fix: grant configmaps RBAC and reduce getListenerStatus complexity

- Add configmaps get/list/watch to the e2e/conformance controller manifest
  so the ConfigMap informer can sync; without it the manager cache never
  becomes ready and all reconcile-dependent tests time out.
- Extract frontendValidation listener validation into a helper to keep
  getListenerStatus under the gocyclo threshold.
- Use a constant for the repeated "api6.com" test host (goconst).

Author: AlinsRan

internal/controller/utils.go

@@ -942,66 +942,7 @@ func getListenerStatus(
 			}
 
 			if listener.TLS.FrontendValidation != nil {
-				var configMap corev1.ConfigMap
-				for _, ref := range listener.TLS.FrontendValidation.CACertificateRefs {
-					if ref.Group != "" && string(ref.Group) != corev1.GroupName {
-						conditionResolvedRefs.Status = metav1.ConditionFalse
-						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonInvalidCertificateRef)
-						conditionResolvedRefs.Message = fmt.Sprintf(`Invalid Group for caCertificateRef, expect "", got "%s"`, ref.Group)
-						conditionProgrammed.Status = metav1.ConditionFalse
-						conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
-						break
-					}
-					if ref.Kind != "" && string(ref.Kind) != KindConfigMap {
-						conditionResolvedRefs.Status = metav1.ConditionFalse
-						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonInvalidCertificateRef)
-						conditionResolvedRefs.Message = fmt.Sprintf(`Invalid Kind for caCertificateRef, expect "ConfigMap", got "%s"`, ref.Kind)
-						conditionProgrammed.Status = metav1.ConditionFalse
-						conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
-						break
-					}
-					if permitted := checkReferenceGrant(ctx,
-						mrgc,
-						v1beta1.ReferenceGrantFrom{
-							Group:     gatewayv1.GroupName,
-							Kind:      KindGateway,
-							Namespace: v1beta1.Namespace(gateway.Namespace),
-						},
-						gatewayv1.ObjectReference{
-							Group:     corev1.GroupName,
-							Kind:      KindConfigMap,
-							Name:      ref.Name,
-							Namespace: ref.Namespace,
-						},
-					); !permitted {
-						conditionResolvedRefs.Status = metav1.ConditionFalse
-						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonRefNotPermitted)
-						conditionResolvedRefs.Message = "caCertificateRefs cross namespaces is not permitted"
-						conditionProgrammed.Status = metav1.ConditionFalse
-						conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
-						break
-					}
-					configMapNN := k8stypes.NamespacedName{
-						Namespace: string(*cmp.Or(ref.Namespace, (*gatewayv1.Namespace)(&gateway.Namespace))),
-						Name:      string(ref.Name),
-					}
-					if err := mrgc.Get(ctx, configMapNN, &configMap); err != nil {
-						conditionResolvedRefs.Status = metav1.ConditionFalse
-						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonInvalidCertificateRef)
-						conditionResolvedRefs.Message = err.Error()
-						conditionProgrammed.Status = metav1.ConditionFalse
-						conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
-						break
-					}
-					if _, err := sslutils.ExtractCAFromConfigMap(&configMap); err != nil {
-						conditionResolvedRefs.Status = metav1.ConditionFalse
-						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonInvalidCertificateRef)
-						conditionResolvedRefs.Message = fmt.Sprintf("Malformed CA ConfigMap referenced: %s", err.Error())
-						conditionProgrammed.Status = metav1.ConditionFalse
-						conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
-						break
-					}
-				}
+				validateListenerFrontendValidation(ctx, mrgc, gateway, listener.TLS.FrontendValidation, &conditionResolvedRefs, &conditionProgrammed)
 			}
 		}
 
