Skip to content

Commit 67a0c0e

Browse files
author
openshift-service-mesh-bot
committed
Automator: merge upstream changes to openshift-service-mesh/istio@master
* upstream/master: Fix kubelet detection on MicroK8s with nftables backend (#58314) Automator: update proxy@master in istio/istio@master (#58386) Add timeout and headers support to Zipkin tracing provider (#58307) Gateway supports custom cipher suites (#58381) Automator: update proxy@master in istio/istio@master (#58383) Automator: update proxy@master in istio/istio@master (#58382) Automator: update proxy@master in istio/istio@master (#58380) Automator: update ztunnel@master in istio/istio@master (#58378) Automator: update proxy@master in istio/istio@master (#58375) fix unerasonable variable setting (#58371) bump go-control-plane (#58370) xds: fix cache key for cluster (#58368) Automator: update istio/client-go@master dependency in istio/istio@master (#58361) Automator: update proxy@master in istio/istio@master (#58358) tests: add integration tests for BackendTLSPolicy applied to ServiceEntry (#58242) Prevent route resource status conflict in multi-revision installs (#58292) add release-note for warmup aggression change (#58339)
2 parents 73e12de + 1ad6422 commit 67a0c0e

File tree

30 files changed

+1291
-85
lines changed

30 files changed

+1291
-85
lines changed

‎cni/pkg/nftables/kubeletuid_linux.go‎

Lines changed: 37 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ import (
2222
"github.com/prometheus/procfs"
2323
)
2424

25-
// getKubeletUIDFromPath finds the kubelet process UID by inspecting the proc filesystem path.
25+
// getKubeletUIDFromPath finds the kubelet or kubelite process UID by inspecting the proc filesystem path.
26+
// In standard Kubernetes distributions, it looks for the "kubelet" process.
27+
// On some platforms like MicroK8s, where multiple k8s components are consolidated, it looks for the "kubelite" process.
2628
func getKubeletUIDFromPath(procPath string) (string, error) {
2729
fs, err := procfs.NewFS(procPath)
2830
if err != nil {
@@ -34,44 +36,53 @@ func getKubeletUIDFromPath(procPath string) (string, error) {
3436
return "", fmt.Errorf("failed to read processes from %s: %v", procPath, err)
3537
}
3638

37-
// Find kubelet process
39+
// List of process names to search for, in order of preference
40+
processNames := []string{"kubelet", "kubelite"}
41+
3842
for _, proc := range procs {
3943
comm, err := proc.Comm()
4044
if err != nil {
4145
// Process might have exited, skip
4246
continue
4347
}
4448

45-
if comm == "kubelet" {
46-
// Lets check the command line to ensure it's really kubelet
47-
cmdline, err := proc.CmdLine()
48-
if err != nil {
49-
continue
50-
}
49+
for _, targetName := range processNames {
50+
if comm == targetName {
51+
// Lets check the command line to ensure it's really the target process
52+
cmdline, err := proc.CmdLine()
53+
if err != nil {
54+
continue
55+
}
5156

52-
kubeletFound := false
53-
for _, arg := range cmdline {
54-
if strings.Contains(strings.ToLower(arg), "kubelet") {
55-
kubeletFound = true
56-
break
57+
// Verify that this process is actually related to kubelet by checking
58+
// if "kubelet" appears in any of the command line arguments.
59+
// This works for both:
60+
// - Standard kubelet: /usr/bin/kubelet [args...]
61+
// - MicroK8s kubelite: /snap/microk8s/.../kubelite --kubelet-args-file=...
62+
processFound := false
63+
for _, arg := range cmdline {
64+
if strings.Contains(strings.ToLower(arg), "kubelet") {
65+
processFound = true
66+
break
67+
}
68+
}
69+
if !processFound {
70+
continue
5771
}
58-
}
59-
if !kubeletFound {
60-
continue
61-
}
6272

