Skip to content

Commit 7a975d0

Browse files
y-rabiey-rabie
committed
fix: only process security/backend/envoyextension policies of our controller
Signed-off-by: y-rabie <[email protected]>
1 parent b376e7a commit 7a975d0

File tree

4 files changed

+86
-36
lines changed

4 files changed

+86
-36
lines changed

‎internal/gatewayapi/backendtrafficpolicy.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -131,15 +131,16 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
131131
ancestorRefs := make([]*gwapiv1.ParentReference, 0, len(parentRefs))
132132
routeParents := sets.New[types.NamespacedName]()
133133
for _, p := range parentRefs {
134-
if p.Kind == nil || *p.Kind == resource.KindGateway {
135-
namespace := route.GetNamespace()
136-
if p.Namespace != nil {
137-
namespace = string(*p.Namespace)
138-
}
139-
gwNN := types.NamespacedName{
140-
Namespace: namespace,
141-
Name: string(p.Name),
142-
}
134+
namespace := route.GetNamespace()
135+
if p.Namespace != nil {
136+
namespace = string(*p.Namespace)
137+
}
138+
gwNN := types.NamespacedName{
139+
Namespace: namespace,
140+
Name: string(p.Name),
141+
}
142+
143+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
143144
routeParents.Insert(gwNN)
144145

145146
key := gwNN.String()

‎internal/gatewayapi/envoyextensionpolicy.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
8585
}
8686

8787
t.processEEPolicyForRoute(resources, xdsIR,
88-
routeMap, gatewayRouteMap, policy, currTarget)
88+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
8989
}
9090
}
9191
}
@@ -104,7 +104,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
104104
}
105105

106106
t.processEEPolicyForRoute(resources, xdsIR,
107-
routeMap, gatewayRouteMap, policy, currTarget)
107+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
108108
}
109109
}
110110
}
@@ -160,6 +160,7 @@ func (t *Translator) processEEPolicyForRoute(
160160
resources *resource.Resources,
161161
xdsIR resource.XdsIRMap,
162162
routeMap map[policyTargetRouteKey]*policyRouteTargetContext,
163+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
163164
gatewayRouteMap map[string]map[string]sets.Set[string],
164165
policy *egv1a1.EnvoyExtensionPolicy,
165166
currTarget gwapiv1.LocalPolicyTargetReferenceWithSectionName,
@@ -184,15 +185,16 @@ func (t *Translator) processEEPolicyForRoute(
184185
// policy overrides and populate its ancestor status.
185186
parentRefs := GetParentReferences(targetedRoute)
186187
for _, p := range parentRefs {
187-
if p.Kind == nil || *p.Kind == resource.KindGateway {
188-
namespace := targetedRoute.GetNamespace()
189-
if p.Namespace != nil {
190-
namespace = string(*p.Namespace)
191-
}
192-
gwNN := types.NamespacedName{
193-
Namespace: namespace,
194-
Name: string(p.Name),
195-
}
188+
namespace := targetedRoute.GetNamespace()
189+
if p.Namespace != nil {
190+
namespace = string(*p.Namespace)
191+
}
192+
gwNN := types.NamespacedName{
193+
Namespace: namespace,
194+
Name: string(p.Name),
195+
}
196+
197+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
196198

197199
key := gwNN.String()
198200
if _, ok := gatewayRouteMap[key]; !ok {
@@ -226,7 +228,7 @@ func (t *Translator) processEEPolicyForRoute(
226228
}
227229

