Check all route types vs only HTTPRoute

Signed-off-by: jukie <isaac.wilson514@gmail.com>

Author: jukie

internal/gatewayapi/route.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -179,7 +180,7 @@ func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, res
 				"Resolved all the Object references for the Route",
 			)
 		}
-		hasHostnameIntersection, hasOverlap := t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
+		hasHostnameIntersection := t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
 		if !hasHostnameIntersection {
 			routeStatus := GetRouteStatus(httpRoute)
 			status.SetRouteStatusCondition(routeStatus,
@@ -192,18 +193,6 @@ func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, res
 			)
 		}
 
-		if hasOverlap {
-			routeStatus := GetRouteStatus(httpRoute)
-			status.SetRouteStatusCondition(routeStatus,
-				parentRef.routeParentStatusIdx,
-				httpRoute.GetGeneration(),
-				gwapiv1.RouteConditionResolvedRefs,
-				metav1.ConditionFalse,
-				status.RouteReasonOverlap,
-				"Overlapping match conditions with another HTTPRoute on the same listener and hostname",
-			)
-		}
-
 		// Skip parent refs that did not accept the route
 		if parentRef.HasCondition(httpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
 			continue
@@ -920,7 +909,7 @@ func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, res
 		if parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
 			continue
 		}
-		hasHostnameIntersection, hasOverlap := t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
+		hasHostnameIntersection := t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
 		if !hasHostnameIntersection {
 			routeStatus := GetRouteStatus(grpcRoute)
 			status.SetRouteStatusCondition(routeStatus,
@@ -933,18 +922,6 @@ func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, res
 			)
 		}
 
-		if hasOverlap {
-			routeStatus := GetRouteStatus(grpcRoute)
-			status.SetRouteStatusCondition(routeStatus,
-				parentRef.routeParentStatusIdx,
-				grpcRoute.GetGeneration(),
-				gwapiv1.RouteConditionResolvedRefs,
-				metav1.ConditionFalse,
-				status.RouteReasonOverlap,
-				"Overlapping match conditions with another GRPCRoute on the same listener and hostname",
-			)
-		}
-
 		// If no negative conditions have been set, the route is considered "Accepted=True".
 		if parentRef.GRPCRoute != nil &&
 			len(parentRef.GRPCRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
@@ -1269,10 +1246,9 @@ func (t *Translator) processGRPCRouteMethodRegularExpression(method *gwapiv1.GRP
 	}
 }
 
-func (t *Translator) processHTTPRouteParentRefListener(route RouteContext, routeRoutes []*ir.HTTPRoute, parentRef *RouteParentContext, xdsIR resource.XdsIRMap) (bool, bool) {
+func (t *Translator) processHTTPRouteParentRefListener(route RouteContext, routeRoutes []*ir.HTTPRoute, parentRef *RouteParentContext, xdsIR resource.XdsIRMap) bool {
 	// need to check hostname intersection if there are listeners
 	hasHostnameIntersection := len(parentRef.listeners) == 0
-	var hasOverlap bool
 
 	for _, listener := range parentRef.listeners {
 		hosts := computeHosts(GetHostnames(route), listener)
@@ -1328,31 +1304,130 @@ func (t *Translator) processHTTPRouteParentRefListener(route RouteContext, route
 				irListener.GRPC.EnableGRPCStats = ptr.To(true)
 			}
 
