fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies by rudrakhp · Pull Request #8210 · envoyproxy/gateway

rudrakhp · 2026-02-08T08:39:01Z

What type of PR is this?

fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies

What this PR does / why we need it:

ConfigMap references for custom response body content in parent policy are not being resolved correctly. Resolving LocalObjectRefs pre-merge addresses this issue.

Which issue(s) this PR fixes:

Fixes #8197

Release Notes: Yes

netlify · 2026-02-08T08:39:07Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`5408a17`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/699c5c4555f25a00080597a6

codecov · 2026-02-08T08:48:10Z

Codecov Report

❌ Patch coverage is 62.85714% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.68%. Comparing base (d1b1e5c) to head (5408a17).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/backendtrafficpolicy.go	64.70%	6 Missing and 6 partials ⚠️
internal/gatewayapi/filters.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8210      +/-   ##
==========================================
- Coverage   73.72%   73.68%   -0.04%     
==========================================
  Files         240      240              
  Lines       36917    36946      +29     
==========================================
+ Hits        27216    27224       +8     
- Misses       7772     7787      +15     
- Partials     1929     1935       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2026-02-08T17:07:56Z

...atewayapi/testdata/backendtrafficpolicy-with-response-override-merged-diff-namespace.in.yaml

@@ -0,0 +1,100 @@
+# Tests merged BackendTrafficPolicies when ResponseOverride ConfigMap lives in the
+# gateway (parent) policy's namespace. Gateway BTP is in envoy-gateway-system with


internal/gatewayapi/backendtrafficpolicy.go

arkodg · 2026-02-16T20:07:33Z

internal/gatewayapi/backendtrafficpolicy.go

+		policy.Namespace,
+		responseOverrideKey,
+	)
+


do we need to save the entire data/field contents here ?
can the map look something like

map[string]string{ "<ns>/<name>/<field>/<valueRefKind>/<name>": <ns>, }

this would allow us to

save space

build a map before using it in buildTrafficFeatures and each new feature can enhance this

cross ns references are a security concern, so will require test coverage for the non happy paths

@arkodg if the exact same local object ref exists in response overrides of parent and route policies, what should be the behavior? Check the first case in the tests I just added.

Check same LocalObjectRef different match criteria test where only one local object ref will remain if entire ResponseOverride is not used as key.

save space

also this is not persisted memory, will be used only while building the IR

…ckendTrafficPolicies Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

kkk777-7 · 2026-02-23T15:56:55Z

Thanks! LGTM from my side.

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix up release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <youssef.rabie@procore.com> * polish Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <zirain2009@gmail.com> * remove skipped tests Signed-off-by: zirain <zirain2009@gmail.com> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix gen-check Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Kris Hicks <khicks@nvidia.com>

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <zirain2009@gmail.com> * remove skipped tests Signed-off-by: zirain <zirain2009@gmail.com> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <youssef.rabie@procore.com> * polish Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix test race (#8180) * fix test race Signed-off-by: zirain <zirain2009@gmail.com> * use io.Discard Signed-off-by: zirain <zirain2009@gmail.com> * use sync.WaitGroup Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * fix gen check Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Co-authored-by: Teja079 <117351771+Teja079@users.noreply.github.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>

rudrakhp requested a review from a team as a code owner February 8, 2026 08:39

rudrakhp changed the title ~~fix: pass parent policy namespace for accessing refs~~ fix: pass parent policy namespace for accessing refs in merged policies Feb 8, 2026

rudrakhp force-pushed the fix_merged_policy_refs branch 2 times, most recently from 9b00fa3 to 60f248b Compare February 8, 2026 14:03

rudrakhp added cherrypick/release-v1.6.4 cherrypick/release-v1.7.1 cherrypick/release-v1.5.9 labels Feb 8, 2026

arkodg reviewed Feb 8, 2026

View reviewed changes

internal/gatewayapi/backendtrafficpolicy.go Show resolved Hide resolved

zirain force-pushed the fix_merged_policy_refs branch from 60f248b to 9e2f0ec Compare February 9, 2026 02:11

