Skip to content

Commit 5922b37

Browse files
y-rabiey-rabie
committed
fix: only process security/backend/envoyextension policies of our controller
Signed-off-by: y-rabie <[email protected]>
1 parent 6f0ada9 commit 5922b37

File tree

4 files changed

+90
-35
lines changed

4 files changed

+90
-35
lines changed

‎internal/gatewayapi/backendtrafficpolicy.go‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
105105
}
106106

107107
t.processBackendTrafficPolicyForRoute(resources, xdsIR,
108-
routeMap, gatewayRouteMap, gatewayPolicyMerged, gatewayPolicyMap, policy, currTarget)
108+
gatewayMap, routeMap, gatewayRouteMap, gatewayPolicyMerged, gatewayPolicyMap, policy, currTarget)
109109
}
110110
}
111111
}
@@ -125,7 +125,7 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
125125
}
126126

127127
t.processBackendTrafficPolicyForRoute(resources, xdsIR,
128-
routeMap, gatewayRouteMap, gatewayPolicyMerged, gatewayPolicyMap, policy, currTarget)
128+
gatewayMap, routeMap, gatewayRouteMap, gatewayPolicyMerged, gatewayPolicyMap, policy, currTarget)
129129
}
130130
}
131131
}
@@ -224,6 +224,7 @@ func (t *Translator) buildGatewayPolicyMap(
224224
func (t *Translator) processBackendTrafficPolicyForRoute(
225225
resources *resource.Resources,
226226
xdsIR resource.XdsIRMap,
227+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
227228
routeMap map[policyTargetRouteKey]*policyRouteTargetContext,
228229
gatewayRouteMap *GatewayPolicyRouteMap,
229230
gatewayPolicyMergedMap *GatewayPolicyRouteMap,
@@ -253,12 +254,17 @@ func (t *Translator) processBackendTrafficPolicyForRoute(
253254
// parentRefCtxs holds parent gateway/listener contexts for using in policy merge logic.
254255
parentRefCtxs := make([]*RouteParentContext, 0, len(parentRefs))
255256
for _, p := range parentRefs {
256-
if p.Kind == nil || *p.Kind == resource.KindGateway {
257-
namespace := targetedRoute.GetNamespace()
258-
if p.Namespace != nil {
259-
namespace = string(*p.Namespace)
260-
}
261-
257+
namespace := targetedRoute.GetNamespace()
258+
if p.Namespace != nil {
259+
namespace = string(*p.Namespace)
260+
}
261+
gwNN := types.NamespacedName{
262+
Namespace: namespace,
263+
Name: string(p.Name),
264+
}
265+
// Check if it's a gateway, and that it's a gateway that belongs to the gatewayclass we're processing.
266+
// Otherwise it may belong to another gatewayclass or another controller.
267+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
262268
mapKey := NamespacedNameWithSection{
263269
NamespacedName: types.NamespacedName{
264270
Name: string(p.Name),

‎internal/gatewayapi/envoyextensionpolicy.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
8686
}
8787

8888
t.processEnvoyExtensionPolicyForRoute(resources, xdsIR,
89-
routeMap, gatewayRouteMap, policy, currTarget)
89+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
9090
}
9191
}
9292
}
@@ -106,7 +106,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
106106
}
107107

108108
t.processEnvoyExtensionPolicyForRoute(resources, xdsIR,
109-
routeMap, gatewayRouteMap, policy, currTarget)
109+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
110110
}
111111
}
112112
}
@@ -164,6 +164,7 @@ func (t *Translator) processEnvoyExtensionPolicyForRoute(
164164
resources *resource.Resources,
165165
xdsIR resource.XdsIRMap,
166166
routeMap map[policyTargetRouteKey]*policyRouteTargetContext,
167+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
167168
gatewayRouteMap map[string]map[string]sets.Set[string],
168169
policy *egv1a1.EnvoyExtensionPolicy,
169170
currTarget gwapiv1.LocalPolicyTargetReferenceWithSectionName,
@@ -188,15 +189,16 @@ func (t *Translator) processEnvoyExtensionPolicyForRoute(
188189
// policy overrides and populate its ancestor status.
189190
parentRefs := GetParentReferences(targetedRoute)
190191
for _, p := range parentRefs {
191-
if p.Kind == nil || *p.Kind == resource.KindGateway {
192-
namespace := targetedRoute.GetNamespace()
193-
if p.Namespace != nil {
194-
namespace = string(*p.Namespace)
195-
}
196-
gwNN := types.NamespacedName{
197-
Namespace: namespace,
198-
Name: string(p.Name),
199-
}
192+
namespace := targetedRoute.GetNamespace()
193+
if p.Namespace != nil {
194+
namespace = string(*p.Namespace)
195+
}
196+
gwNN := types.NamespacedName{
197+
Namespace: namespace,
198+
Name: string(p.Name),
199+
}
200+
201+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
200202

