Skip to content

Commit 46880e8

Browse files
rikatzrikatz
committed
Add examples of conflicting ListenerSets
1 parent 88960c8 commit 46880e8

File tree

1 file changed

+199
-4
lines changed

1 file changed

+199
-4
lines changed

‎geps/gep-1713/index.md

Lines changed: 199 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,16 @@ type ListenerSetSpec struct {
115115
// 2. ListenerSet ordered by creation time (oldest first)
116116
// 3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
117117
//
118+
// Regarding Conflict Management, Listeners in a ListenerSet follow the same
119+
// rules of Listeners on a Gateway resource.
120+
//
121+
// This validation should happen within all of the ListenerSets attached to a
122+
// Gateway, and the precedence of "parent Gateway" -> "oldest first" ->
123+
// "alphabetically ordered" should be respected.
124+
//
125+
// ListenerSets containing conflicting Listeners MUST set the Conflicted
126+
// Condition to true and clearly indicate which Listeners are conflicted.
127+
//
118128
// +listType=map
119129
// +listMapKey=name
120130
// +kubebuilder:validation:MinItems=1
@@ -333,9 +343,6 @@ type ParentGatewayReference struct {
333343
The following example shows a `Gateway` with an HTTP listener and two child HTTPS `ListenerSets` with unique hostnames and certificates.
334344