63-
// Get process status with UIDs
64-
status, err := proc.NewStatus()
65-
if err != nil {
66-
continue
67-
}
73+
// Get process status with UIDs
74+
status, err := proc.NewStatus()
75+
if err != nil {
76+
continue
77+
}
6878

69-
realUID := status.UIDs[0]
70-
realUIDStr := strconv.FormatUint(realUID, 10)
79+
realUID := status.UIDs[0]
80+
realUIDStr := strconv.FormatUint(realUID, 10)
7181

72-
return realUIDStr, nil
82+
return realUIDStr, nil
83+
}
7384
}
7485
}
7586

76-
return "", fmt.Errorf("kubelet process not found in %s", procPath)
87+
return "", fmt.Errorf("kubelet or kubelite process not found in %s", procPath)
7788
}

‎cni/pkg/nftables/nftables.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,7 @@ func (cfg *NftablesConfigurator) CreateHostRulesForHealthChecks() error {
443443
//
444444
// Challenge: In nftables, there is no direct equivalent to "--socket-exists", so we explored multiple alternatives
445445
// - Option-1 (UID-based matching): Since kubelet runs as a specific process with a known UID, we can use
446-
// meta skuid to identify traffic originating from kubelet.
446+
// meta skuid to identify traffic originating from kubelet (or kubelite in MicroK8s).
447447
//
448448
// - Option-2: Match on kubelet’s source IP (node IP). This works in theory but is a bit unsafe as
449449
// other host processes can also send traffic from the node IP, and nodes can have multiple IPs making the

‎go.mod‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ require (
1212
github.com/cenkalti/backoff/v4 v4.3.0
1313
github.com/cespare/xxhash/v2 v2.3.0
1414
github.com/cheggaaa/pb/v3 v3.1.7
15-
github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443
15+
github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e
1616
github.com/containernetworking/cni v1.3.0
1717
github.com/containernetworking/plugins v1.7.1
1818
github.com/coreos/go-oidc/v3 v3.15.0
1919
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
2020
github.com/docker/cli v28.3.3+incompatible
2121
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250627145903-197b96a9c7f8
22-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251009075907-cccc37f025be
22+
github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20251120180717-7c66c7f1d0b2
2323
github.com/evanphx/json-patch/v5 v5.9.11
2424
github.com/fatih/color v1.18.0
2525
github.com/felixge/fgprof v0.9.5
@@ -76,7 +76,7 @@ require (
7676
go.opentelemetry.io/otel/sdk v1.37.0
7777
go.opentelemetry.io/otel/sdk/metric v1.37.0
7878
go.opentelemetry.io/otel/trace v1.37.0
79-
go.opentelemetry.io/proto/otlp v1.7.1
79+
go.opentelemetry.io/proto/otlp v1.9.0
8080
go.uber.org/atomic v1.11.0
8181
go.uber.org/zap v1.27.0
8282
golang.org/x/net v0.46.0
@@ -93,8 +93,8 @@ require (
9393
gopkg.in/yaml.v2 v2.4.0
9494
gopkg.in/yaml.v3 v3.0.1
9595
helm.sh/helm/v3 v3.18.6
96-
istio.io/api v1.28.0-alpha.0.0.20251118133802-3d6b80ec2d1e
97-
istio.io/client-go v1.28.0-alpha.0.0.20251118134000-fa71d5732509
96+
istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002
97+
istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377
9898
k8s.io/api v0.34.1
9999
k8s.io/apiextensions-apiserver v0.34.1
100100
k8s.io/apimachinery v0.34.1
@@ -134,7 +134,6 @@ require (
134134
github.com/docker/distribution v2.8.3+incompatible // indirect
135135
github.com/docker/docker-credential-helpers v0.9.3 // indirect
136136
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
137-
github.com/envoyproxy/go-control-plane v0.13.5-0.20251013064519-48f97e33cb02 // indirect
138137
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
139138
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
140139
github.com/fatih/camelcase v1.0.0 // indirect
@@ -154,7 +153,7 @@ require (
154153
github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a // indirect
155154
github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
156155
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
157-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
156+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
158157
github.com/hashicorp/errwrap v1.1.0 // indirect
159158
github.com/huandu/xstrings v1.5.0 // indirect
160159
github.com/inconshreveable/mousetrap v1.1.0 // indirect