201203
key := gwNN.String()
202204
if _, ok := gatewayRouteMap[key]; !ok {
@@ -230,7 +232,7 @@ func (t *Translator) processEnvoyExtensionPolicyForRoute(
230232
}
231233

232234
// Set conditions for translation error if it got any
233-
if err := t.translateEnvoyExtensionPolicyForRoute(policy, targetedRoute, currTarget, xdsIR, resources); err != nil {
235+
if err := t.translateEnvoyExtensionPolicyForRoute(policy, targetedRoute, currTarget, gatewayMap, xdsIR, resources); err != nil {
234236
status.SetTranslationErrorForPolicyAncestors(&policy.Status,
235237
ancestorRefs,
236238
t.GatewayControllerName,
@@ -454,6 +456,7 @@ func (t *Translator) translateEnvoyExtensionPolicyForRoute(
454456
policy *egv1a1.EnvoyExtensionPolicy,
455457
route RouteContext,
456458
target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
459+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
457460
xdsIR resource.XdsIRMap,
458461
resources *resource.Resources,
459462
) error {
@@ -475,6 +478,17 @@ func (t *Translator) translateEnvoyExtensionPolicyForRoute(
475478
parentRefs := GetParentReferences(route)
476479
routesWithDirectResponse := sets.New[string]()
477480
for _, p := range parentRefs {
481+
namespace := route.GetNamespace()
482+
if p.Namespace != nil {
483+
namespace = string(*p.Namespace)
484+
}
485+
gwNN := types.NamespacedName{
486+
Namespace: namespace,
487+
Name: string(p.Name),
488+
}
489+
if _, ok := gatewayMap[gwNN]; !ok {
490+
continue
491+
}
478492
parentRefCtx := GetRouteParentContext(route, p, t.GatewayControllerName)
479493
gtwCtx := parentRefCtx.GetGateway()
480494
if gtwCtx == nil {

‎internal/gatewayapi/securitypolicy.go‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
113113
}
114114

115115
t.processSecurityPolicyForRoute(resources, xdsIR,
116-
routeMap, gatewayRouteMap, policy, currTarget)
116+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
117117
}
118118
}
119119
}
@@ -132,7 +132,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
132132
}
133133

134134
t.processSecurityPolicyForRoute(resources, xdsIR,
135-
routeMap, gatewayRouteMap, policy, currTarget)
135+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
136136
}
137137
}
138138
}
@@ -188,6 +188,7 @@ func (t *Translator) processSecurityPolicyForRoute(
188188
resources *resource.Resources,
189189
xdsIR resource.XdsIRMap,
190190
routeMap map[policyTargetRouteKey]*policyRouteTargetContext,
191+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
191192
gatewayRouteMap map[string]map[string]sets.Set[string],
192193
policy *egv1a1.SecurityPolicy,
193194
currTarget gwapiv1.LocalPolicyTargetReferenceWithSectionName,
@@ -212,16 +213,15 @@ func (t *Translator) processSecurityPolicyForRoute(
212213
// The parent gateways are also used to set the status of the policy.
213214
parentRefs := GetParentReferences(targetedRoute)
214215
for _, p := range parentRefs {
215-
if p.Kind == nil || *p.Kind == resource.KindGateway {
216-
namespace := targetedRoute.GetNamespace()
217-
if p.Namespace != nil {
218-
namespace = string(*p.Namespace)
219-
}
220-
gwNN := types.NamespacedName{
221-
Namespace: namespace,
222-
Name: string(p.Name),
223-
}
224-
216+
namespace := targetedRoute.GetNamespace()
217+
if p.Namespace != nil {
218+
namespace = string(*p.Namespace)
219+
}
220+
gwNN := types.NamespacedName{
221+
Namespace: namespace,
222+
Name: string(p.Name),
223+
}
224+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
225225
key := gwNN.String()
226226
if _, ok := gatewayRouteMap[key]; !ok {
227227
gatewayRouteMap[key] = make(map[string]sets.Set[string])
@@ -271,7 +271,7 @@ func (t *Translator) processSecurityPolicyForRoute(
271271
return
272272
}
273273

