fix ListenerSet conformance test

Signed-off-by: zirain <zirain2009@gmail.com>

Author: zirain

internal/gatewayapi/contexts.go

@@ -121,12 +121,12 @@ func (g *GatewayContext) attachEnvoyProxy(resources *resource.Resources, epMap m
 	return err
 }
 
-func (g *GatewayContext) IncreaseAttachedListenerSets() {
-	if g.Status.AttachedListenerSets == nil {
-		g.Status.AttachedListenerSets = new(int32(1))
-	} else {
-		*g.Status.AttachedListenerSets++
+func (g *GatewayContext) SetAttachedListenerSets(count int32) {
+	if count <= 0 {
+		g.Status.AttachedListenerSets = nil
+		return
 	}
+	g.Status.AttachedListenerSets = &count
 }
 
 // ListenerContext wraps a Listener and provides helper methods for

internal/gatewayapi/helpers.go

@@ -425,24 +425,24 @@ func wildcardHostnameMatchesHostname(wildcardHostname, hostname string) bool {
 
 func containsPort(ports []*protocolPort, port *protocolPort) bool {
 	for _, protocolPort := range ports {
-		curProtocol, curLevel := layer4Protocol(protocolPort)
-		myProtocol, myLevel := layer4Protocol(port)
-		if protocolPort.port == port.port && (curProtocol == myProtocol && curLevel == myLevel) {
+		curProtocol := layer4Protocol(protocolPort)
+		myProtocol := layer4Protocol(port)
+		if protocolPort.port == port.port && curProtocol == myProtocol {
 			return true
 		}
 	}
 	return false
 }
 
-// layer4Protocol returns listener L4 protocol and listen protocol level
-func layer4Protocol(protocolPort *protocolPort) (string, string) {
+// layer4Protocol returns listener L4 protocol
+func layer4Protocol(protocolPort *protocolPort) string {
 	switch protocolPort.protocol {
 	case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
-		return TCPProtocol, L7Protocol
+		return TCPProtocol
 	case gwapiv1.TCPProtocolType:
-		return TCPProtocol, L4Protocol
+		return TCPProtocol
 	default:
-		return UDPProtocol, L4Protocol
+		return UDPProtocol
 	}
 }
 

internal/gatewayapi/listener.go

@@ -239,11 +239,33 @@ func allowedRouteKindsForProtocol(protocol gwapiv1.ProtocolType, tlsMode *gwapiv
 	}
 }
 
+// validateProtocolRules validates protocol-specific constraints (hostname, TLS requirements).
+// Returns true if all constraints are satisfied, false otherwise.
+func validateProtocolRules(listener *ListenerContext) bool {
+	switch listener.Protocol {
+	case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType,
+		gwapiv1.TCPProtocolType, gwapiv1.UDPProtocolType:
+		// All supported protocols pass basic validation here.
+		// Protocol-specific constraints (TLS, hostname) are validated in
+		// validateTLSConfiguration and validateHostName respectively,
+		// where they can set proper conditions.
+		return true
+
+	default:
+		// Unsupported protocol handled separately
+		return false
+	}
+}
+
 func (t *Translator) validateListenerSpec(listener *ListenerContext, resources *resource.Resources) bool {
 	// Validate listener spec directly without relying on conditions.
 	// Start with valid assumption and invalidate on failures.
+
 	// Phase 1: Validate fundamental rules
 	specValid := t.validateAllowedNamespaces(listener)
+	if !validateProtocolRules(listener) {
+		specValid = false
+	}
 
 	// Phase 2: Validate allowed routes based on protocol
 	if isSupportedListenerProtocol(listener.Protocol) {
@@ -313,7 +335,6 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 		}
 		t.processProxyReadyListener(xdsIR[irKey], gateway.envoyProxy)
 		t.processProxyObservability(gateway, xdsIR[irKey], infraIR[irKey].Proxy, resources)
-
 		for _, listener := range gateway.listeners {
 			// Finalize listener conditions and check readiness.
 			t.validateListenerConditions(listener)
@@ -411,6 +432,29 @@ func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR resource
 	t.checkOverlappingTLSConfig(gateways)
 }
 
+// isListenerReady returns true if the listener is ready (Accepted=True and Programmed=True or no conditions yet).
+// A listener is not ready if it has Accepted=False or Programmed=False.
+func isListenerReady(listener *ListenerContext) bool {
+	conditions := listener.GetConditions()
+
+	// No conditions yet means it will be set to ready during validation.
+	if len(conditions) == 0 {
+		return true
+	}
+
+	// Check if Accepted=False or Programmed=False exists.
+	for _, cond := range conditions {
+		if cond.Type == string(gwapiv1.ListenerConditionAccepted) && cond.Status == metav1.ConditionFalse {
+			return false
+		}
+		if cond.Type == string(gwapiv1.ListenerConditionProgrammed) && cond.Status == metav1.ConditionFalse {
+			return false
+		}
+	}
+
+	return true
+}
+
 // checkOverlappingTLSConfig checks for overlapping hostnames and certificates between listeners and sets
 // the `OverlappingTLSConfig` condition if there are overlapping hostnames or certificates.
 func (t *Translator) checkOverlappingTLSConfig(gateways []*GatewayContext) {
@@ -419,7 +463,7 @@ func (t *Translator) checkOverlappingTLSConfig(gateways []*GatewayContext) {
 		httpsListeners := []*ListenerContext{}
 		for _, gateway := range gateways {
 			for _, listener := range gateway.listeners {
-				if listener.Protocol == gwapiv1.HTTPSProtocolType {
+				if listener.Protocol == gwapiv1.HTTPSProtocolType && isListenerReady(listener) {
 					httpsListeners = append(httpsListeners, listener)
 				}
 			}
@@ -434,7 +478,7 @@ func (t *Translator) checkOverlappingTLSConfig(gateways []*GatewayContext) {
 		for _, gateway := range gateways {
 			httpsListeners := []*ListenerContext{}
 			for _, listener := range gateway.listeners {
-				if listener.Protocol == gwapiv1.HTTPSProtocolType {
+				if listener.Protocol == gwapiv1.HTTPSProtocolType && isListenerReady(listener) {
 					httpsListeners = append(httpsListeners, listener)
 				}
 			}