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,8 @@ github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moA
9494
github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
9595
github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
9696
github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
97-
github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
98-
github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
97+
github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e h1:gt7U1Igw0xbJdyaCM5H2CnlAlPSkzrhsebQB6WQWjLA=
98+
github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
9999
github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
100100
github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
101101
github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
@@ -133,12 +133,12 @@ github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqI
133133
github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
134134
github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
135135
github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
136-
github.com/envoyproxy/go-control-plane v0.13.5-0.20251013064519-48f97e33cb02 h1:VbmMEM1sWPDGm+v2MIa5dD55Ad/KrRXhARGJANxBV6U=
137-
github.com/envoyproxy/go-control-plane v0.13.5-0.20251013064519-48f97e33cb02/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
136+
github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
137+
github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
138138
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250627145903-197b96a9c7f8 h1:KXgXPtBofHkRHr+8dO058dGZnLHapW7m0yJEgSYdAFA=
139139
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250627145903-197b96a9c7f8/go.mod h1:Nx/YcyEeIcgjT13QwKHdcPmS060urxZ835MeO8cLOrg=
140-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251009075907-cccc37f025be h1:u4SE0TvJwGK/iDu9YIK4zd16VOn19pBRSuKOm9KRskA=
141-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251009075907-cccc37f025be/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
140+
github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20251120180717-7c66c7f1d0b2 h1:BprNEu/ZERE6ACMAisXf1H8/1HmDseGxpvD70ltXiqo=
141+
github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20251120180717-7c66c7f1d0b2/go.mod h1:6DQL0WI2n/JV923ZcB8Pr3Xi28osKAWBPpo/jDIKL6U=
142142
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
143143
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
144144
github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
@@ -235,8 +235,8 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 h1:sGm2vDRFUrQJO/Veii4h4z
235235
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2/go.mod h1:wd1YpapPLivG6nQgbf7ZkG1hhSOXDhhn4MLTknx2aAc=
236236
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
237237
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
238-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
239-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
238+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
239+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
240240
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
241241
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
242242
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -470,8 +470,8 @@ go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFh
470470
go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
471471
go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
472472
go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
473-
go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
474-
go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
473+
go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
474+
go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
475475
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
476476
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
477477
go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
@@ -574,10 +574,10 @@ gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
574574
gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
575575
helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
576576
helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
577-
istio.io/api v1.28.0-alpha.0.0.20251118133802-3d6b80ec2d1e h1:qfJY+yQTjm0AWhPXITGSAGCLkujfBGh0Hu3RuXQeyq4=
578-
istio.io/api v1.28.0-alpha.0.0.20251118133802-3d6b80ec2d1e/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
579-
istio.io/client-go v1.28.0-alpha.0.0.20251118134000-fa71d5732509 h1:U0SrRSda3au07r6b4ZbHa+NeKXkV4mVofPvTlQMF7oA=
580-
istio.io/client-go v1.28.0-alpha.0.0.20251118134000-fa71d5732509/go.mod h1:G0jE4yjFmzhXjlTAi6/TYvE8jjFaWM34EpR9OfIb4Ac=
577+
istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002 h1:GmCiNi/TnMKpKIu0r5WSTir1W/Mc+2D9HI/dMp+7zPA=
578+
istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
579+
istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377 h1:ghagEGUxUsjpvbgR6Llr8xaN3kObAk2zJbnWquRhP+s=
580+
istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377/go.mod h1:K9qmUWxQPP5Ltt7fbTmDqHaSUm9iMF5co3dvZsl++P0=
581581
k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
582582
k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
583583
k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=