@@ -1041,6 +982,68 @@ func getListenerStatus(
 	return statusArray, nil
 }
 
+// validateListenerFrontendValidation validates a listener's TLS frontendValidation
+// (downstream mTLS CA references) and records the outcome on the listener conditions.
+func validateListenerFrontendValidation(
+	ctx context.Context,
+	mrgc client.Client,
+	gateway *gatewayv1.Gateway,
+	frontendValidation *gatewayv1.FrontendTLSValidation,
+	conditionResolvedRefs, conditionProgrammed *metav1.Condition,
+) {
+	setInvalid := func(reason gatewayv1.ListenerConditionReason, message string) {
+		conditionResolvedRefs.Status = metav1.ConditionFalse
+		conditionResolvedRefs.Reason = string(reason)
+		conditionResolvedRefs.Message = message
+		conditionProgrammed.Status = metav1.ConditionFalse
+		conditionProgrammed.Reason = string(gatewayv1.ListenerReasonInvalid)
+	}
+
+	var configMap corev1.ConfigMap
+	for _, ref := range frontendValidation.CACertificateRefs {
+		if ref.Group != "" && string(ref.Group) != corev1.GroupName {
+			setInvalid(gatewayv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf(`Invalid Group for caCertificateRef, expect "", got "%s"`, ref.Group))
+			return
+		}
+		if ref.Kind != "" && string(ref.Kind) != KindConfigMap {
+			setInvalid(gatewayv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf(`Invalid Kind for caCertificateRef, expect "ConfigMap", got "%s"`, ref.Kind))
+			return
+		}
+		if permitted := checkReferenceGrant(ctx,
+			mrgc,
+			v1beta1.ReferenceGrantFrom{
+				Group:     gatewayv1.GroupName,
+				Kind:      KindGateway,
+				Namespace: v1beta1.Namespace(gateway.Namespace),
+			},
+			gatewayv1.ObjectReference{
+				Group:     corev1.GroupName,
+				Kind:      KindConfigMap,
+				Name:      ref.Name,
+				Namespace: ref.Namespace,
+			},
+		); !permitted {
+			setInvalid(gatewayv1.ListenerReasonRefNotPermitted, "caCertificateRefs cross namespaces is not permitted")
+			return
+		}
+		configMapNN := k8stypes.NamespacedName{
+			Namespace: string(*cmp.Or(ref.Namespace, (*gatewayv1.Namespace)(&gateway.Namespace))),
+			Name:      string(ref.Name),
+		}
+		if err := mrgc.Get(ctx, configMapNN, &configMap); err != nil {
+			setInvalid(gatewayv1.ListenerReasonInvalidCertificateRef, err.Error())
+			return
+		}
+		if _, err := sslutils.ExtractCAFromConfigMap(&configMap); err != nil {
+			setInvalid(gatewayv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Malformed CA ConfigMap referenced: %s", err.Error()))
+			return
+		}
+	}
+}
+
 // SplitMetaNamespaceKey returns the namespace and name that
 // MetaNamespaceKeyFunc encoded into key.
 func SplitMetaNamespaceKey(key string) (namespace, name string, err error) {

test/e2e/framework/manifests/ingress.yaml

@@ -80,6 +80,7 @@ rules:
 - apiGroups:
   - ""
   resources:
+  - configmaps
   - namespaces
   - pods
   - secrets

test/e2e/gatewayapi/gateway.go

@@ -36,6 +36,8 @@ import (
 
 const _secretName = "test-apisix-tls"
 
+const _hostAPI6 = "api6.com"
+
 var Cert = strings.TrimSpace(framework.TestServerCert)
 
 var Key = strings.TrimSpace(framework.TestServerKey)
@@ -176,7 +178,7 @@ spec:
 
 			By("create secret")
 			secretName := _secretName
-			host := "api6.com"
+			host := _hostAPI6
 			createSecret(s, secretName)
 			gatewayClassName := s.Namespace()
 			var defaultGatewayClass = `
@@ -238,7 +240,7 @@ spec:
 
 			By("create server cert secret")
 			secretName := _secretName
-			host := "api6.com"
+			host := _hostAPI6
 			createSecret(s, secretName)
 
 			By("create CA ConfigMap for frontendValidation")