274-
if err := t.translateSecurityPolicyForRoute(policy, targetedRoute, currTarget, resources, xdsIR); err != nil {
274+
if err := t.translateSecurityPolicyForRoute(policy, targetedRoute, currTarget, gatewayMap, resources, xdsIR); err != nil {
275275
status.SetTranslationErrorForPolicyAncestors(&policy.Status,
276276
parentGateways,
277277
t.GatewayControllerName,
@@ -598,6 +598,7 @@ func (t *Translator) translateSecurityPolicyForRoute(
598598
policy *egv1a1.SecurityPolicy,
599599
route RouteContext,
600600
target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
601+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
601602
resources *resource.Resources,
602603
xdsIR resource.XdsIRMap,
603604
) error {
@@ -647,6 +648,18 @@ func (t *Translator) translateSecurityPolicyForRoute(
647648
parentRefs := GetParentReferences(route)
648649
routesWithDirectResponse := sets.New[string]()
649650
for _, p := range parentRefs {
651+
namespace := route.GetNamespace()
652+
if p.Namespace != nil {
653+
namespace = string(*p.Namespace)
654+
}
655+
gwNN := types.NamespacedName{
656+
Namespace: namespace,
657+
Name: string(p.Name),
658+
}
659+
if _, ok := gatewayMap[gwNN]; !ok {
660+
continue
661+
}
662+
650663
parentRefCtx := GetRouteParentContext(route, p, t.GatewayControllerName)
651664
gtwCtx := parentRefCtx.GetGateway()
652665
if gtwCtx == nil {

‎internal/gatewayapi/securitypolicy_test.go‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@ import (
1616
"github.com/stretchr/testify/assert"
1717
"github.com/stretchr/testify/require"
1818
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
19+
"k8s.io/apimachinery/pkg/types"
1920
"k8s.io/apimachinery/pkg/util/sets"
2021
"k8s.io/utils/ptr"
2122
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
2223
gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
2324

2425
egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
2526
"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
27+
"github.com/envoyproxy/gateway/internal/utils"
2628
)
2729

2830
func Test_wildcard2regex(t *testing.T) {
@@ -933,12 +935,22 @@ func Test_SecurityPolicy_TCP_Invalid_setsStatus_and_returns(t *testing.T) {
933935
}
934936
routeMap[key] = &policyRouteTargetContext{RouteContext: tcpRoute}
935937

938+
// Create the gateway map with gateways that belong to our controller
939+
gw := &gwapiv1.Gateway{
940+
ObjectMeta: metav1.ObjectMeta{
941+
Name: "test-gateway",
942+
Namespace: "default",
943+
},
944+
}
945+
gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, 1)
946+
gatewayMap[utils.NamespacedName(gw)] = &policyGatewayTargetContext{GatewayContext: &GatewayContext{Gateway: gw}}
947+
936948
gatewayRouteMap := make(map[string]map[string]sets.Set[string])
937949
resources := resource.NewResources()
938950
xdsIR := make(resource.XdsIRMap)
939951

940952
// Process the policy - this should set error status
941-
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayRouteMap, policy, target)
953+
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayMap, gatewayRouteMap, policy, target)
942954

943955
// Assert that the policy has a False condition (error was set)
944956
require.True(t, hasParentFalseCondition(policy))
@@ -1007,12 +1019,22 @@ func Test_SecurityPolicy_HTTP_Invalid_setsStatus_and_returns(t *testing.T) {
10071019
}
10081020
routeMap[key] = &policyRouteTargetContext{RouteContext: httpRoute}
10091021

1022+
// Create the gateway map with gateways that belong to our controller
1023+
gw := &gwapiv1.Gateway{
1024+
ObjectMeta: metav1.ObjectMeta{
1025+
Name: "test-gateway",
1026+
Namespace: "default",
1027+
},
1028+
}
1029+
gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, 1)
1030+
gatewayMap[utils.NamespacedName(gw)] = &policyGatewayTargetContext{GatewayContext: &GatewayContext{Gateway: gw}}
1031+
10101032
gatewayRouteMap := make(map[string]map[string]sets.Set[string])
10111033
resources := resource.NewResources()
10121034
xdsIR := make(resource.XdsIRMap)
10131035

10141036
// Process the policy - this should set error status
1015-
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayRouteMap, policy, target)
1037+
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayMap, gatewayRouteMap, policy, target)
10161038

10171039
// Assert that the policy has a False condition (error was set)
10181040
require.True(t, hasParentFalseCondition(policy))

0 commit comments

Comments
 (0)