Skip to content

Commit 45bd0eb

Browse files
zirainzirain
committed
skip invalid listener first
Signed-off-by: zirain <zirain2009@gmail.com>
1 parent ef8f744 commit 45bd0eb

35 files changed

Lines changed: 108 additions & 748 deletions

File tree

‎internal/gatewayapi/listener.go‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -41,25 +41,11 @@ type ListenersTranslator interface {
4141
func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource.XdsIRMap, infraIR resource.InfraIRMap, resources *resource.Resources) {
4242
// Infra IR proxy ports must be unique.
4343
foundPorts := make(map[string][]*protocolPort)
44-
t.validateConflictedLayer7Listeners(gateways)
45-
t.validateConflictedLayer4Listeners(gateways, gwapiv1.TCPProtocolType)
46-
t.validateConflictedLayer4Listeners(gateways, gwapiv1.UDPProtocolType)
47-
if t.MergeGateways {
48-
t.validateConflictedMergedListeners(gateways)
49-
}
5044

51-
// Iterate through all listeners to validate spec
52-
// and compute status for each, and add valid ones
53-
// to the Xds IR.
45+
// Phase 1: Validate each listener's spec independently.
46+
// This must happen before conflict resolution so that invalid listeners
47+
// don't block valid ones during conflict detection.
5448
for _, gateway := range gateways {
55-
irKey := t.getIRKey(gateway.Gateway)
56-
57-
if gateway.envoyProxy != nil {
58-
infraIR[irKey].Proxy.Config = gateway.envoyProxy
59-
}
60-
t.processProxyReadyListener(xdsIR[irKey], gateway.envoyProxy)
61-
t.processProxyObservability(gateway, xdsIR[irKey], infraIR[irKey].Proxy, resources)
62-
6349
for _, listener := range gateway.listeners {
6450
// Process protocol & supported kinds
6551
switch listener.Protocol {
@@ -101,9 +87,35 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
10187

10288
// Process Hostname configuration
10389
t.validateHostName(listener)
90+
}
91+
}
10492

93+
// Phase 2: Run conflict detection.
94+
// Only listeners that haven't been marked as invalid will participate in conflict resolution.
95+
t.validateConflictedLayer7Listeners(gateways)
96+
t.validateConflictedLayer4Listeners(gateways, gwapiv1.TCPProtocolType)
97+
t.validateConflictedLayer4Listeners(gateways, gwapiv1.UDPProtocolType)
98+
if t.MergeGateways {
99+
t.validateConflictedMergedListeners(gateways)
100+
}
101+
102+
// Phase 3: Build IR for valid listeners.
103+
for _, gateway := range gateways {
104+
irKey := t.getIRKey(gateway.Gateway)
105+
106+
if gateway.envoyProxy != nil {
107+
infraIR[irKey].Proxy.Config = gateway.envoyProxy
108+
}
109+
t.processProxyReadyListener(xdsIR[irKey], gateway.envoyProxy)
110+
t.processProxyObservability(gateway, xdsIR[irKey], infraIR[irKey].Proxy, resources)
111+
112+
for _, listener := range gateway.listeners {
105113
// Process conditions and check if the listener is ready
106-
t.validateListenerConditions(listener)
114+
isReady := t.validateListenerConditions(listener)
115+
if !isReady {
116+
// Skip invalid listeners from IR building
117+
continue
118+
}
107119

108120
address := netutils.IPv4ListenerAddress
109121
ipFamily := getEnvoyIPFamily(gateway.envoyProxy)

‎internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -508,12 +508,6 @@ infraIR:
508508
name: http-80
509509
protocol: HTTP
510510
servicePort: 80
511-
- name: envoy-gateway/gateway-2/https
512-
ports:
513-
- containerPort: 10443
514-
name: https-443
515-
protocol: HTTPS
516-
servicePort: 443
517511
- name: envoy-gateway/gateway-2/tcp
518512
ports:
519513
- containerPort: 10053
@@ -735,20 +729,6 @@ xdsIR:
735729
namespace: envoy-gateway
736730
name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
737731
traffic: {}
738-
- address: 0.0.0.0
739-
externalPort: 443
740-
hostnames:
741-
- '*'
742-
metadata:
743-
kind: Gateway
744-
name: gateway-2
745-
namespace: envoy-gateway
746-
sectionName: https
747-
name: envoy-gateway/gateway-2/https
748-
path:
749-
escapedSlashesAction: UnescapeAndRedirect
750-
mergeSlashes: true
751-
port: 10443
752732
readyListener:
753733
address: 0.0.0.0
754734
ipFamily: IPv4