-			// Check for overlapping route matches before adding new routes.
-			// Two routes overlap when they are from different route resources
-			// but have identical match conditions on the same hostname.
-			routePrefix := irRoutePrefix(route)
-			for _, newRoute := range perHostRoutes {
-				for _, existingRoute := range irListener.Routes {
-					if strings.HasPrefix(existingRoute.Name, routePrefix) {
-						// Same route resource, skip.
+			irListener.Routes = append(irListener.Routes, perHostRoutes...)
+		}
+	}
+
+	return hasHostnameIntersection
+}
+
+// checkRouteOverlaps detects overlapping route matches across all IR listeners
+// and sets a warning Overlap condition on the affected HTTPRoutes.
+// This runs once after all routes are processed, checking each listener's routes
+// for duplicates from different HTTPRoute resources.
+// routeKey returns a "namespace/name" key for a route resource metadata.
+func routeKey(namespace, name string) string {
+	return namespace + "/" + name
+}
+
+// checkRouteOverlaps detects overlapping route matches across all IR listeners
+// and sets a warning Overlap condition on the affected HTTPRoutes and GRPCRoutes.
+// This runs once after all routes are processed, rather than inside the per-route
+// processing loop where it would execute N times.
+func (t *Translator) checkRouteOverlaps(httpRoutes []*HTTPRouteContext, grpcRoutes []*GRPCRouteContext, xdsIR resource.XdsIRMap) {
+	// Build a combined lookup from "namespace/name" to RouteContext and its ParentRefs.
+	type routeInfo struct {
+		route      RouteContext
+		parentRefs map[gwapiv1.ParentReference]*RouteParentContext
+	}
+	routeByKey := make(map[string]*routeInfo, len(httpRoutes)+len(grpcRoutes))
+	for _, hr := range httpRoutes {
+		routeByKey[routeKey(hr.GetNamespace(), hr.GetName())] = &routeInfo{route: hr, parentRefs: hr.ParentRefs}
+	}
+	for _, gr := range grpcRoutes {
+		routeByKey[routeKey(gr.GetNamespace(), gr.GetName())] = &routeInfo{route: gr, parentRefs: gr.ParentRefs}
+	}
+
+	// overlaps tracks per IR listener which routes overlap with which others.
+	// Key: IR listener name -> route key -> set of conflicting route keys.
+	type listenerOverlaps map[string]map[string]struct{}
+	overlaps := make(map[string]listenerOverlaps)
+
+	for _, xds := range xdsIR {
+		for _, httpListener := range xds.HTTP {
+			routes := httpListener.Routes
+			for i := 0; i < len(routes); i++ {
+				if routes[i].Metadata == nil {
+					continue
+				}
+				aKey := routeKey(routes[i].Metadata.Namespace, routes[i].Metadata.Name)
+				for j := i + 1; j < len(routes); j++ {
+					if routes[j].Metadata == nil {
 						continue
 					}
-					if routeMatchesOverlap(existingRoute, newRoute) {
-						hasOverlap = true
-						break
+					bKey := routeKey(routes[j].Metadata.Namespace, routes[j].Metadata.Name)
+					if aKey == bKey {
+						continue
+					}
+					if routeMatchesOverlap(routes[i], routes[j]) {
+						if overlaps[httpListener.Name] == nil {
+							overlaps[httpListener.Name] = make(listenerOverlaps)
+						}
+						lo := overlaps[httpListener.Name]
+						if lo[aKey] == nil {
+							lo[aKey] = make(map[string]struct{})
+						}
+						if lo[bKey] == nil {
+							lo[bKey] = make(map[string]struct{})
+						}
+						lo[aKey][bKey] = struct{}{}
+						lo[bKey][aKey] = struct{}{}
 					}
 				}
-				if hasOverlap {
-					break
+			}
+		}
+	}
+
+	// Set the Overlap warning condition only on parentRefs whose listeners
+	// match an IR listener where the overlap was detected.
+	for rKey, info := range routeByKey {
+		// Collect all conflicts for this route across the parentRefs that have overlaps.
+		for _, parentRef := range info.parentRefs {
+			var conflicts map[string]struct{}
+			for _, listener := range parentRef.listeners {
+				irKey := t.getIRKey(listener.gateway.Gateway)
+				irListener := xdsIR[irKey].GetHTTPListener(irListenerName(listener))
+				if irListener == nil {
+					continue
+				}
+				lo, ok := overlaps[irListener.Name]
+				if !ok {
+					continue
+				}
+				routeConflicts, ok := lo[rKey]
+				if !ok {
+					continue
 				}
+				if conflicts == nil {
+					conflicts = make(map[string]struct{})
+				}
+				for c := range routeConflicts {
+					conflicts[c] = struct{}{}
+				}
+			}
+			if len(conflicts) == 0 {
+				continue
 			}
 
