[release/v1.6] cherry picks for v1.6.7

internal/gatewayapi/filters.go

@@ -1116,8 +1116,8 @@ func (t *Translator) processCORSFilter(
 }
 
 // Unresolvable or unsupported filters should be treated like other reference failures:
-// (`Accepted` will be set to true, `ResolvedRefs` to false with a `InvalidKind` Reason,
-// and traffic that would have matched the filter should receive a 500 error.)
+// (`Accepted` will be set to true, `ResolvedRefs` to false, and traffic that would have
+// matched the filter should receive a 500 error.)
 // ref: https://gateway-api.sigs.k8s.io/geps/gep-1364/#new-and-updated-conditions
 func (t *Translator) processUnresolvedHTTPFilter(errMsg string, filterContext *HTTPFiltersContext) status.Error {
 	t.Logger.Info("marking route unresolved due to HTTP filter error", "error", errMsg)
@@ -1126,13 +1126,13 @@ func (t *Translator) processUnresolvedHTTPFilter(errMsg string, filterContext *H
 	}
 	return status.NewRouteStatusError(
 		errors.New(errMsg),
-		gwapiv1.RouteReasonBackendNotFound,
+		gwapiv1.RouteReasonUnsupportedValue,
 	).WithType(gwapiv1.RouteConditionResolvedRefs)
 }
 
 // Unresolvable or unsupported filters should be treated like other reference failures:
-// (`Accepted` will be set to true, `ResolvedRefs` to false with a `InvalidKind` Reason,
-// and traffic that would have matched the filter should receive a 500 error.)
+// (`Accepted` will be set to true, `ResolvedRefs` to false, and traffic that would have
+// matched the filter should receive a 500 error.)
 // ref: https://gateway-api.sigs.k8s.io/geps/gep-1364/#new-and-updated-conditions
 func (t *Translator) processUnsupportedHTTPFilter(filterType string, filterContext *HTTPFiltersContext) status.Error {
 	t.Logger.Info("marking route unsupported due to HTTP filter type", "filterType", filterType)

internal/gatewayapi/status/error.go

@@ -159,7 +159,7 @@ func (m *MultiStatusError) Reason() gwapiv1.RouteConditionReason {
 		reasonList = append(reasonList, reason)
 	}
 	sort.Strings(reasonList)
-	return gwapiv1.RouteConditionReason(strings.Join(reasonList, ", "))
+	return gwapiv1.RouteConditionReason(strings.Join(reasonList, ","))
 }
 
 func (m *MultiStatusError) Type() gwapiv1.RouteConditionType {

internal/gatewayapi/testdata/extensions/httproute-with-custom-backend-invalid-group.out.yaml

@@ -76,7 +76,7 @@ httpRoutes:
       - lastTransitionTime: null
         message: 'Unable to translate APIVersion for Extension Filter: kind: Foo,
           default/test.'
-        reason: BackendNotFound
+        reason: UnsupportedValue
         status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller

internal/gatewayapi/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml

@@ -75,7 +75,7 @@ httpRoutes:
         type: Accepted
       - lastTransitionTime: null
         message: 'Reference default/example not found for filter type: Foo.'
-        reason: BackendNotFound
+        reason: UnsupportedValue
         status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller

internal/gatewayapi/testdata/grpcroute-with-conflicting-filters.out.yaml

@@ -80,7 +80,7 @@ grpcRoutes:
         message: |-
           Dropped Rule(s) [0]: Invalid filter ExtensionRef: unknown kind gateway.envoyproxy.io/HTTPRouteFilter.
           RequestMirror filter cannot be used when the rule also configures a DirectResponse filter.
-        reason: IncompatibleFilters, UnsupportedValue
+        reason: IncompatibleFilters,UnsupportedValue
         status: "True"
         type: PartiallyInvalid
       - lastTransitionTime: null

internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml

@@ -120,7 +120,7 @@ httpRoutes:
         type: Accepted
       - lastTransitionTime: null
         message: 'Unable to translate HTTPRouteFilter: default/direct-response-value-ref-not-found.'
-        reason: BackendNotFound
+        reason: UnsupportedValue
         status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller

internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml

@@ -305,7 +305,7 @@ httpRoutes:
         type: Accepted
       - lastTransitionTime: null
         message: 'Unable to translate HTTPRouteFilter: default/notfound.'
-        reason: BackendNotFound
+        reason: UnsupportedValue
         status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller

internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.in.yaml

@@ -125,6 +125,42 @@ httpRoutes:
           path:
             type: ReplacePrefixMatch
             replacePrefixMatch: /rewrite
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-5
+  spec:
+    hostnames:
+    - gateway.envoyproxy.io
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/not-found-filter"
+      backendRefs:
+      - name: service-1
+        port: 8080
+        filters:
+        - type: ExtensionRef
+          extensionRef:
+            group: gateway.envoyproxy.io
+            kind: HTTPRouteFilter
+            name: not-found-filter
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
+      - type: ExtensionRef
+        extensionRef:
+          group: gateway.envoyproxy.io
+          kind: HTTPRouteFilter
+          name: not-found-filter
 httpFilters:
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: HTTPRouteFilter

internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml

@@ -16,7 +16,7 @@ gateways:
       protocol: HTTP
   status:
     listeners:
-    - attachedRoutes: 4
+    - attachedRoutes: 5
       conditions:
       - lastTransitionTime: null
         message: Sending translated listener configuration to the data plane
@@ -222,6 +222,62 @@ httpRoutes:
         name: gateway-1
         namespace: envoy-gateway
         sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    name: httproute-5
+    namespace: default
+  spec:
+    hostnames:
+    - gateway.envoyproxy.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - filters:
+        - extensionRef:
+            group: gateway.envoyproxy.io
+            kind: HTTPRouteFilter
+            name: not-found-filter
+          type: ExtensionRef
+        name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      - extensionRef:
+          group: gateway.envoyproxy.io
+          kind: HTTPRouteFilter
+          name: not-found-filter
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /not-found-filter
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: |-
+          Unable to translate HTTPRouteFilter: default/not-found-filter.
+          Failed to process route rule 0 backendRef 0: Unable to translate HTTPRouteFilter: default/not-found-filter.
+        reason: InvalidBackendFilters,UnsupportedValue
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
 infraIR:
   envoy-gateway/gateway-1:
     proxy:
@@ -357,6 +413,23 @@ xdsIR:
           path:
             fullReplace: null
             prefixMatchReplace: /rewrite
+      - directResponse:
+          statusCode: 500
+        hostname: gateway.envoyproxy.io
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-5
+          namespace: default
+        name: httproute/default/httproute-5/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /not-found-filter
+        urlRewrite:
+          path:
+            fullReplace: null
+            prefixMatchReplace: /rewrite
       - destination:
           metadata:
             kind: HTTPRoute

release-notes/current.yaml

@@ -43,6 +43,8 @@ bug fixes: |
   Allowed single-label backend hostnames when running with the Host infrastructure, enabling Docker Compose service names for telemetry backends.
   Fixed an issue that message package didn't adopt logging level.
   Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
+  Fixed BackendTrafficPolicy rate limit `requests` values above uint32 max (4294967295) being silently truncated modulo 2^32 by the rate limit service and Envoy token bucket. The field now rejects such values at admission time with a clear schema validation error. See envoyproxy/ai-gateway#2012.
+  Fixed status conditions not being updated when a route is rejected due to multiple errors.
 
 # Enhancements that improve performance.
 performance improvements: |