Previously, validateTerminateModeAndGetTLSSecrets would always use the
namespace of the listener's gateway when verifying a cross-namespace
ref.

This meant that if the listener were from an XListenerSet, whether or
not the Secret associated with the certificateRef was in the same
namespace as the XListenerSet, it would not be permitted.

Additionally, and relatedly, this fixes an issue where an XListenerSet
could reference a Secret in the gateway's namespace without a
ReferenceGrant being present.

With this change we add a new GetNamespace() method to
gatewayapi.ListenerContext which returns the listener's gateway's
namespace for a listener added directly to the gateway, or the
XListenerSet's namespace otherwise. This is similar to some of the other
methods that were added to ListenerContext in support of XListenerSets.

The new method is used when creating the `crossNamespaceFrom` to
determine if the certificateRef is permitted. If the Secret and
XListenerSet are in the same namespace, it is permitted. If that is not
the case a ReferenceGrant from the XListenerSet to the Secret will be
properly searched for.

Signed-off-by: krishicks <kris@krishicks.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: Remove whitespace for nodeSelector in deployment YAML - helm chart change (#8185)

Remove whitespace for nodeSelector in deployment YAML

Signed-off-by: Jess Belliveau <jess.belliveau@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* [release/v1.7.0] release notes (#8188)

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Signed-off-by: krishicks <kris@krishicks.com>
Signed-off-by: Jess Belliveau <jess.belliveau@gmail.com>
Co-authored-by: Guy Daich <guy.daich@sap.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: krishicks <kris@krishicks.com>
Co-authored-by: Jess Belliveau <jess.belliveau@gmail.com>
zirain pushed a commit to zirain/gateway that referenced this pull request Feb 9, 2026
@zhaohuabing @zirain
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
96f6d6a 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zhaohuabing zhaohuabing deleted the fix-8151 branch February 11, 2026 01:34
zirain added a commit that referenced this pull request Feb 11, 2026
@zirain @Aditya7880900936
@arkodg @zhaohuabing @jukie
[release-1.6] cherry pick for v1.6.4 (#8218)
0838745 
* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API (#7793)

* fix(status): align BackendTLSPolicy ResolvedRefs reason with Gateway API

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): use accurate error for missing CA bundle in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: fix BackendTLSPolicy status reasons for invalid CA refs

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* Update internal/gatewayapi/backendtlspolicy.go

Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>

* gatewayapi: align BackendTLSPolicy invalid CA status and formatting

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* gatewayapi: align BackendTLSPolicy invalid CA error message with validation output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* testdata: regenerate BackendTLSPolicy invalid CA output

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* fix(gatewayapi): keep Accepted reason as NoValidCACertificate for invalid CA ref kind

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

* chore(gatewayapi): fix import grouping in BackendTLSPolicy

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>

* feat: Ignore ready and stats listener metrics in shutdown manager calculation (#7985)

* feat: Ignore ready and stats listener metrics in shutdown manager calculation

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* refactor

Signed-off-by: zirain <zirain2009@gmail.com>

* remove USE_SERVER_CONNECTIONS

Signed-off-by: zirain <zirain2009@gmail.com>

* address review comment

Signed-off-by: zirain <zirain2009@gmail.com>

* display the real value

Signed-off-by: zirain <zirain2009@gmail.com>

* comment for worker thread

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: custom response should be put at the first of the filter chain (#8061)

* fix: custom response should be put before oauth2

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* move the custom response filter to first

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix: route idle timeout (#8058)

* fix: route idle timeout

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix: remove global logger in message package (#8131)

* fix: remove global logger in message package

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: TCPRoute mTLS didn't work (#8152)

* fix: remove auto HTTP config on TCP cluster

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

* add e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* fix e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* fix comment

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix resource name

Signed-off-by: zirain <zirain2009@gmail.com>

* address Arko's comment

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* fix: controller cache-sync readiness check (#7430)

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* release notes for v1.6.4 (#8221)

* release notes for v1.6.4

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

* update VERSION

Signed-off-by: zirain <zirain2009@gmail.com>

* update release notes

Signed-off-by: zirain <zirain2009@gmail.com>

* update

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com>
Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>
Inode1 pushed a commit to Inode1/gateway that referenced this pull request Feb 23, 2026
@zhaohuabing
fix: continue processing the remaining xDS with invalid EnvoyPatchPol…
1901085 
…icies (envoyproxy#8153)

continue processing the remaining xDS with invalid EnvoyPatchPolicies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zirain zirain zirain approved these changes

@kkk777-7 kkk777-7 kkk777-7 approved these changes

@arkodg arkodg arkodg left review comments

Assignees

No one assigned

Labels

cherrypick/release-v1.6.4

Projects

None yet

Milestone

v1.7.0 Release

Development

Successfully merging this pull request may close these issues.

EnvoyPatchPolicy with JSONPatch blocks xDS updates when target objects don’t exist (control plane stuck)

4 participants

@zhaohuabing @kkk777-7 @zirain @arkodg