From c2584463d0d033d08ce17d9b7c6faf805a304c15 Mon Sep 17 00:00:00 2001 From: kkk777-7 Date: Fri, 31 Jul 2026 01:12:45 +0900 Subject: [PATCH 1/2] perf: translate for listenerset Signed-off-by: kkk777-7 --- internal/gatewayapi/backendtrafficpolicy.go | 77 ++++++++++---------- internal/gatewayapi/envoyextensionpolicy.go | 2 +- internal/gatewayapi/securitypolicy.go | 79 +++++++++++---------- 3 files changed, 85 insertions(+), 73 deletions(-) diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go index 39f5110f64..30caaf2645 100644 --- a/internal/gatewayapi/backendtrafficpolicy.go +++ b/internal/gatewayapi/backendtrafficpolicy.go @@ -372,47 +372,52 @@ func (t *Translator) ProcessBackendTrafficPolicies( } } - // Process the policies targeting ListenerSet Listeners - for i, currPolicy := range backendTrafficPolicies { - policyName := utils.NamespacedName(currPolicy) - // Only resolve TargetRefs from targetRefs field since TargetSelectors can't specify sectionName. - targetRefs := resolvePolicyTargetsFromReferences(currPolicy.Spec.PolicyTargetReferences, currPolicy.Namespace) - for _, currTarget := range targetRefs { - if isListenerSetListener(currTarget) { - policy, found := handledPolicies[policyName] - if !found { - policy = backendTrafficPolicies[i] - handledPolicies[policyName] = policy - res = append(res, policy) + // Only run the ListenerSet-specific translation when at least one ListenerSet exists. + // When none are present, no policy can successfully attach to a ListenerSet (the target resolves to + // nil and processing returns early), so these loops would be pure overhead. + if len(resources.ListenerSets) > 0 { + // Process the policies targeting ListenerSet Listeners + for i, currPolicy := range backendTrafficPolicies { + policyName := utils.NamespacedName(currPolicy) + // Only resolve TargetRefs from targetRefs field since TargetSelectors can't specify sectionName. + targetRefs := resolvePolicyTargetsFromReferences(currPolicy.Spec.PolicyTargetReferences, currPolicy.Namespace) + for _, currTarget := range targetRefs { + if isListenerSetListener(currTarget) { + policy, found := handledPolicies[policyName] + if !found { + policy = backendTrafficPolicies[i] + handledPolicies[policyName] = policy + res = append(res, policy) + } + t.processBackendTrafficPolicyForListenerSet(xdsIR, + gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) } - t.processBackendTrafficPolicyForListenerSet(xdsIR, - gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) } } - } - // Process the policies targeting ListenerSets - for i, currPolicy := range backendTrafficPolicies { - policyName := utils.NamespacedName(currPolicy) - targetRefs := resolvePolicyTargets( - currPolicy.Spec.PolicyTargetReferences, - resources.ListenerSets, - resources.ReferenceGrants, - egv1a1.GroupName, - egv1a1.KindBackendTrafficPolicy, - currPolicy.Namespace, - t.GetNamespace, - ) - for _, currTarget := range targetRefs { - if isListenerSet(currTarget) { - policy, found := handledPolicies[policyName] - if !found { - policy = backendTrafficPolicies[i] - handledPolicies[policyName] = policy - res = append(res, policy) + // Process the policies targeting ListenerSets + for i, currPolicy := range backendTrafficPolicies { + policyName := utils.NamespacedName(currPolicy) + targetRefs := resolvePolicyTargets( + currPolicy.Spec.PolicyTargetReferences, + resources.ListenerSets, + resources.ReferenceGrants, + egv1a1.GroupName, + egv1a1.KindBackendTrafficPolicy, + currPolicy.Namespace, + t.GetNamespace, + ) + for _, currTarget := range targetRefs { + if isListenerSet(currTarget) { + policy, found := handledPolicies[policyName] + if !found { + policy = backendTrafficPolicies[i] + handledPolicies[policyName] = policy + res = append(res, policy) + } + t.processBackendTrafficPolicyForListenerSet(xdsIR, + gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) } - t.processBackendTrafficPolicyForListenerSet(xdsIR, - gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) } } } diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go index a06a2bdfb2..723dd57c3e 100644 --- a/internal/gatewayapi/envoyextensionpolicy.go +++ b/internal/gatewayapi/envoyextensionpolicy.go @@ -169,7 +169,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies( } } - // Only run the ListenerSet-specific　translation when at least one ListenerSet exists. + // Only run the ListenerSet-specific translation when at least one ListenerSet exists. // When none are present, no policy can successfully attach to a ListenerSet (the target resolves to // nil and processing returns early), so these loops would be pure overhead. if len(resources.ListenerSets) > 0 { diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go index 0e8d64a1a6..90da401d62 100644 --- a/internal/gatewayapi/securitypolicy.go +++ b/internal/gatewayapi/securitypolicy.go @@ -192,49 +192,56 @@ func (t *Translator) ProcessSecurityPolicies( } } } - // Process the policies targeting ListenerSets Listeners - for i, currPolicy := range securityPolicies { - policyName := utils.NamespacedName(currPolicy) - // Only resolve TargetRefs from targetRefs field since TargetSelectors can't specify sectionName. - targetRefs := resolvePolicyTargetsFromReferences(currPolicy.Spec.PolicyTargetReferences, currPolicy.Namespace) - for _, currTarget := range