-			irListener.Routes = append(irListener.Routes, perHostRoutes...)
+			conflictNames := make([]string, 0, len(conflicts))
+			for name := range conflicts {
+				conflictNames = append(conflictNames, name)
+			}
+			sort.Strings(conflictNames)
+
+			msg := fmt.Sprintf("Overlapping match conditions with route(s): %s", strings.Join(conflictNames, ", "))
+
+			routeStatus := GetRouteStatus(info.route)
+			status.SetRouteStatusCondition(routeStatus,
+				parentRef.routeParentStatusIdx,
+				info.route.GetGeneration(),
+				status.RouteConditionOverlap,
+				metav1.ConditionTrue,
+				status.RouteReasonOverlap,
+				msg,
+			)
 		}
 	}
-
-	return hasHostnameIntersection, hasOverlap
 }
 
 // routeMatchesOverlap checks if two IR HTTP routes have identical match conditions,

internal/gatewayapi/status/error.go

@@ -31,8 +31,9 @@ const (
 	RouteReasonInvalidAddress         gwapiv1.RouteConditionReason = "InvalidAddress"
 	RouteReasonEndpointsNotFound      gwapiv1.RouteConditionReason = "EndpointsNotFound"
 
-	// Route overlap reason
-	RouteReasonOverlap gwapiv1.RouteConditionReason = "Overlap"
+	// Route overlap reason and condition type
+	RouteReasonOverlap      gwapiv1.RouteConditionReason = "Overlap"
+	RouteConditionOverlap   gwapiv1.RouteConditionType   = "Overlap"
 
 	// Network configuration related condition types
 	RouteConditionBackendsAvailable gwapiv1.RouteConditionType = "BackendsAvailable"

internal/gatewayapi/testdata/httproute-overlapping-matches.out.yaml

@@ -69,6 +69,11 @@ httpRoutes:
         reason: ResolvedRefs
         status: "True"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: 'Overlapping match conditions with route(s): default/httproute-2'
+        reason: Overlap
+        status: "True"
+        type: Overlap
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
         name: gateway-1
@@ -99,11 +104,15 @@ httpRoutes:
         status: "True"
         type: Accepted
       - lastTransitionTime: null
-        message: Overlapping match conditions with another HTTPRoute on the same listener
-          and hostname
-        reason: Overlap
-        status: "False"
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: 'Overlapping match conditions with route(s): default/httproute-1'
+        reason: Overlap
+        status: "True"
+        type: Overlap
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
         name: gateway-1
@@ -158,7 +167,6 @@ xdsIR:
       externalPort: 80
       hostnames:
       - '*'
-      isHTTP2: false
       metadata:
         kind: Gateway
         name: gateway-1

internal/gatewayapi/translator.go

@@ -286,6 +286,11 @@ func (t *Translator) Translate(resources *resource.Resources) (*TranslateResult,
 	// Process all relevant GRPCRoutes.
 	grpcRoutes := t.ProcessGRPCRoutes(resources.GRPCRoutes, acceptedGateways, resources, xdsIR)
 
+	// Check for overlapping route matches across all listeners after all HTTP and
+	// GRPC routes have been processed. This runs once rather than inside the
+	// per-route processing loop where it would execute N times.
+	t.checkRouteOverlaps(httpRoutes, grpcRoutes, xdsIR)
+
 	// Process all relevant TLSRoutes.
 	tlsRoutes := t.ProcessTLSRoutes(resources.TLSRoutes, acceptedGateways, resources, xdsIR)