228230
// Set conditions for translation error if it got any
229-
if err := t.translateEnvoyExtensionPolicyForRoute(policy, targetedRoute, currTarget, xdsIR, resources); err != nil {
231+
if err := t.translateEnvoyExtensionPolicyForRoute(policy, targetedRoute, currTarget, gatewayMap, xdsIR, resources); err != nil {
230232
status.SetTranslationErrorForPolicyAncestors(&policy.Status,
231233
ancestorRefs,
232234
t.GatewayControllerName,
@@ -450,6 +452,7 @@ func (t *Translator) translateEnvoyExtensionPolicyForRoute(
450452
policy *egv1a1.EnvoyExtensionPolicy,
451453
route RouteContext,
452454
target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
455+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
453456
xdsIR resource.XdsIRMap,
454457
resources *resource.Resources,
455458
) error {
@@ -471,6 +474,17 @@ func (t *Translator) translateEnvoyExtensionPolicyForRoute(
471474
parentRefs := GetParentReferences(route)
472475
routesWithDirectResponse := sets.New[string]()
473476
for _, p := range parentRefs {
477+
namespace := route.GetNamespace()
478+
if p.Namespace != nil {
479+
namespace = string(*p.Namespace)
480+
}
481+
gwNN := types.NamespacedName{
482+
Namespace: namespace,
483+
Name: string(p.Name),
484+
}
485+
if _, ok := gatewayMap[gwNN]; !ok {
486+
continue
487+
}
474488
parentRefCtx := GetRouteParentContext(route, p, t.GatewayControllerName)
475489
gtwCtx := parentRefCtx.GetGateway()
476490
if gtwCtx == nil {

‎internal/gatewayapi/securitypolicy.go‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
107107
}
108108

109109
t.processSecurityPolicyForRoute(resources, xdsIR,
110-
routeMap, gatewayRouteMap, policy, currTarget)
110+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
111111
}
112112
}
113113
}
@@ -125,7 +125,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
125125
}
126126

127127
t.processSecurityPolicyForRoute(resources, xdsIR,
128-
routeMap, gatewayRouteMap, policy, currTarget)
128+
routeMap, gatewayMap, gatewayRouteMap, policy, currTarget)
129129
}
130130
}
131131
}
@@ -179,6 +179,7 @@ func (t *Translator) processSecurityPolicyForRoute(
179179
resources *resource.Resources,
180180
xdsIR resource.XdsIRMap,
181181
routeMap map[policyTargetRouteKey]*policyRouteTargetContext,
182+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
182183
gatewayRouteMap map[string]map[string]sets.Set[string],
183184
policy *egv1a1.SecurityPolicy,
184185
currTarget gwapiv1.LocalPolicyTargetReferenceWithSectionName,
@@ -203,16 +204,15 @@ func (t *Translator) processSecurityPolicyForRoute(
203204
// The parent gateways are also used to set the status of the policy.
204205
parentRefs := GetParentReferences(targetedRoute)
205206
for _, p := range parentRefs {
206-
if p.Kind == nil || *p.Kind == resource.KindGateway {
207-
namespace := targetedRoute.GetNamespace()
208-
if p.Namespace != nil {
209-
namespace = string(*p.Namespace)
210-
}
211-
gwNN := types.NamespacedName{
212-
Namespace: namespace,
213-
Name: string(p.Name),
214-
}
215-
207+
namespace := targetedRoute.GetNamespace()
208+
if p.Namespace != nil {
209+
namespace = string(*p.Namespace)
210+
}
211+
gwNN := types.NamespacedName{
212+
Namespace: namespace,
213+
Name: string(p.Name),
214+
}
215+
if _, ok := gatewayMap[gwNN]; ok && (p.Kind == nil || *p.Kind == resource.KindGateway) {
216216
key := gwNN.String()
217217
if _, ok := gatewayRouteMap[key]; !ok {
218218
gatewayRouteMap[key] = make(map[string]sets.Set[string])
@@ -262,7 +262,7 @@ func (t *Translator) processSecurityPolicyForRoute(
262262
return
263263
}
264264