targetRefs { - if isListenerSetListener(currTarget) { - policy, found := handledPolicies[policyName] - if !found { - policy = securityPolicies[i] - handledPolicies[policyName] = policy - res = append(res, policy) - } - t.processSecurityPolicyForListenerSet(resources, xdsIR, gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) + // Only run the ListenerSet-specific translation when at least one ListenerSet exists. + // When none are present, no policy can successfully attach to a ListenerSet (the target resolves to + // nil and processing returns early), so these loops would be pure overhead. + if len(resources.ListenerSets) > 0 { + // Process the policies targeting ListenerSets Listeners + for i, currPolicy := range securityPolicies { + policyName := utils.NamespacedName(currPolicy) + // Only resolve TargetRefs from targetRefs field since TargetSelectors can't specify sectionName. + targetRefs := resolvePolicyTargetsFromReferences(currPolicy.Spec.PolicyTargetReferences, currPolicy.Namespace) + for _, currTarget := range targetRefs { + if isListenerSetListener(currTarget) { + policy, found := handledPolicies[policyName] + if !found { + policy = securityPolicies[i] + handledPolicies[policyName] = policy + res = append(res, policy) + } + + t.processSecurityPolicyForListenerSet(resources, xdsIR, gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) + } } } - } - // Process the policies targeting ListenerSets - for i, currPolicy := range securityPolicies { - policyName := utils.NamespacedName(currPolicy) - targetRefs := resolvePolicyTargets( - currPolicy.Spec.PolicyTargetReferences, - resources.ListenerSets, - resources.ReferenceGrants, - egv1a1.GroupName, - egv1a1.KindSecurityPolicy, - currPolicy.Namespace, - t.GetNamespace, - ) - for _, currTarget := range targetRefs { - if isListenerSet(currTarget) { - policy, found := handledPolicies[policyName] - if !found { - policy = securityPolicies[i] - handledPolicies[policyName] = policy - res = append(res, policy) - } + // Process the policies targeting ListenerSets + for i, currPolicy := range securityPolicies { + policyName := utils.NamespacedName(currPolicy) + targetRefs := resolvePolicyTargets( + currPolicy.Spec.PolicyTargetReferences, + resources.ListenerSets, + resources.ReferenceGrants, + egv1a1.GroupName, + egv1a1.KindSecurityPolicy, + currPolicy.Namespace, + t.GetNamespace, + ) + for _, currTarget := range targetRefs { + if isListenerSet(currTarget) { + policy, found := handledPolicies[policyName] + if !found { + policy = securityPolicies[i] + handledPolicies[policyName] = policy + res = append(res, policy) + } - t.processSecurityPolicyForListenerSet(resources, xdsIR, gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) + t.processSecurityPolicyForListenerSet(resources, xdsIR, gatewayMap, listenerSetMap, overrides, merged, policy, currTarget) + } } } } + // Process the policies targeting Gateway Listeners for i, currPolicy := range securityPolicies { policyName := utils.NamespacedName(currPolicy) From 6e8cf343535ac4d7c73fee0b7d2077d9475692da Mon Sep 17 00:00:00 2001 From: kkk777-7 Date: Fri, 31 Jul 2026 01:20:48 +0900 Subject: [PATCH 2/2] use: common helper Signed-off-by: kkk777-7 --- internal/gatewayapi/backendtrafficpolicy.go | 41 +-------------------- 1 file changed, 2 insertions(+), 39 deletions(-) diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go index 30caaf2645..b0355b2bfd 100644 --- a/internal/gatewayapi/backendtrafficpolicy.go +++ b/internal/gatewayapi/backendtrafficpolicy.go @@ -1618,7 +1618,7 @@ func (t *Translator) translateBackendTrafficPolicyForGateway( return t.translateBackendTrafficPolicyForListeners( policy, gtwCtx, - gatewayBackendTrafficPolicyTargetListeners(gtwCtx, target), + gatewayPolicyTargetListeners(gtwCtx, target), xdsIR, ) } @@ -1633,48 +1633,11 @@ func (t *Translator) translateBackendTrafficPolicyForListenerSet( return t.translateBackendTrafficPolicyForListeners( policy, gtwCtx, - listenerSetBackendTrafficPolicyTargetListeners(gtwCtx, listenerSet, target), + listenerSetPolicyTargetListeners(gtwCtx, listenerSet, target), xdsIR, ) } -func gatewayBackendTrafficPolicyTargetListeners( - gtwCtx *GatewayContext, - target policyTargetReferenceWithSectionName, -) []*ListenerContext { - listeners := make([]*ListenerContext, 0, len(gtwCtx.listeners)) - for _, listener := range gtwCtx.listeners { - if target.SectionName != nil { - if listener.isFromListenerSet() || listener.Name != *target.SectionName { - continue - } - } - listeners = append(listeners, listener) - } - return listeners -} - -func listenerSetBackendTrafficPolicyTargetListeners( - gtwCtx *GatewayContext, - listenerSet *gwapiv1.ListenerSet, - target policyTargetReferenceWithSectionName, -) []*ListenerContext { - listeners := make([]*ListenerContext, 0, len(gtwCtx.listeners)) - for _, listener := range gtwCtx.listeners { - if !listener.isFromListenerSet() { - continue - } - if listener.listenerSet.Namespace != listenerSet.Namespace || listener.listenerSet.Name != listenerSet.Name { - continue - } - if target.SectionName != nil && listener.Name != *target.SectionName { - continue - } - listeners = append(listeners, listener) - } - return listeners -} - func (t *Translator) translateBackendTrafficPolicyForListeners( policy *egv1a1.BackendTrafficPolicy, gtwCtx *GatewayContext,