internal/gatewayapi/listenerset.go

@@ -93,7 +93,6 @@ func (t *Translator) processListenerSet(ls *gwapiv1.ListenerSet, gatewayMap map[
 		}
 		gatewayCtx.listeners = append(gatewayCtx.listeners, listenerCtx)
 	}
-	gatewayCtx.IncreaseAttachedListenerSets()
 }
 
 // ProcessListenerSetStatus computes the status of ListenerSets after their listeners have been processed.
@@ -158,6 +157,43 @@ func (t *Translator) ProcessListenerSetStatus(listenerSets []*gwapiv1.ListenerSe
 	}
 }
 
+// UpdateGatewayAttachedListenerSetCount sets Gateway.status.attachedListenerSets based on
+// ListenerSet Accepted=True status.
+func (t *Translator) UpdateGatewayAttachedListenerSetCount(listenerSets []*gwapiv1.ListenerSet, gateways []*GatewayContext) {
+	gatewayMap := make(map[types.NamespacedName]*GatewayContext, len(gateways))
+	for _, gw := range gateways {
+		gatewayMap[types.NamespacedName{Namespace: gw.Namespace, Name: gw.Name}] = gw
+		// reset for current reconciliation cycle
+		gw.SetAttachedListenerSets(0)
+	}
+
+	counts := make(map[types.NamespacedName]int32)
+	for _, ls := range listenerSets {
+		if !listenerSetAccepted(ls) {
+			continue
+		}
+		parentNamespace := NamespaceDerefOr(ls.Spec.ParentRef.Namespace, ls.Namespace)
+		key := types.NamespacedName{Namespace: parentNamespace, Name: string(ls.Spec.ParentRef.Name)}
+		if _, ok := gatewayMap[key]; !ok {
+			continue
+		}
+		counts[key]++
+	}
+
+	for key, count := range counts {
+		gatewayMap[key].SetAttachedListenerSets(count)
+	}
+}
+
+func listenerSetAccepted(ls *gwapiv1.ListenerSet) bool {
+	for _, cond := range ls.Status.Conditions {
+		if cond.Type == string(gwapiv1.ListenerSetConditionAccepted) {
+			return cond.Status == metav1.ConditionTrue
+		}
+	}
+	return false
+}
+
 func (t *Translator) isListenerSetAllowed(gateway *gwapiv1.Gateway, ls *gwapiv1.ListenerSet) bool {
 	// If AllowedListeners is not set, attachment is not allowed (default is None)
 	if gateway.Spec.AllowedListeners == nil || gateway.Spec.AllowedListeners.Namespaces == nil || gateway.Spec.AllowedListeners.Namespaces.From == nil {

internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml

@@ -33,8 +33,13 @@ gateways:
         status: "True"
         type: Conflicted
       - lastTransitionTime: null
-        message: Listener is invalid, see other Conditions for details.
-        reason: Invalid
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
         status: "False"
         type: Programmed
       - lastTransitionTime: null
@@ -56,8 +61,13 @@ gateways:
         status: "True"
         type: Conflicted
       - lastTransitionTime: null
-        message: Listener is invalid, see other Conditions for details.
-        reason: Invalid
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
         status: "False"
         type: Programmed
       - lastTransitionTime: null

internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml

@@ -31,8 +31,13 @@ gateways:
         status: "True"
         type: Conflicted
       - lastTransitionTime: null
-        message: Listener is invalid, see other Conditions for details.
-        reason: Invalid
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
         status: "False"
         type: Programmed
       - lastTransitionTime: null
@@ -54,8 +59,13 @@ gateways:
         status: "True"
         type: Conflicted
       - lastTransitionTime: null
-        message: Listener is invalid, see other Conditions for details.
-        reason: Invalid
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
         status: "False"
         type: Programmed
       - lastTransitionTime: null

internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml

@@ -25,6 +25,26 @@ gateways:
             mode: Terminate
             certificateRefs:
               - name: tls-secret-1
+        - allowedRoutes:
+            namespaces:
+              from: All
+          name: udp-8162
+          port: 8162
+          protocol: UDP
+        # This listener(http-8162) is valid because HTTP + UDP are compatible protocols.
+        - allowedRoutes:
+            namespaces:
+              from: All
+          name: http-8162
+          port: 8162
+          protocol: HTTP
+        # This listener(tcp-8162) is invalid because TCP is not compatible with HTTP.
+        - allowedRoutes:
+            namespaces:
+              from: All
+          name: tcp-8162
+          port: 8162
+          protocol: TCP
 secrets:
   - apiVersion: v1
     kind: Secret