‎internal/gatewayapi/testdata/backendtrafficpolicy-with-routing-type-listener.out.yaml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -218,12 +218,6 @@ infraIR:
218218
name: http-80
219219
protocol: HTTP
220220
servicePort: 80
221-
- name: envoy-gateway/gateway-1/https
222-
ports:
223-
- containerPort: 10443
224-
name: https-443
225-
protocol: HTTPS
226-
servicePort: 443
227221
metadata:
228222
labels:
229223
gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -309,20 +303,6 @@ xdsIR:
309303
name: ""
310304
prefix: /foo
311305
traffic: {}
312-
- address: 0.0.0.0
313-
externalPort: 443
314-
hostnames:
315-
- '*'
316-
metadata:
317-
kind: Gateway
318-
name: gateway-1
319-
namespace: envoy-gateway
320-
sectionName: https
321-
name: envoy-gateway/gateway-1/https
322-
path:
323-
escapedSlashesAction: UnescapeAndRedirect
324-
mergeSlashes: true
325-
port: 10443
326306
readyListener:
327307
address: 0.0.0.0
328308
ipFamily: IPv4

‎internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -453,12 +453,6 @@ infraIR:
453453
name: http-80
454454
protocol: HTTP
455455
servicePort: 80
456-
- name: envoy-gateway/gateway-2/https
457-
ports:
458-
- containerPort: 10443
459-
name: https-443
460-
protocol: HTTPS
461-
servicePort: 443
462456
- name: envoy-gateway/gateway-2/tcp
463457
ports:
464458
- containerPort: 10053
@@ -596,20 +590,6 @@ xdsIR:
596590
escapedSlashesAction: UnescapeAndRedirect
597591
mergeSlashes: true
598592
port: 10080
599-
- address: 0.0.0.0
600-
externalPort: 443
601-
hostnames:
602-
- '*'
603-
metadata:
604-
kind: Gateway
605-
name: gateway-2
606-
namespace: envoy-gateway
607-
sectionName: https
608-
name: envoy-gateway/gateway-2/https
609-
path:
610-
escapedSlashesAction: UnescapeAndRedirect
611-
mergeSlashes: true
612-
port: 10443
613593
readyListener:
614594
address: 0.0.0.0
615595
ipFamily: IPv4

‎internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -508,12 +508,6 @@ infraIR:
508508
name: http-80
509509
protocol: HTTP
510510
servicePort: 80
511-
- name: envoy-gateway/gateway-2/https
512-
ports:
513-
- containerPort: 10443
514-
name: https-443
515-
protocol: HTTPS
516-
servicePort: 443
517511
- name: envoy-gateway/gateway-2/tcp
518512
ports:
519513
- containerPort: 10053
@@ -727,20 +721,6 @@ xdsIR:
727721
name: grpcroute-1
728722
namespace: envoy-gateway
729723
name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
730-
- address: 0.0.0.0
731-
externalPort: 443
732-
hostnames:
733-
- '*'
734-
metadata:
735-
kind: Gateway
736-
name: gateway-2
737-
namespace: envoy-gateway
738-
sectionName: https
739-
name: envoy-gateway/gateway-2/https
740-
path:
741-
escapedSlashesAction: UnescapeAndRedirect
742-
mergeSlashes: true
743-
port: 10443
744724
readyListener:
745725
address: 0.0.0.0
746726
ipFamily: IPv4

‎internal/gatewayapi/testdata/gateway-with-attached-routes.out.yaml‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -326,13 +326,6 @@ infraIR:
326326
namespace: envoy-gateway-system
327327
envoy-gateway/unresolved-gateway-with-one-attached-unresolved-route:
328328
proxy:
329-
listeners:
330-
- name: envoy-gateway/unresolved-gateway-with-one-attached-unresolved-route/tls
331-
ports:
332-
- containerPort: 10443
333-
name: https-443
334-
protocol: HTTPS
335-
servicePort: 443
336329
metadata:
337330
labels:
338331
gateway.envoyproxy.io/owning-gateway-name: unresolved-gateway-with-one-attached-unresolved-route
@@ -487,21 +480,6 @@ xdsIR:
487480
sectionName: "8080"
488481
name: envoy-gateway/unresolved-gateway-with-one-attached-unresolved-route
489482
protocol: TCP
490-
http:
491-
- address: 0.0.0.0
492-
externalPort: 443
493-
hostnames:
494-
- '*'
495-
metadata:
496-
kind: Gateway
497-
name: unresolved-gateway-with-one-attached-unresolved-route
498-
namespace: envoy-gateway
499-
sectionName: tls
500-
name: envoy-gateway/unresolved-gateway-with-one-attached-unresolved-route/tls
501-
path:
502-
escapedSlashesAction: UnescapeAndRedirect
503-
mergeSlashes: true
504-
port: 10443
505483
readyListener:
506484
address: 0.0.0.0
507485
ipFamily: IPv4

