envoyproxy / envoyproxy/gateway

`ClientTrafficPolicy` status update error when attached to Gateway with `mergeGateways` set to `true`

Open
#4,703 1 comment 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
When we create a `ClientTraifficPolicy` and attach to a `Gateway` using a `GatewayClass` with `EnvoyProxy` configuration specifying `mergeGateways` as `true`, the `ClientTrafficPolicy` seemingly gets applied, however we get the following error in the `EnvoyGateway` logs:
```
2024-11-11T10:26:04.965Z ERROR provider kubernetes/status_updater.go:114 unable to update status {"runner": "provider", "name": "ctp-name", "namespace": "", "error": "ClientTrafficPolicy.gateway.envoyproxy.io \"ctp-name\" is invalid: [status.ancestors[0].conditions[0].message: Too long: may not be longer than 32768, status.ancestors[1].conditions[0].message: Too long: may not be longer than 32768, : Invalid value: \"null\": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation]"}
```

Gateway object status is slightly over 1KByte (1276 characters) - which I assume this error is referring to. I tried various combinations of the CTP:
* targetRef instead of targetRefs (indicated one gateway section)
* separate CTPs with one or multiple spec items

Once duplicate CTP is created, I see the following message which likely implies that the previous CTP (which shows no status) is actually applied, but it's not in reality (e.g. `preserveHeaderCase` is not enforced validated by tests):
```
...
status:
ancestors:
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: name
namespace: namespace
sectionName: gateway-section-name
conditions:
- lastTransitionTime: "2024-11-11T10:20:05Z"
message: Unable to target section, another ClientTrafficPolicy has already attached
to it
observedGeneration: 1
reason: Conflicted
status: "False"
type: Accepted
controllerName: gateway.envoyproxy.io/gatewayclass-controller
```

*Repro steps*:
The following CTP causes the issue:
```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: ctp-name
namespace:
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-name
sectionName: section-name
http1:
preserveHeaderCase: true
```

When I switch to use the Gateway without the mergeGateways - then CTP works fine:
```
...
status:
ancestors:
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: non-merged-gateway
namespace: namespace
conditions:
- lastTransitionTime: "2024-11-11T11:37:44Z"
message: Policy has been accepted.
reason: Accepted
status: "True"
type: Accepted
controllerName: gateway.envoyproxy.io/gatewayclass-controller
```

*Environment*:
Envoy Gateway v1.1

*Logs*:
Included above

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.