fix: followup for #8380 (#8666)

zirain · web-flow · commit 9f25066512ac · 2026-04-13T11:56:50.000+05:30
* improve status message

Signed-off-by: zirain &lt;zirain2009@gmail.com&gt;

* allow to disable validation

Signed-off-by: zirain &lt;zirain2009@gmail.com&gt;

* address follow up for 8380

Signed-off-by: zirain &lt;zirain2009@gmail.com&gt;

* address TODO

Signed-off-by: zirain &lt;zirain2009@gmail.com&gt;

---------

Signed-off-by: zirain &lt;zirain2009@gmail.com&gt;
diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go
@@ -531,7 +531,7 @@ func (t *Translator) getCaCertsFromCARefs(resources *resource.Resources, caCerti
 				},
 				resources.ReferenceGrants,
 			) {
-				return nil, ErrRefNotPermitted
+				return nil, fmt.Errorf("%w for caCertificateRef %s/%s (kind: %s, namespace: %s)", ErrRefNotPermitted, caRef.Group, caRef.Name, kind, caRefNs)
 			}
 		}
 
@@ -582,7 +582,7 @@ func (t *Translator) getCaCertsFromCARefs(resources *resource.Resources, caCerti
 
 	if ca == "" {
 		if !foundSupportedRef {
-			return nil, ErrInvalidCACertificateKind
+			return nil, fmt.Errorf("%w in caCertificateRefs", ErrInvalidCACertificateKind)
 		}
 		return nil, ErrNoValidCACertificate
 	}
diff --git a/internal/gatewayapi/contexts.go b/internal/gatewayapi/contexts.go
@@ -45,8 +45,16 @@ type ResourceMetadata struct {
 // Precedence order (highest to lowest):
 // 1. Gateway.spec.tls.backend configuration
 // 2. EnvoyProxy.spec.backendTLS (attached to Gateway or GatewayClass)
+//
+// TODO: Merging fields in EnvoyProxy and Gateway TLS configs should be considered.
 func (g *GatewayContext) GetBackendTLSConfig() (*egv1a1.BackendTLSConfig, *ResourceMetadata) {
-	if g.backendTLS != nil {
+	// If Gateway.spec.tls.backend is configured, it takes precedence over
+	// EnvoyProxy.spec.backendTLS even when translation produced no usable
+	// backendTLS config (for example, due to invalid clientCertificateRef).
+	if g.Gateway != nil && g.Spec.TLS != nil && g.Spec.TLS.Backend != nil {
+		if g.backendTLS == nil {
+			return nil, nil
+		}
 		return g.backendTLS, &ResourceMetadata{
 			Namespace: g.Namespace,
 			Name:      g.Name,
diff --git a/internal/gatewayapi/listener.go b/internal/gatewayapi/listener.go
@@ -82,6 +82,9 @@ func (t *Translator) ProcessGatewayTLS(gateways []*GatewayContext, resources *re
 			gtwPerPortCaCertificate := make(map[gwapiv1.PortNumber]*ListenerFrontendTLSValidation)
 			for _, portValidation := range gtw.Spec.TLS.Frontend.PerPort {
 				if portValidation.TLS.Validation == nil {
+					// An explicit per-port tls override with no validation disables
+					// frontend default validation on that port.
+					gtwPerPortCaCertificate[portValidation.Port] = nil
 					continue
 				}
 				caCert, err := t.getCaCertsFromCARefs(resources, portValidation.TLS.Validation.CACertificateRefs, resource.ResourceMetadata{
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -60,13 +60,13 @@ backendTLSPolicies:
       conditions:
       - lastTransitionTime: null
         message: Unsupported reference kind, supported kinds are ConfigMap, Secret,
-          and ClusterTrustBundle.
+          and ClusterTrustBundle in caCertificateRefs.
         reason: NoValidCACertificate
         status: "False"
         type: Accepted
       - lastTransitionTime: null
         message: Unsupported reference kind, supported kinds are ConfigMap, Secret,
-          and ClusterTrustBundle.
+          and ClusterTrustBundle in caCertificateRefs.
         reason: InvalidKind
         status: "False"
         type: ResolvedRefs
@@ -145,7 +145,7 @@ httpRoutes:
       - lastTransitionTime: null
         message: |-
           Failed to process route rule 0 backendRef 0: configmap no-ca-cmap not found in namespace backends.
-          Failed to process route rule 0 backendRef 1: Unsupported reference kind, supported kinds are ConfigMap, Secret, and ClusterTrustBundle.
+          Failed to process route rule 0 backendRef 1: Unsupported reference kind, supported kinds are ConfigMap, Secret, and ClusterTrustBundle in caCertificateRefs.
         reason: InvalidBackendTLS
         status: "False"
         type: ResolvedRefs
diff --git a/internal/gatewayapi/testdata/gateway-tls-frontend-backend.in.yaml b/internal/gatewayapi/testdata/gateway-tls-frontend-backend.in.yaml
@@ -185,6 +185,108 @@ gateways:
               - group: ""
                 kind: Secret
                 name: tls-validity-checks-certificate
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: client-validation-per-port-disable-default
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      tls:
+        frontend:
+          default:
+            validation:
+              caCertificateRefs:
+                - kind: ConfigMap
+                  group: ""
+                  name: tls-validity-checks-ca-certificate
+          perPort:
+            - port: 8443
+              tls: {}
+      listeners:
+        - name: https
+          port: 443
+          protocol: HTTPS
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-validity-checks-certificate
+        - name: https-disable-default-validation
+          port: 8443
+          protocol: HTTPS
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-validity-checks-certificate
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: client-validation-per-port-disable-invalid-default
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      tls:
+        frontend:
+          default:
+            validation:
+              caCertificateRefs:
+                - kind: ConfigMap
+                  group: ""
+                  name: does-not-exist
+          perPort:
+            - port: 8443
+              tls: {}
+      listeners:
+        - name: https-invalid-default
+          port: 443
+          protocol: HTTPS
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-validity-checks-certificate
+        - name: https-disable-default-validation
+          port: 8443
+          protocol: HTTPS
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-validity-checks-certificate
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: invalid-gateway-backend-client-cert-no-fallback
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 8080
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: All
+      tls:
+        backend:
+          clientCertificateRef:
+            group: ""
+            kind: ConfigMap
+            name: invalid-kind
   - apiVersion: gateway.networking.k8s.io/v1
     kind: Gateway
     metadata:
@@ -303,6 +405,79 @@ httpRoutes:
         - backendRefs:
             - name: service-1
               port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: invalid-gateway-backend-client-cert-no-fallback
+      namespace: default
+    spec:
+      parentRefs:
+        - name: invalid-gateway-backend-client-cert-no-fallback
+          namespace: envoy-gateway
+      hostnames:
+        - mTLS.example.org
+      rules:
+        - backendRefs:
+            - name: tls-backend
+              namespace: default
+              port: 443
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: tls-backend
+      namespace: default
+    spec:
+      clusterIP: 10.22.33.44
+      ports:
+        - port: 443
+          name: https
+          protocol: TCP
+          targetPort: 443
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-tls-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: tls-backend
+    addressType: IPv4
+    ports:
+      - name: https
+        protocol: TCP
+        port: 443
+    endpoints:
+      - addresses:
+          - "10.244.0.22"
+        conditions:
+          ready: true
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: tls-backend-policy
+      namespace: default
+    spec:
+      targetRefs:
+        - group: ""
+          kind: Service
+          name: tls-backend
+      validation:
+        wellKnownCACertificates: System
+        hostname: backend.example.org
+envoyProxyForGatewayClass:
+  apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: envoy-gateway-system
+    name: backend-client-cert-default
+  spec:
+    backendTLS:
+      clientCertificateRef:
+        group: ""
+        kind: Secret
+        name: global-backend-client-cert
 secrets:
   - apiVersion: v1
     kind: Secret
@@ -313,6 +488,15 @@ secrets:
     data:
       tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
       tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway-system
+      name: global-backend-client-cert
+    type: kubernetes.io/tls
+    data:
+      tls.crt: YQ==
+      tls.key: Yg==
 configmaps:
   - apiVersion: v1
     kind: ConfigMap
diff --git a/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml b/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml
diff --git a/internal/gatewayapi/validate.go b/internal/gatewayapi/validate.go

Original file line number	Diff line number	Diff line change
`@@ -531,7 +531,7 @@ func (t Translator) getCaCertsFromCARefs(resources resource.Resources, caCerti`
`531`	`531`	`},`
`532`	`532`	`resources.ReferenceGrants,`
`533`	`533`	`) {`
`534`		`- return nil, ErrRefNotPermitted`
	`534`	`+ return nil, fmt.Errorf("%w for caCertificateRef %s/%s (kind: %s, namespace: %s)", ErrRefNotPermitted, caRef.Group, caRef.Name, kind, caRefNs)`
`535`	`535`	`}`
`536`	`536`	`}`
`537`	`537`
`@@ -582,7 +582,7 @@ func (t Translator) getCaCertsFromCARefs(resources resource.Resources, caCerti`
`582`	`582`
`583`	`583`	`if ca == "" {`
`584`	`584`	`if !foundSupportedRef {`
`585`		`- return nil, ErrInvalidCACertificateKind`
	`585`	`+ return nil, fmt.Errorf("%w in caCertificateRefs", ErrInvalidCACertificateKind)`
`586`	`586`	`}`
`587`	`587`	`return nil, ErrNoValidCACertificate`
`588`	`588`	`}`