Merge branch 'main' into feat/startup-probe-gtw

Author: cleman95

.github/workflows/codeql.yml

@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463  # v3.29.5
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@87557b9c84dde89fdd9b10e88954ac2f4248e463  # v3.29.5
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463  # v3.29.5
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463  # v3.29.5
+      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         sarif_file: results.sarif

api/v1alpha1/backend_types.go

@@ -132,6 +132,8 @@ type UnixSocket struct {
 
 // BackendSpec describes the desired state of BackendSpec.
 // +kubebuilder:validation:XValidation:rule="self.type != 'DynamicResolver' || !has(self.endpoints)",message="DynamicResolver type cannot have endpoints specified"
+// +kubebuilder:validation:XValidation:rule="self.type != 'DynamicResolver' || !has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname) && self.tls.autoSNIFromEndpointHostname)",message="DynamicResolver type cannot use autoSNIFromEndpointHostname"
+// +kubebuilder:validation:XValidation:rule="!has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname) && self.tls.autoSNIFromEndpointHostname) || self.endpoints.all(e, (!has(e.ip) && !has(e.unix)) || has(e.hostname))",message="when autoSNIFromEndpointHostname is enabled, IP and Unix endpoints must define a hostname"
 type BackendSpec struct {
 	// Type defines the type of the backend. Defaults to "Endpoints"
 	//
@@ -173,6 +175,7 @@ type BackendSpec struct {
 // BackendTLSSettings holds the TLS settings for the backend.
 // +kubebuilder:validation:XValidation:message="must not contain both CACertificateRefs and WellKnownCACertificates",rule="!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
 // +kubebuilder:validation:XValidation:message="must not contain either CACertificateRefs or WellKnownCACertificates when InsecureSkipVerify is enabled",rule="!((has(self.insecureSkipVerify) && self.insecureSkipVerify) && ((has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")))"
+// +kubebuilder:validation:XValidation:message="sni and autoSNIFromEndpointHostname are mutually exclusive",rule="!(has(self.sni) && has(self.autoSNIFromEndpointHostname) && self.autoSNIFromEndpointHostname)"
 type BackendTLSSettings struct {
 	// CACertificateRefs contains one or more references to Kubernetes objects that
 	// contain TLS certificates of the Certificate Authorities that can be used
@@ -206,18 +209,32 @@ type BackendTLSSettings struct {
 	// +optional
 	InsecureSkipVerify *bool `json:"insecureSkipVerify,omitempty"`
 
-	// SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
+	// SNI specifies the fixed SNI value used when establishing an upstream TLS connection to the backend.
 	//
 	// Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
 	// 1. Backend resources that do not set SNI, or
 	// 2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
 	//
-	// When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
-	// over this value.
+	// If a BackendTLSPolicy is attached to the Backend resource, the BackendTLSPolicy's validation.hostname
+	// value takes precedence over this field.
+	//
+	// If no BackendTLSPolicy validation.hostname applies and both this field and AutoSNIFromEndpointHostname
+	// are unset, Envoy Gateway configures Envoy to set the upstream SNI from the downstream HTTP host/authority header.
 	//
 	// +optional
 	SNI *gwapiv1.PreciseHostname `json:"sni,omitempty"`
 
+	// AutoSNIFromEndpointHostname indicates whether the upstream endpoint's hostname should be used as the SNI value
+	// when establishing a TLS connection to the backend.
+	// This uses the resolved hostname of the upstream endpoint (e.g., from the Backend Endpoints list),
+	// rather than a static value.
+	//
+	// Mutually exclusive with SNI. When a BackendTLSPolicy is attached, its Hostname value takes
+	// precedence and AutoSNIFromEndpointHostname is ignored.
+	//
+	// +optional
+	AutoSNIFromEndpointHostname *bool `json:"autoSNIFromEndpointHostname,omitempty"`
+
 	// BackendTLSConfig defines the client certificate/key as well as TLS protocol parameters such as ciphers, TLS versions,
 	// and ALPN that the Envoy uses when connecting to the backend.
 	// When omitted, Envoy will fall back to the EnvoyProxy BackendTLS defaults, if any.

api/v1alpha1/zz_generated.deepcopy.go

@@ -189,6 +189,16 @@ spec:
                         using ALPN
                       type: string
                     type: array
+                  autoSNIFromEndpointHostname:
+                    description: |-
+                      AutoSNIFromEndpointHostname indicates whether the upstream endpoint's hostname should be used as the SNI value
+                      when establishing a TLS connection to the backend.
+                      This uses the resolved hostname of the upstream endpoint (e.g., from the Backend Endpoints list),
+                      rather than a static value.
+
+                      Mutually exclusive with SNI. When a BackendTLSPolicy is attached, its Hostname value takes
+                      precedence and AutoSNIFromEndpointHostname is ignored.
+                    type: boolean
                   caCertificateRefs:
                     description: |-
                       CACertificateRefs contains one or more references to Kubernetes objects that
@@ -401,14 +411,17 @@ spec:
                     type: array
                   sni:
                     description: |-
-                      SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
+                      SNI specifies the fixed SNI value used when establishing an upstream TLS connection to the backend.
 