265-
if err := t.translateSecurityPolicyForRoute(policy, targetedRoute, currTarget, resources, xdsIR); err != nil {
265+
if err := t.translateSecurityPolicyForRoute(policy, targetedRoute, currTarget, gatewayMap, resources, xdsIR); err != nil {
266266
status.SetTranslationErrorForPolicyAncestors(&policy.Status,
267267
parentGateways,
268268
t.GatewayControllerName,
@@ -589,6 +589,7 @@ func (t *Translator) translateSecurityPolicyForRoute(
589589
policy *egv1a1.SecurityPolicy,
590590
route RouteContext,
591591
target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
592+
gatewayMap map[types.NamespacedName]*policyGatewayTargetContext,
592593
resources *resource.Resources,
593594
xdsIR resource.XdsIRMap,
594595
) error {
@@ -638,6 +639,18 @@ func (t *Translator) translateSecurityPolicyForRoute(
638639
parentRefs := GetParentReferences(route)
639640
routesWithDirectResponse := sets.New[string]()
640641
for _, p := range parentRefs {
642+
namespace := route.GetNamespace()
643+
if p.Namespace != nil {
644+
namespace = string(*p.Namespace)
645+
}
646+
gwNN := types.NamespacedName{
647+
Namespace: namespace,
648+
Name: string(p.Name),
649+
}
650+
if _, ok := gatewayMap[gwNN]; !ok {
651+
continue
652+
}
653+
641654
parentRefCtx := GetRouteParentContext(route, p, t.GatewayControllerName)
642655
gtwCtx := parentRefCtx.GetGateway()
643656
if gtwCtx == nil {

‎internal/gatewayapi/securitypolicy_test.go‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,15 @@ import (
1212
"github.com/stretchr/testify/assert"
1313
"github.com/stretchr/testify/require"
1414
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15+
"k8s.io/apimachinery/pkg/types"
1516
"k8s.io/apimachinery/pkg/util/sets"
1617
"k8s.io/utils/ptr"
1718
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
1819
gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
1920

2021
egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
2122
"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
23+
"github.com/envoyproxy/gateway/internal/utils"
2224
)
2325

2426
func Test_wildcard2regex(t *testing.T) {
@@ -856,12 +858,22 @@ func Test_SecurityPolicy_TCP_Invalid_setsStatus_and_returns(t *testing.T) {
856858
}
857859
routeMap[key] = &policyRouteTargetContext{RouteContext: tcpRoute}
858860

861+
// Create the gateway map with gateways that belong to our controller
862+
gw := &gwapiv1.Gateway{
863+
ObjectMeta: metav1.ObjectMeta{
864+
Name: "test-gateway",
865+
Namespace: "default",
866+
},
867+
}
868+
gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, 1)
869+
gatewayMap[utils.NamespacedName(gw)] = &policyGatewayTargetContext{GatewayContext: &GatewayContext{Gateway: gw}}
870+
859871
gatewayRouteMap := make(map[string]map[string]sets.Set[string])
860872
resources := resource.NewResources()
861873
xdsIR := make(resource.XdsIRMap)
862874

863875
// Process the policy - this should set error status
864-
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayRouteMap, policy, target)
876+
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayMap, gatewayRouteMap, policy, target)
865877

866878
// Assert that the policy has a False condition (error was set)
867879
require.True(t, hasParentFalseCondition(policy))
@@ -930,12 +942,22 @@ func Test_SecurityPolicy_HTTP_Invalid_setsStatus_and_returns(t *testing.T) {
930942
}
931943
routeMap[key] = &policyRouteTargetContext{RouteContext: httpRoute}
932944

945+
// Create the gateway map with gateways that belong to our controller
946+
gw := &gwapiv1.Gateway{
947+
ObjectMeta: metav1.ObjectMeta{
948+
Name: "test-gateway",
949+
Namespace: "default",
950+
},
951+
}
952+
gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, 1)
953+
gatewayMap[utils.NamespacedName(gw)] = &policyGatewayTargetContext{GatewayContext: &GatewayContext{Gateway: gw}}
954+
933955
gatewayRouteMap := make(map[string]map[string]sets.Set[string])
934956
resources := resource.NewResources()
935957
xdsIR := make(resource.XdsIRMap)
936958

937959
// Process the policy - this should set error status
938-
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayRouteMap, policy, target)
960+
tr.processSecurityPolicyForRoute(resources, xdsIR, routeMap, gatewayMap, gatewayRouteMap, policy, target)
939961

940962
// Assert that the policy has a False condition (error was set)
941963
require.True(t, hasParentFalseCondition(policy))

0 commit comments

Comments
 (0)