zirain previously approved these changes Feb 9, 2026

View reviewed changes

zirain requested a review from arkodg February 9, 2026 03:01

This was referenced Feb 9, 2026

[release-1.5] cherry pick for v1.5.9 #8217

Merged

[release-1.6] cherry pick for v1.6.4 #8218

Merged

release notes for v1.5.9 #8219

Merged

release notes for v1.6.4 #8221

Merged

rudrakhp dismissed zirain’s stale review via 181aec1 February 10, 2026 11:00

rudrakhp force-pushed the fix_merged_policy_refs branch from 9e2f0ec to 181aec1 Compare February 10, 2026 11:00

rudrakhp changed the title ~~fix: pass parent policy namespace for accessing refs in merged policies~~ fix: for accessing parent policy refs in merged policies Feb 10, 2026

rudrakhp force-pushed the fix_merged_policy_refs branch 3 times, most recently from 50947a2 to 51cb904 Compare February 10, 2026 13:14

zirain previously approved these changes Feb 10, 2026

View reviewed changes

rudrakhp dismissed zirain’s stale review via e0c71f3 February 11, 2026 02:55

rudrakhp force-pushed the fix_merged_policy_refs branch 2 times, most recently from e0c71f3 to a15ec14 Compare February 11, 2026 03:07

rudrakhp requested a review from zirain February 11, 2026 03:28

zirain previously approved these changes Feb 11, 2026

View reviewed changes

rudrakhp force-pushed the fix_merged_policy_refs branch 3 times, most recently from 1121812 to 05a8cb9 Compare February 15, 2026 09:32

arkodg reviewed Feb 16, 2026

View reviewed changes

rudrakhp force-pushed the fix_merged_policy_refs branch 2 times, most recently from de5b86a to f7b9836 Compare February 19, 2026 18:12

rudrakhp requested a review from arkodg February 20, 2026 08:45

rudrakhp force-pushed the fix_merged_policy_refs branch 4 times, most recently from 23199e0 to f1e80ad Compare February 23, 2026 13:54

rudrakhp changed the title ~~fix: access parent policy custom response refs in merged policies~~ fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies Feb 23, 2026

fix: fixed local object reference resolution from parent in merged Ba…

5408a17

…ckendTrafficPolicies Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp force-pushed the fix_merged_policy_refs branch from f1e80ad to 5408a17 Compare February 23, 2026 13:55

kkk777-7 approved these changes Feb 23, 2026

View reviewed changes

jukie approved these changes Feb 23, 2026

View reviewed changes

cnvergence approved these changes Feb 23, 2026

View reviewed changes

rudrakhp merged commit 1d14e58 into envoyproxy:main Feb 24, 2026
57 of 59 checks passed

antonio-mazzini pushed a commit to antonio-mazzini/gateway that referenced this pull request Mar 5, 2026

fix: fixed local object reference resolution from parent in merged Ba…

86ee135

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026

fix: fixed local object reference resolution from parent in merged Ba…

235ce45

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp added a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026

fix: fixed local object reference resolution from parent in merged Ba…

373625f

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp added a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026

fix: fixed local object reference resolution from parent in merged Ba…

0d22fca

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp added a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026

fix: fixed local object reference resolution from parent in merged Ba…

10484b0

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp added a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026

fix: fixed local object reference resolution from parent in merged Ba…

e9d99a4

…ckendTrafficPolicies (envoyproxy#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies#8210

fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies#8210
rudrakhp merged 1 commit intoenvoyproxy:mainfrom
rudrakhp:fix_merged_policy_refs

rudrakhp commented Feb 8, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 8, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 8, 2026 •

edited

Loading

Uh oh!

arkodg Feb 8, 2026

Uh oh!

Uh oh!

arkodg Feb 16, 2026

Uh oh!

arkodg Feb 16, 2026

Uh oh!

rudrakhp Feb 19, 2026

Uh oh!

rudrakhp Feb 19, 2026

Uh oh!

rudrakhp Feb 19, 2026

Uh oh!

kkk777-7 commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

		@@ -0,0 +1,100 @@
		# Tests merged BackendTrafficPolicies when ResponseOverride ConfigMap lives in the
		# gateway (parent) policy's namespace. Gateway BTP is in envoy-gateway-system with

Conversation

rudrakhp commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov bot commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arkodg Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

kkk777-7 commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

rudrakhp commented Feb 8, 2026 •

edited

Loading

netlify bot commented Feb 8, 2026 •

edited

Loading

codecov bot commented Feb 8, 2026 •

edited

Loading