                       Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
                       1. Backend resources that do not set SNI, or
                       2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
 
-                      When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
-                      over this value.
+                      If a BackendTLSPolicy is attached to the Backend resource, the BackendTLSPolicy's validation.hostname
+                      value takes precedence over this field.
+
+                      If no BackendTLSPolicy validation.hostname applies and both this field and AutoSNIFromEndpointHostname
+                      are unset, Envoy Gateway configures Envoy to set the upstream SNI from the downstream HTTP host/authority header.
                     maxLength: 253
                     minLength: 1
                     pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -437,6 +450,9 @@ spec:
                     && ((has(self.caCertificateRefs) && size(self.caCertificateRefs)
                     > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates
                     != "")))'
+                - message: sni and autoSNIFromEndpointHostname are mutually exclusive
+                  rule: '!(has(self.sni) && has(self.autoSNIFromEndpointHostname)
+                    && self.autoSNIFromEndpointHostname)'
                 - message: setting ciphers has no effect if the minimum possible TLS
                     version is 1.3
                   rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers)
@@ -457,6 +473,14 @@ spec:
             x-kubernetes-validations:
             - message: DynamicResolver type cannot have endpoints specified
               rule: self.type != 'DynamicResolver' || !has(self.endpoints)
+            - message: DynamicResolver type cannot use autoSNIFromEndpointHostname
+              rule: self.type != 'DynamicResolver' || !has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname)
+                && self.tls.autoSNIFromEndpointHostname)
+            - message: when autoSNIFromEndpointHostname is enabled, IP and Unix endpoints
+                must define a hostname
+              rule: '!has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname)
+                && self.tls.autoSNIFromEndpointHostname) || self.endpoints.all(e,
+                (!has(e.ip) && !has(e.unix)) || has(e.hostname))'
           status:
             description: Status defines the current status of Backend.
             properties:

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml

@@ -188,6 +188,16 @@ spec:
                         using ALPN
                       type: string
                     type: array
+                  autoSNIFromEndpointHostname:
+                    description: |-
+                      AutoSNIFromEndpointHostname indicates whether the upstream endpoint's hostname should be used as the SNI value
+                      when establishing a TLS connection to the backend.
+                      This uses the resolved hostname of the upstream endpoint (e.g., from the Backend Endpoints list),
+                      rather than a static value.
+
+                      Mutually exclusive with SNI. When a BackendTLSPolicy is attached, its Hostname value takes
+                      precedence and AutoSNIFromEndpointHostname is ignored.
+                    type: boolean
                   caCertificateRefs:
                     description: |-
                       CACertificateRefs contains one or more references to Kubernetes objects that
@@ -400,14 +410,17 @@ spec:
                     type: array
                   sni:
                     description: |-
-                      SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
+                      SNI specifies the fixed SNI value used when establishing an upstream TLS connection to the backend.
 
                       Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
                       1. Backend resources that do not set SNI, or
                       2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
 
-                      When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
-                      over this value.
+                      If a BackendTLSPolicy is attached to the Backend resource, the BackendTLSPolicy's validation.hostname
+                      value takes precedence over this field.
+
+                      If no BackendTLSPolicy validation.hostname applies and both this field and AutoSNIFromEndpointHostname
+                      are unset, Envoy Gateway configures Envoy to set the upstream SNI from the downstream HTTP host/authority header.
                     maxLength: 253
                     minLength: 1
                     pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -436,6 +449,9 @@ spec:
                     && ((has(self.caCertificateRefs) && size(self.caCertificateRefs)
                     > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates
                     != "")))'
+                - message: sni and autoSNIFromEndpointHostname are mutually exclusive
+                  rule: '!(has(self.sni) && has(self.autoSNIFromEndpointHostname)
+                    && self.autoSNIFromEndpointHostname)'
                 - message: setting ciphers has no effect if the minimum possible TLS
                     version is 1.3
                   rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers)
@@ -456,6 +472,14 @@ spec:
             x-kubernetes-validations:
             - message: DynamicResolver type cannot have endpoints specified
               rule: self.type != 'DynamicResolver' || !has(self.endpoints)
+            - message: DynamicResolver type cannot use autoSNIFromEndpointHostname
+              rule: self.type != 'DynamicResolver' || !has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname)
+                && self.tls.autoSNIFromEndpointHostname)
+            - message: when autoSNIFromEndpointHostname is enabled, IP and Unix endpoints
+                must define a hostname
+              rule: '!has(self.tls) || !(has(self.tls.autoSNIFromEndpointHostname)
+                && self.tls.autoSNIFromEndpointHostname) || self.endpoints.all(e,
+                (!has(e.ip) && !has(e.unix)) || has(e.hostname))'
           status:
             description: Status defines the current status of Backend.
             properties:

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_backends.yaml

@@ -184,8 +184,9 @@ func mergeServerValidationTLSConfigs(
 	if btpValidationTLSConfig.CACertificate != nil {
 		mergedConfig.CACertificate = btpValidationTLSConfig.CACertificate
 	}
-	if btpValidationTLSConfig.SNI != nil {
+	if btpValidationTLSConfig.SNI != nil { // BTP takes precedence for SNI, if set, it will override Backend resource SNI and disable AutoSNIFromEndpointHostname
 		mergedConfig.SNI = btpValidationTLSConfig.SNI
+		mergedConfig.AutoSNIFromEndpointHostname = false
 	}
 	if btpValidationTLSConfig.UseSystemTrustStore {
 		mergedConfig.UseSystemTrustStore = btpValidationTLSConfig.UseSystemTrustStore
@@ -255,7 +256,8 @@ func (t *Translator) processServerValidationTLSSettings(
 	backend *egv1a1.Backend,
 ) (*ir.TLSUpstreamConfig, error) {
 	tlsConfig := &ir.TLSUpstreamConfig{
-		InsecureSkipVerify: ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false),
+		InsecureSkipVerify:          ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false),
+		AutoSNIFromEndpointHostname: ptr.Deref(backend.Spec.TLS.AutoSNIFromEndpointHostname, false),
 	}
 
 	if backend.Spec.TLS.SNI != nil {

internal/gatewayapi/backendtlspolicy.go

@@ -203,17 +203,6 @@ func isRefToListenerSet(parentRef gwapiv1.ParentReference) bool {
 	return false
 }
 
-// HasReadyListener returns true if at least one Listener in the
-// provided list has a condition of "Ready: true", and false otherwise.
-func HasReadyListener(listeners []*ListenerContext) bool {
-	for _, listener := range listeners {
-		if listener.IsReady() {
-			return true
-		}
-	}
-	return false
-}
-
 // ValidateHTTPRouteFilter validates the provided filter within HTTPRoute.
 func ValidateHTTPRouteFilter(filter *gwapiv1.HTTPRouteFilter, extGKs ...schema.GroupKind) error {
 	switch {

internal/gatewayapi/helpers.go

@@ -1625,11 +1625,11 @@ func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resour
 			if listener.AttachedRoutes() >= 1 {
 				continue
 			}
+			accepted = true
 			listener.IncrementAttachedRoutes()
 			if !listener.IsReady() {
 				continue
 			}
-			accepted = true
 
 			irKey := t.getIRKey(listener.gateway.Gateway)
 
@@ -1777,12 +1777,11 @@ func (t *Translator) processTCPRouteParentRefs(tcpRoute *TCPRouteContext, resour
 			if listener.AttachedRoutes() >= 1 {
 				continue
 			}
+			accepted = true
+			listener.IncrementAttachedRoutes()
 			if !listener.IsReady() {
 				continue
 			}
-			listener.IncrementAttachedRoutes()
-
-			accepted = true
 			irKey := t.getIRKey(listener.gateway.Gateway)
 
 			gwXdsIR := xdsIR[irKey]
@@ -2300,19 +2299,6 @@ func (t *Translator) processAllowedListenersForParentRefs(
 		}
 		parentRefCtx.SetListeners(allowedListeners...)
 
-		if !HasReadyListener(allowedListeners) {
-			routeStatus := GetRouteStatus(routeContext)
-			status.SetRouteStatusCondition(routeStatus,
-				parentRefCtx.routeParentStatusIdx,
-				routeContext.GetGeneration(),
-				gwapiv1.RouteConditionAccepted,
-				metav1.ConditionFalse,
-				"NoReadyListeners",
-				"There are no ready listeners for this parent ref",
-			)
-			continue
-		}
-
 		routeStatus := GetRouteStatus(routeContext)
 		status.SetRouteStatusCondition(routeStatus,
 			parentRefCtx.routeParentStatusIdx,
@@ -2528,8 +2514,9 @@ func (t *Translator) processBackendDestinationSetting(
 		case bep.Unix != nil:
 			addrTypeMap[ir.UDS]++
 			irde = &ir.DestinationEndpoint{
-				Path: new(bep.Unix.Path),
-				Zone: bep.Zone,
+				Hostname: bep.Hostname,
+				Path:     new(bep.Unix.Path),
+				Zone:     bep.Zone,
 			}
 		}