‎istio.deps‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"name": "PROXY_REPO_SHA",
55
"repoName": "proxy",
66
"file": "",
7-
"lastStableSHA": "c3cad09527225b6a98dbf46ce81d066c580e038f"
7+
"lastStableSHA": "f38c96aea8f213298168d2e7dd6d53ccc8ebe8d1"
88
},
99
{
1010
"_comment": "",
1111
"name": "ZTUNNEL_REPO_SHA",
1212
"repoName": "ztunnel",
1313
"file": "",
14-
"lastStableSHA": "d38548df2d52604a996d601cf2c69e8f3461cb76"
14+
"lastStableSHA": "8ece3c4b191da41e64d8e48b1965ef7291fc1557"
1515
}
1616
]

‎istioctl/pkg/waypoint/waypoint.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -600,7 +600,7 @@ func errorWithMessage(errMsg string, gwc *gateway.Gateway, err error) error {
600600
return errors.New(errorMsg)
601601
}
602602

603-
func printWaypointStatus(ctx cli.Context, w *tabwriter.Writer, kubeClient kube.CLIClient, gw []gateway.Gateway) error {
603+
func printWaypointStatus(ctx cli.Context, w *tabwriter.Writer, kubeClient kube.CLIClient, gws []gateway.Gateway) error {
604604
var cond metav1.Condition
605605
startTime := time.Now()
606606
ticker := time.NewTicker(1 * time.Second)
@@ -610,7 +610,7 @@ func printWaypointStatus(ctx cli.Context, w *tabwriter.Writer, kubeClient kube.C
610610
} else {
611611
fmt.Fprintln(w, "NAME\tSTATUS\tTYPE\tREASON\tMESSAGE")
612612
}
613-
for _, gw := range gw {
613+
for _, gw := range gws {
614614
for range ticker.C {
615615
programmed := false
616616
gwc, err := kubeClient.GatewayAPI().GatewayV1().Gateways(ctx.NamespaceOrDefault(ctx.Namespace())).Get(context.TODO(), gw.Name, metav1.GetOptions{})

‎manifests/charts/base/files/crd-all.gen.yaml‎

Lines changed: 32 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pilot/pkg/config/kube/gateway/backend_policies.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,14 +133,14 @@ func DestinationRuleCollection(
133133
opts krt.OptionsBuilder,
134134
) krt.Collection[*config.Config] {
135135
trafficPolicyStatus, backendTrafficPolicies := BackendTrafficPolicyCollection(trafficPolicies, references, domainSuffix, opts)
136-
status.RegisterStatus(c.status, trafficPolicyStatus, GetStatus)
136+
status.RegisterStatus(c.status, trafficPolicyStatus, GetStatus, c.tagWatcher.AccessUnprotected())
137137

138138
// TODO: BackendTrafficPolicy should also probably use ancestorCollection. However, its still up for debate in the
139139
// Gateway API community if having the Gateway as an ancestor ref is required or not; we would prefer it to not be if possible.
140140
// Until conformance requires it, for now we skip it.
141141
ancestorCollection := ancestors.AsCollection(append(opts.WithName("AncestorBackend"), TypedNamespacedNameIndexCollectionFunc)...)
142142
tlsPolicyStatus, backendTLSPolicies := BackendTLSPolicyCollection(tlsPolicies, ancestorCollection, references, domainSuffix, opts)
143-
status.RegisterStatus(c.status, tlsPolicyStatus, GetStatus)
143+
status.RegisterStatus(c.status, tlsPolicyStatus, GetStatus, c.tagWatcher.AccessUnprotected())
144144

145145
// We need to merge these by hostname into a single DR
146146
allPolicies := krt.JoinCollection([]krt.Collection[BackendPolicy]{backendTrafficPolicies, backendTLSPolicies})

0 commit comments

Comments
 (0)