Skip to content

Commit 828cd01

Browse files
fabian4fabian4
authored
set the status when EPP target to a MergeGateways with wrong kind (#7490)
fix: enhance EnvoyPatchPolicy error handling for target references Signed-off-by: fabian4 <fabian.v.bao@gmail.com>
1 parent 9d84fa8 commit 828cd01

11 files changed

Lines changed: 427 additions & 9 deletions

‎internal/gatewayapi/envoypatchpolicy.go‎

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,41 @@ func (t *Translator) ProcessEnvoyPatchPolicies(envoyPatchPolicies []*egv1a1.Envo
2626
resolveErr *status.PolicyResolveError
2727
targetKind string
2828
irKey string
29+
gwXdsIR *ir.Xds
30+
ok bool
2931
)
3032

31-
refKind, refName := policy.Spec.TargetRef.Kind, policy.Spec.TargetRef.Name
33+
refGroup, refKind, refName := policy.Spec.TargetRef.Group, policy.Spec.TargetRef.Kind, policy.Spec.TargetRef.Name
3234
if t.MergeGateways {
3335
targetKind = resource.KindGatewayClass
34-
// if ref GatewayClass name is not same as t.GatewayClassName, it will be skipped in L53.
36+
// if ref GatewayClass name is not same as t.GatewayClassName, it will be skipped in L74.
3537
irKey = string(refName)
3638
ancestorRef = gwapiv1.ParentReference{
3739
Group: GroupPtr(gwapiv1.GroupName),
3840
Kind: KindPtr(targetKind),
3941
Name: refName,
4042
}
4143

44+
gwXdsIR, ok = xdsIR[irKey]
45+
if !ok {
46+
// The TargetRef GatewayClass is not an accepted GatewayClass, then skip processing.
47+
message := fmt.Sprintf(
48+
"TargetRef.Group:%s TargetRef.Kind:%s TargetRef.Namespace:%s TargetRef.Name:%s not found or not accepted (MergeGateways=%t).",
49+
refGroup, refKind, policy.Namespace, string(refName), t.MergeGateways,
50+
)
51+
resolveErr = &status.PolicyResolveError{
52+
Reason: gwapiv1.PolicyReasonInvalid,
53+
Message: message,
54+
}
55+
status.SetResolveErrorForPolicyAncestor(&policy.Status,
56+
&ancestorRef,
57+
t.GatewayControllerName,
58+
policy.Generation,
59+
resolveErr,
60+
)
61+
continue
62+
}
63+
4264
} else {
4365
targetKind = resource.KindGateway
4466
gatewayNN := types.NamespacedName{
@@ -47,12 +69,12 @@ func (t *Translator) ProcessEnvoyPatchPolicies(envoyPatchPolicies []*egv1a1.Envo
4769
}
4870
irKey = t.IRKey(gatewayNN)
4971
ancestorRef = getAncestorRefForPolicy(gatewayNN, nil)
50-
}
5172

52-
gwXdsIR, ok := xdsIR[irKey]
53-
if !ok {
54-
// The TargetRef Gateway is not an accepted Gateway, then skip processing.
55-
continue
73+
gwXdsIR, ok = xdsIR[irKey]
74+
if !ok {
75+
// The TargetRef Gateway is not an accepted Gateway, then skip processing.
76+
continue
77+
}
5678
}
5779

5880
// Create the IR with the context need to publish the status later
@@ -82,9 +104,9 @@ func (t *Translator) ProcessEnvoyPatchPolicies(envoyPatchPolicies []*egv1a1.Envo
82104
}
83105

84106
// Ensure EnvoyPatchPolicy is targeting to a support type
85-
if policy.Spec.TargetRef.Group != gwapiv1.GroupName || string(refKind) != targetKind {
107+
if refGroup != gwapiv1.GroupName || string(refKind) != targetKind {
86108
message := fmt.Sprintf("TargetRef.Group:%s TargetRef.Kind:%s, only TargetRef.Group:%s and TargetRef.Kind:%s is supported.",
87-
policy.Spec.TargetRef.Group, policy.Spec.TargetRef.Kind, gwapiv1.GroupName, targetKind)
109+
refGroup, policy.Spec.TargetRef.Kind, gwapiv1.GroupName, targetKind)
88110