335345
Only `ListenerSets` from the same namespace of the `Gateway` will be accepted:
336-
337-
338-
339346
```yaml
340347
apiVersion: gateway.networking.k8s.io/v1
341348
kind: Gateway
@@ -556,7 +563,195 @@ Listeners should be merged using the following precedence:
556563
2. ListenerSet ordered by creation time (oldest first)
557564
3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
558565

559-
Conflicts are covered in the section 'ListenerConditions within a ListenerSet'
566+
Conflicts are covered in the section [Listener and ListenerSet conflicts](#listener-and-listenerset-conflicts)
567+
568+
### Listener and ListenerSet conflicts
569+
570+
ListenerSet conflicts should be managed similarly to [Gateway resource conflict](https://github.com/kubernetes-sigs/gateway-api/blob/372a5b06624cff12117f41dcd26c08cb1def22e7/apis/v1/gateway_types.go#L76)
571+
management.
572+
573+
With ListenerSet this validation should happen within the same ListenerSet resource,
574+
but MUST be validated also within a Gateway scope and all of the attached Listeners/ListenerSets.
575+
576+
This means that the validation should happen now between distinct ListenerSets
577+
attached to the same Gateway, and in case of a conflict, the [Listener Precedence](#listener-precedence)
578+
should be respected, and the conflicting listener MUST have a `Conflicted` condition
579+
set to True and with an explicit reason on its message.
580+
581+
Following are some examples of a conflict situation:
582+
583+
#### Conflict between ListenerSet and parent Gateway
584+
585+
Given the following resource definitions:
586+
587+
```yaml
588+
apiVersion: gateway.networking.k8s.io/v1
589+
kind: Gateway
590+
metadata:
591+
name: parent-gateway
592+
namespace: infra
593+
spec:
594+
allowedListeners:
595+
namespaces:
596+
from: All
597+
listeners:
598+
- name: foo
599+
hostname: www.something.tld
600+
protocol: HTTPS
601+
port: 443
602+
tls:
603+
mode: Terminate
604+
certificateRefs:
605+
- kind: Secret
606+
group: ""
607+
name: default-cert
608+
---
609+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
610+
kind: ListenerSet
611+
metadata:
612+
name: user-listenerset
613+
namespace: user01
614+
spec:
615+
parentRef:
616+
name: parent-gateway
617+
kind: Gateway
618+
group: gateway.networking.k8s.io
619+
listeners:
620+
- name: myapp
621+
hostname: www.something.tld
622+
protocol: HTTPS
623+
port: 443
624+
tls:
625+
mode: Terminate
626+
certificateRefs:
627+
- kind: Secret
628+
group: ""
629+
name: app-cert
630+
```
631+
632+
The ListenerSet `user-listenerset` should be marked as Conflicted, as the `parent-gateway`
633+
have a listener definition called `foo` that conflicts with the ListenetSet definition
634+
called `myapp`, as the following:
635+
636+
```yaml
637+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
638+
kind: ListenerSet
639+
metadata:
640+
name: user-listenerset
641+
namespace: user01
642+
....
643+
status:
644+
listeners:
645+
- name: myapp
646+
hostname: www.something.tld
647+
protocol: HTTPS
648+
port: 443
649+
conditions:
650+
- message: ListenerSet has conflicts with Gateway 'infra/parent-gateway'
651+
reason: Conflicted
652+
status: "True"
653+
type: Conflicted
654+
```
655+
656+
#### Conflict between two ListenerSets
657+
658+
The following example represents a conflict between two ListenerSets on distinct
659+
namespaces. The controller should avoid setting any Condition that exposes information
660+
from other users, but still provide meaningful information of why a ListenerSet
661+
was not accepted
662+
663+
664+
```yaml
665+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
666+
kind: ListenerSet
667+
metadata:
668+
creationTimestamp: "2025-08-11T15:44:05Z"
669+
name: listenerset1
670+
namespace: user01
671+
spec:
672+
parentRef:
673+
name: parent-gateway
674+
kind: Gateway
675+
group: gateway.networking.k8s.io
676+
listeners:
677+
- name: myapp
678+
hostname: www.something.tld
679+
protocol: HTTPS
680+
port: 443
681+
tls:
682+
mode: Terminate
683+
certificateRefs:
684+
- kind: Secret
685+
group: ""
686+
name: app-cert
687+
---
688+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
689+
kind: ListenerSet
690+
metadata:
691+
creationTimestamp: "2025-08-11T13:44:05Z"
692+
name: listenerset2
693+
namespace: user02
694+
spec:
695+
parentRef:
696+
name: parent-gateway
697+
kind: Gateway
698+
group: gateway.networking.k8s.io
699+
listeners:
700+
- name: myapp
701+
hostname: www.something.tld
702+
protocol: HTTPS
703+
port: 443
704+
tls:
705+
mode: Terminate
706+
certificateRefs:
707+
- kind: Secret
708+
group: ""
709+
name: other-app-cert
710+
```
711+
712+
In this case, there's a conflict as both users are setting the same hostname and
713+
port on distinct Listeners. In this case, because the ListenerSet `user02/listenerset2`
714+
is older, it will be accepted while `user01/listenerset1` should not be accepted,
715+
and receive a `Conflicted=True` condition.
716+
717+
The status of ListenerSets can be defined as the following:
718+
719+
```yaml
720+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
721+
kind: ListenerSet
722+
metadata:
723+
creationTimestamp: "2025-08-11T15:44:05Z"
724+
name: listenerset1
725+
namespace: user01
726+
status:
727+
listeners:
728+
- name: myapp
729+
hostname: www.something.tld
730+
protocol: HTTPS
731+
port: 443
732+
conditions:
733+
- message: ListenerSet has conflicts with other listeners attached to the same Gateway
734+
reason: Conflicted
735+
status: "True"
736+
type: Conflicted
737+
---
738+
apiVersion: gateway.networking.x-k8s.io/v1alpha1
739+
kind: ListenerSet
740+
metadata:
741+
creationTimestamp: "2025-08-11T13:44:05Z"
742+
name: listenerset2
743+
namespace: user02
744+
status:
745+
listeners:
746+
- name: myapp
747+
hostname: www.something.tld
748+
protocol: HTTPS
749+
port: 443
750+
conditions:
751+
- reason: Accepted
752+
status: "True"
753+
type: Accepted
754+
```
560755

561756
### Gateway Conditions
562757

0 commit comments

Comments
 (0)