‎internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,6 @@ httpRoutes:
7878
infraIR:
7979
envoy-gateway/gateway-1:
8080
proxy:
81-
listeners:
82-
- name: envoy-gateway/gateway-1/http
83-
ports:
84-
- containerPort: 10080
85-
name: http-80
86-
protocol: HTTP
87-
servicePort: 80
8881
metadata:
8982
labels:
9083
gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -120,21 +113,6 @@ xdsIR:
120113
sectionName: "8080"
121114
name: envoy-gateway/gateway-1
122115
protocol: TCP
123-
http:
124-
- address: 0.0.0.0
125-
externalPort: 80
126-
hostnames:
127-
- '*'
128-
metadata:
129-
kind: Gateway
130-
name: gateway-1
131-
namespace: envoy-gateway
132-
sectionName: http
133-
name: envoy-gateway/gateway-1/http
134-
path:
135-
escapedSlashesAction: UnescapeAndRedirect
136-
mergeSlashes: true
137-
port: 10080
138116
readyListener:
139117
address: 0.0.0.0
140118
ipFamily: IPv4

‎internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,6 @@ httpRoutes:
6969
infraIR:
7070
envoy-gateway/gateway-1:
7171
proxy:
72-
listeners:
73-
- name: envoy-gateway/gateway-1/http
74-
ports:
75-
- containerPort: 10080
76-
name: http-80
77-
protocol: HTTP
78-
servicePort: 80
7972
metadata:
8073
labels:
8174
gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -111,21 +104,6 @@ xdsIR:
111104
sectionName: "8080"
112105
name: envoy-gateway/gateway-1
113106
protocol: TCP
114-
http:
115-
- address: 0.0.0.0
116-
externalPort: 80
117-
hostnames:
118-
- '*'
119-
metadata:
120-
kind: Gateway
121-
name: gateway-1
122-
namespace: envoy-gateway
123-
sectionName: http
124-
name: envoy-gateway/gateway-1/http
125-
path:
126-
escapedSlashesAction: UnescapeAndRedirect
127-
mergeSlashes: true
128-
port: 10080
129107
readyListener:
130108
address: 0.0.0.0
131109
ipFamily: IPv4

‎internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,6 @@ httpRoutes:
7171
infraIR:
7272
envoy-gateway/gateway-1:
7373
proxy:
74-
listeners:
75-
- name: envoy-gateway/gateway-1/http
76-
ports:
77-
- containerPort: 10080
78-
name: http-80
79-
protocol: HTTP
80-
servicePort: 80
8174
metadata:
8275
labels:
8376
gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -113,21 +106,6 @@ xdsIR:
113106
sectionName: "8080"
114107
name: envoy-gateway/gateway-1
115108
protocol: TCP
116-
http:
117-
- address: 0.0.0.0
118-
externalPort: 80
119-
hostnames:
120-
- '*'
121-
metadata:
122-
kind: Gateway
123-
name: gateway-1
124-
namespace: envoy-gateway
125-
sectionName: http
126-
name: envoy-gateway/gateway-1/http
127-
path:
128-
escapedSlashesAction: UnescapeAndRedirect
129-
mergeSlashes: true
130-
port: 10080
131109
readyListener:
132110
address: 0.0.0.0
133111
ipFamily: IPv4

‎internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,6 @@ httpRoutes:
6969
infraIR:
7070
envoy-gateway/gateway-1:
7171
proxy:
72-
listeners:
73-
- name: envoy-gateway/gateway-1/http
74-
ports:
75-
- containerPort: 10080
76-
name: http-80
77-
protocol: HTTP
78-
servicePort: 80
7972
metadata:
8073
labels:
8174
gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -111,21 +104,6 @@ xdsIR:
111104
sectionName: "8080"
112105
name: envoy-gateway/gateway-1
113106
protocol: TCP
114-
http:
115-
- address: 0.0.0.0
116-
externalPort: 80
117-
hostnames:
118-
- '*'
119-
metadata:
120-
kind: Gateway
121-
name: gateway-1
122-
namespace: envoy-gateway
123-
sectionName: http
124-
name: envoy-gateway/gateway-1/http
125-
path:
126-
escapedSlashesAction: UnescapeAndRedirect
127-
mergeSlashes: true
128-
port: 10080
129107
readyListener:
130108
address: 0.0.0.0
131109
ipFamily: IPv4

0 commit comments

Comments
 (0)