89111
resolveErr = &status.PolicyResolveError{
90112
Reason: gwapiv1.PolicyReasonInvalid,

‎internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: edit-conn-buffer-bytes
6+
namespace: envoy-gateway-2
7+
spec:
8+
jsonPatches:
9+
- name: envoy-gateway-gateway-1-http
10+
operation:
11+
op: replace
12+
path: /per_connection_buffer_limit_bytes
13+
value: "1024"
14+
type: type.googleapis.com/envoy.config.listener.v3.Listener
15+
targetRef:
16+
group: gateway.networking.k8s.io
17+
kind: Gateway
18+
name: gateway-1
19+
type: JSONPatch
20+
status:
21+
ancestors: null
122
gateways:
223
- apiVersion: gateway.networking.k8s.io/v1
324
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,35 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: edit-conn-buffer-bytes
6+
namespace: envoy-gateway
7+
spec:
8+
jsonPatches:
9+
- name: envoy-gateway-gateway-1-http
10+
operation:
11+
op: replace
12+
path: /per_connection_buffer_limit_bytes
13+
value: "1024"
14+
type: type.googleapis.com/envoy.config.listener.v3.Listener
15+
targetRef:
16+
group: gateway.networking.k8s.io
17+
kind: GatewayClass
18+
name: envoy-gateway-class
19+
type: JSONPatch
20+
status:
21+
ancestors:
22+
- ancestorRef:
23+
group: gateway.networking.k8s.io
24+
kind: GatewayClass
25+
name: envoy-gateway-class
26+
conditions:
27+
- lastTransitionTime: null
28+
message: EnvoyPatchPolicy is disabled in the EnvoyGateway configuration
29+
reason: Disabled
30+
status: "False"
31+
type: Accepted
32+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
133
gateways:
234
- apiVersion: gateway.networking.k8s.io/v1
335
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-invalid-merge-gateways.out.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,69 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: gateway-class-not-exists
6+
namespace: envoy-gateway
7+
spec:
8+
jsonPatches:
9+
- name: envoy-gateway-gateway-1-http
10+
operation:
11+
op: replace
12+
path: /per_connection_buffer_limit_bytes
13+
value: "1024"
14+
type: type.googleapis.com/envoy.config.listener.v3.Listener
15+
targetRef:
16+
group: gateway.networking.k8s.io
17+
kind: GatewayClass
18+
name: gateway-class-not-exists
19+
type: JSONPatch
20+
status:
21+
ancestors:
22+
- ancestorRef:
23+
group: gateway.networking.k8s.io
24+
kind: GatewayClass
25+
name: gateway-class-not-exists
26+
conditions:
27+
- lastTransitionTime: null
28+
message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:GatewayClass
29+
TargetRef.Namespace:envoy-gateway TargetRef.Name:gateway-class-not-exists
30+
not found or not accepted (MergeGateways=true).
31+
reason: Invalid
32+
status: "False"
33+
type: Accepted
34+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
35+
- apiVersion: gateway.envoyproxy.io/v1alpha1
36+
kind: EnvoyPatchPolicy
37+
metadata:
38+
name: edit-ignore-global-limit
39+
namespace: envoy-gateway
40+
spec:
41+
jsonPatches:
42+
- name: envoy-gateway-gateway-1-http
43+
operation:
44+
op: replace
45+
path: /ignore_global_conn_limit
46+
value: "true"
47+
type: type.googleapis.com/envoy.config.listener.v3.Listener
48+
priority: -1
49+
targetRef:
50+
group: gateway.networking.k8s.io
51+
kind: GatewayClass
52+
name: envoy-gateway-class
53+
type: JSONPatch
54+
status:
55+
ancestors:
56+
- ancestorRef:
57+
group: gateway.networking.k8s.io
58+
kind: GatewayClass
59+
name: envoy-gateway-class
60+
conditions:
61+
- lastTransitionTime: null
62+
message: Policy has been accepted.
63+
reason: Accepted
64+
status: "True"
65+
type: Accepted
66+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
167
gateways:
268
- apiVersion: gateway.networking.k8s.io/v1
369
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,37 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: edit-conn-buffer-bytes
6+
namespace: envoy-gateway
7+
spec:
8+
jsonPatches:
9+
- name: envoy-gateway-gateway-1-http
10+
operation:
11+
op: replace
12+
