envoyproxy / envoyproxy/gateway

Support using xPolicies with routes that attach to ListenerSets

Open
#9,242 3 comments 6 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
Currently (v1.8.1) attaching policies to routes that attach to `ListenerSet` instead of `Gateway` doesn't work. The policies get ignored - they don't have their status fields set and they don't affect anything (double-checked by dumping and verifying xDS).

Example that doesn't work:
```yaml
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
namespace: envoy-gateway
name: gateway-1
spec:
gatewayClassName: envoy-gateway-class
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
allowedListeners:
namespaces:
from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
namespace: default
name: listener-1
spec:
parentRef:
name: gateway-1
namespace: envoy-gateway
listeners:
- name: extra-http-one
protocol: HTTP
port: 8081
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
namespace: default
name: httproute-1
spec:
hostnames:
- gateway.envoyproxy.io
parentRefs:
- group: gateway.networking.k8s.io
kind: ListenerSet
name: listener-1
rules:
- matches:
- path:
value: "/http1"
backendRefs:
- name: service-1
port: 8080
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
namespace: default
name: policy-for-httproute-1
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: httproute-1
requestBuffer:
limit: 4Mi
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by applying the Gateway, ListenerSet, HTTPRoute, and BackendTrafficPolicy manifests from the report and inspect the resulting policy status fields and xDS output. Trace how policies targeting the HTTPRoute are resolved when its parentRef kind is ListenerSet, then verify that the policy is no longer ignored and affects the generated configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
api, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.