BUG/MEDIUM: fix a case for conformance test GatewayWithAttachedRoutes

Author: hdurand0710

.gitlab/conformance-tests.yml

@@ -17,7 +17,7 @@ conformance-MR-GW-API-1_3_0:
     CONFORMANCE_REPORT_OUTPUT: "${CI_PROJECT_DIR}/conformance-report-1.3.0.yaml"
     CONFORMANCE_JUNIT_OUTPUT: "conformance-junit-1.3.0.xml"
     CONFORMANCE_RUN_TEST: ""
-    CONFORMANCE_SKIP_TESTS: "HTTPRouteInvalidParentRefNotMatchingSectionName,GatewayWithAttachedRoutes,HTTPRouteCrossNamespace,HTTPRouteExactPathMatching,HTTPRouteHTTPSListener,HTTPRouteHeaderMatching,HTTPRouteHostnameIntersection,HTTPRouteInvalidBackendRefUnknownKind,HTTPRouteInvalidCrossNamespaceBackendRef,HTTPRouteInvalidCrossNamespaceParentRef,HTTPRouteInvalidNonExistentBackendRef,HTTPRouteListenerHostnameMatching,HTTPRouteMatching,HTTPRouteMatchingAcrossRoutes,HTTPRouteObservedGenerationBump,HTTPRoutePathMatchOrder,HTTPRouteRedirectHostAndStatus,HTTPRouteRequestHeaderModifier,HTTPRouteServiceTypes,HTTPRouteSimpleSameNamespace,HTTPRouteWeight,GatewaySecretInvalidReferenceGrant,GatewaySecretMissingReferenceGrant,GatewaySecretReferenceGrantAllInNamespace,GatewaySecretReferenceGrantSpecific,HTTPRouteInvalidReferenceGrant,HTTPRoutePartiallyInvalidViaInvalidReferenceGrant,HTTPRouteReferenceGrant"
+    CONFORMANCE_SKIP_TESTS: "HTTPRouteInvalidParentRefNotMatchingSectionName,HTTPRouteCrossNamespace,HTTPRouteExactPathMatching,HTTPRouteHTTPSListener,HTTPRouteHeaderMatching,HTTPRouteHostnameIntersection,HTTPRouteInvalidBackendRefUnknownKind,HTTPRouteInvalidCrossNamespaceBackendRef,HTTPRouteInvalidCrossNamespaceParentRef,HTTPRouteInvalidNonExistentBackendRef,HTTPRouteListenerHostnameMatching,HTTPRouteMatching,HTTPRouteMatchingAcrossRoutes,HTTPRouteObservedGenerationBump,HTTPRoutePathMatchOrder,HTTPRouteRedirectHostAndStatus,HTTPRouteRequestHeaderModifier,HTTPRouteServiceTypes,HTTPRouteSimpleSameNamespace,HTTPRouteWeight,GatewaySecretInvalidReferenceGrant,GatewaySecretMissingReferenceGrant,GatewaySecretReferenceGrantAllInNamespace,GatewaySecretReferenceGrantSpecific,HTTPRouteInvalidReferenceGrant,HTTPRoutePartiallyInvalidViaInvalidReferenceGrant,HTTPRouteReferenceGrant"
   before_script:
     - export PATH=$PATH:/root/go/bin
     - docker login -u='$app' -p "$CI_REGISTRY_TOKEN" registry.haproxy.com

k8s/gate/tree/HTTPRoute.go

@@ -251,8 +251,8 @@ func (r *HTTPRoute) checkParentRef(parentRef gatewayv1.ParentReference, controll
 	conds := generic.Conditions{}
 
 	for _, listener := range attachableListeners {
-		// Check if the listener is valid
-		if !listener.Valid {
+		// Check if the listener is accepted (routes can attach to accepted listeners even with unresolved refs)
+		if !listener.Accepted {
 			conds.MergeOverrideConditions(rc.ConditionNotAcceptedNoMatchingParent())
 			continue
 		}

k8s/gate/tree/TLSRoute.go

@@ -229,8 +229,8 @@ func (r *TLSRoute) checkParentRef(parentRef gatewayv1.ParentReference, controlle
 	conds := generic.Conditions{}
 
 	for _, listener := range attachableListeners {
-		// Vérifie la validité du listener
-		if !listener.Valid {
+		// Check if the listener is accepted (routes can attach to accepted listeners even with unresolved refs)
+		if !listener.Accepted {
 			conds.MergeOverrideConditions(rc.ConditionNotAcceptedNoMatchingParent())
 			continue
 		}

k8s/gate/tree/gateway_listener.go

@@ -52,8 +52,11 @@ type Listener struct {
 	CheckConflict       CheckResult
 	// AllowedRouteKinds is the list of allowed route kinds for this listener.
 	AllowedRouteKinds []gatewayv1.RouteGroupKind
-	// Valid
+	// Valid indicates the listener is fully programmed (Accepted, no conflicts, all refs resolved).
 	Valid bool
+	// Accepted indicates the listener configuration is accepted (valid protocol, no conflicts).
+	// Routes can attach to an accepted listener even if refs are unresolved.
+	Accepted bool
 }
 
 // DeepCopy creates a deep copy of the Listener.
@@ -409,6 +412,8 @@ func (l *Listener) BuildConditions(treeGw *Gateway) {
 	l.Conditions.MergeOverrideConditions(l.CheckConflict.Conditions)
 	// Should we process with Haproxy programmation
 	shouldProgramm := true
+	// isAccepted tracks whether the listener is accepted (routes can attach even with unresolved refs)
+	isAccepted := true
 
 	_, exists := l.Conditions.GetCondition(generic.ConditionType(gatewayv1.ListenerConditionAccepted))
 	if !exists {
@@ -417,6 +422,7 @@ func (l *Listener) BuildConditions(treeGw *Gateway) {
 	} else {
 		l.Conditions.MergeOverrideConditions(conditions.NewListenerProgrammedInvalid())
 		shouldProgramm = false
+		isAccepted = false
 	}
 
 	_, exists = l.Conditions.GetCondition(generic.ConditionType(gatewayv1.ListenerConditionResolvedRefs))
@@ -426,19 +432,22 @@ func (l *Listener) BuildConditions(treeGw *Gateway) {
 	} else {
 		l.Conditions.MergeOverrideConditions(conditions.NewListenerProgrammedInvalid())
 		shouldProgramm = false
+		// ResolvedRefs=False does NOT prevent route attachment per the Gateway API spec
 	}
 
 	_, exists = l.Conditions.GetCondition(generic.ConditionType(gatewayv1.ListenerConditionConflicted))
 	if exists {
 		l.Conditions.MergeOverrideConditions(conditions.NewListenerProgrammedInvalid())
 		shouldProgramm = false
+		isAccepted = false
 	}
 
 	if shouldProgramm {
 		l.Conditions.MergeOverrideConditions(conditions.NewListenerProgrammedPending())
 	}
 
 	l.Valid = shouldProgramm
+	l.Accepted = isAccepted
 	l.Conditions.SetGeneration(treeGw.K8sResource.GetGeneration())
 }