failing test on master regarding ssl-passthrough - #831
Draft
KlausNie wants to merge 1 commit into
Draft
Conversation
KlausNie
changed the title
KlausNie
force-pushed
the
test/allowlist-dropped-from-https-under-cluster-passthrough
branch
from
July 13, 2026 11:25
eb81653 to
d5c1ba0
Compare
KlausNie
changed the title
KlausNie
force-pushed
the
test/allowlist-dropped-from-https-under-cluster-passthrough
branch
from
July 13, 2026 11:40
d5c1ba0 to
57ace45
Compare
…om https frontend Once any ingress uses ssl-passthrough, allow-list/deny-list rules of all other ingresses lose the https frontend, where their TLS traffic lands.
KlausNie
force-pushed
the
test/allowlist-dropped-from-https-under-cluster-passthrough
branch
from
July 28, 2026 05:53
57ace45 to
35fa1db
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Test-only demonstration PR — intentionally contains no fix, and the new e2e test is expected to FAIL against master. It reproduces a fail-open bug in allow-list/deny-list enforcement; a full write-up will follow as an issue linking back here.
What it demonstrates
Once any single ingress in the cluster uses
ssl-passthrough, the controller-widehaproxy.SSLPassthroughflag istrue, andaddRules()(pkg/ingress/ingress.go:167-170) places every ingress'sREQ_DENY/REQ_CAPTURErule on{http, ssl}instead of{http, https}— dropping thehttpsfrontend even for ingresses that never opted into passthrough. Their TLS traffic still terminates on thehttpsfrontend (relayed via thesslfrontend's default backend, or arriving directly on the QUIC binds), so theirallow-list/deny-listsilently goes unenforced on HTTPS while plain HTTP stays correctly filtered.This is distinct from #770 / 79d754a: that fix made the frontend selection stable per reconcile pass (it previously depended on Go map iteration order mid-pass), but the stable selection itself still drops the
httpsfrontend. Observed live on 3.2.12: the intermittent enforcement described in #770 became a permanent fail-open.