refactor: Simplify permission checking in ReferenceGrant validation

Author: dspo

internal/controller/httproute_controller.go

@@ -464,7 +464,7 @@ func (r *HTTPRouteReconciler) processHTTPRouteBackendRefs(tctx *provider.Transla
 				r.Log.Error(err, "failed to list ReferenceGrants", "namespace", targetNN.Namespace)
 				return err
 			}
-			if !checkReferenceGrant(
+			if permitted := checkReferenceGrant(
 				v1beta1.ReferenceGrantFrom{
 					Group:     gatewayv1.GroupName,
 					Kind:      KindHTTPRoute,
@@ -476,7 +476,7 @@ func (r *HTTPRouteReconciler) processHTTPRouteBackendRefs(tctx *provider.Transla
 					Name:  (*gatewayv1.ObjectName)(&targetNN.Name),
 				},
 				referenceGrantList.Items,
-			) {
+			); !permitted {
 				terr = ReasonError{
 					Reason:  string(v1beta1.RouteReasonRefNotPermitted),
 					Message: fmt.Sprintf("%s is in a different namespace than the HTTPRoute %s and no ReferenceGrant allowing reference is configured", targetNN, hrNN),

internal/controller/utils.go

@@ -741,7 +741,7 @@ func getListenerStatus(
 				}
 				// if cross namespaces, check if the Gateway has the permission to access the Secret
 				if ref.Namespace != nil && string(*ref.Namespace) != gateway.Namespace {
-					if ok := checkReferenceGrant(
+					if permitted := checkReferenceGrant(
 						v1beta1.ReferenceGrantFrom{
 							Group:     gatewayv1.GroupName,
 							Kind:      KindGateway,
@@ -753,7 +753,7 @@ func getListenerStatus(
 							Name:  &ref.Name,
 						},
 						grants,
-					); !ok {
+					); !permitted {
 						conditionResolvedRefs.Status = metav1.ConditionFalse
 						conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonRefNotPermitted)
 						conditionResolvedRefs.Message = "certificateRefs cross namespaces is not permitted"
@@ -763,8 +763,11 @@ func getListenerStatus(
 					}
 				}
 
-				ns := cmp.Or(ref.Namespace, (*gatewayv1.Namespace)(&gateway.Namespace))
-				if err := mrgc.Get(ctx, client.ObjectKey{Namespace: string(*ns), Name: string(ref.Name)}, &secret); err != nil {
+				secretNN := types.NamespacedName{
+					Namespace: string(*cmp.Or(ref.Namespace, (*gatewayv1.Namespace)(&gateway.Namespace))),
+					Name:      string(ref.Name),
+				}
+				if err := mrgc.Get(ctx, secretNN, &secret); err != nil {
 					conditionResolvedRefs.Status = metav1.ConditionFalse
 					conditionResolvedRefs.Reason = string(gatewayv1.ListenerReasonInvalidCertificateRef)
 					conditionResolvedRefs.Message = err.Error()