path: /per_connection_buffer_limit_bytes
13+
value: "1024"
14+
type: type.googleapis.com/envoy.config.listener.v3.Listener
15+
targetRef:
16+
group: gateway.networking.k8s.io
17+
kind: Gateway
18+
name: gateway-1
19+
type: JSONPatch
20+
status:
21+
ancestors:
22+
- ancestorRef:
23+
group: gateway.networking.k8s.io
24+
kind: GatewayClass
25+
name: gateway-1
26+
conditions:
27+
- lastTransitionTime: null
28+
message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:Gateway
29+
TargetRef.Namespace:envoy-gateway TargetRef.Name:gateway-1 not found or
30+
not accepted (MergeGateways=true).
31+
reason: Invalid
32+
status: "False"
33+
type: Accepted
34+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
135
gateways:
236
- apiVersion: gateway.networking.k8s.io/v1
337
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,38 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: edit-conn-buffer-bytes
6+
namespace: envoy-gateway
7+
spec:
8+
jsonPatches:
9+
- name: envoy-gateway-gateway-1-http
10+
operation:
11+
op: replace
12+
path: /per_connection_buffer_limit_bytes
13+
value: "1024"
14+
type: type.googleapis.com/envoy.config.listener.v3.Listener
15+
targetRef:
16+
group: gateway.networking.k8s.io
17+
kind: MyGateway
18+
name: gateway-1
19+
type: JSONPatch
20+
status:
21+
ancestors:
22+
- ancestorRef:
23+
group: gateway.networking.k8s.io
24+
kind: Gateway
25+
name: gateway-1
26+
namespace: envoy-gateway
27+
conditions:
28+
- lastTransitionTime: null
29+
message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:MyGateway,
30+
only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:Gateway
31+
is supported.
32+
reason: Invalid
33+
status: "False"
34+
type: Accepted
35+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
136
gateways:
237
- apiVersion: gateway.networking.k8s.io/v1
338
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-name.out.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,60 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
generation: 10
6+
name: gateway-not-exists
7+
namespace: envoy-gateway
8+
spec:
9+
jsonPatches:
10+
- name: envoy-gateway-gateway-1-http
11+
operation:
12+
op: replace
13+
path: /per_connection_buffer_limit_bytes
14+
value: "1024"
15+
type: type.googleapis.com/envoy.config.listener.v3.Listener
16+
targetRef:
17+
group: gateway.networking.k8s.io
18+
kind: Gateway
19+
name: gateway-not-exists
20+
type: JSONPatch
21+
status:
22+
ancestors: null
23+
- apiVersion: gateway.envoyproxy.io/v1alpha1
24+
kind: EnvoyPatchPolicy
25+
metadata:
26+
generation: 10
27+
name: edit-ignore-global-limit
28+
namespace: envoy-gateway
29+
spec:
30+
jsonPatches:
31+
- name: envoy-gateway-gateway-1-http
32+
operation:
33+
op: replace
34+
path: /ignore_global_conn_limit
35+
value: "true"
36+
type: type.googleapis.com/envoy.config.listener.v3.Listener
37+
priority: -1
38+
targetRef:
39+
group: gateway.networking.k8s.io
40+
kind: Gateway
41+
name: gateway-1
42+
type: JSONPatch
43+
status:
44+
ancestors:
45+
- ancestorRef:
46+
group: gateway.networking.k8s.io
47+
kind: Gateway
48+
name: gateway-1
49+
namespace: envoy-gateway
50+
conditions:
51+
- lastTransitionTime: null
52+
message: Policy has been accepted.
53+
observedGeneration: 10
54+
reason: Accepted
55+
status: "True"
56+
type: Accepted
57+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
158
gateways:
259
- apiVersion: gateway.networking.k8s.io/v1
360
kind: Gateway

‎internal/gatewayapi/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,16 @@
1+
envoyPatchPolicies:
2+
- apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyPatchPolicy
4+
metadata:
5+
name: target-unknown-gateway
6+
namespace: envoy-gateway
7+
spec:
8+
targetRef:
9+
group: gateway.networking.k8s.io
10+
kind: Gateway
11+
name: unknown-gateway
12+
type: JSONPatch
13+
status:
14+
ancestors: null
115
infraIR: {}
216
xdsIR: {}

0 commit comments

Comments
 (0)