Repository navigation
fix: Don't report a non-entitled wildcard as Pending - #852
Merged
Merged
Conversation
A gateway whose only dropped listener is a wildcard hostname the project is not entitled to reported Programmed=False with reason Pending, which means the certificate is still being issued and will clear on its own. It never does, so the HTTPProxy stayed Pending indefinitely and kept HTTPProxyStuckUnreconciled firing as if the platform were stuck. Report ListenersNotValid instead, matching the listener's own status.
The entitlement block is only recorded on the listener's certificate status by the certificate service, so the summary taken before it still saw a listener waiting on issuance. Add a reconcile-level test.
scotwells
marked this pull request as ready for review
November 3, 2026 19:28
ecv
approved these changes
Nov 3, 2026
ecv
left a comment
ecv
left a comment
Contributor
There was a problem hiding this comment.
Approve.
A gateway whose only dropped listener is a wildcard the project is not entitled to now reports Programmed=False with ListenersNotValid instead of Pending, so the proxy no longer looks like a certificate that will clear on its own.
summarizeDroppedListenersmoves after the certificate-service step, so theissuanceReasonthat step records inlistenerCertHealthis visible when the drop is summarized. A listener blocked withcertificateServiceReasonWildcardNotEntitledno longer counts as "certificate withheld", soallCertWithheldstays false and the reason is notPending.- A certificate that is merely still issuing keeps
Pending; the existing table cases for that path are unchanged and pass. - Both new tests pin the user-visible outcome: the status table case, and an end-to-end reconcile in
TestWildcardNotEntitledIsNotReportedPendingthat sets the downstream Programmed and still expectsListenersNotValidupstream.
Follow-ups:
- A gateway that drops one non-entitled wildcard and one listener still waiting on its certificate now reports
ListenersNotValid, which hides the one that will clear. Fine as a default, but the condition message should name both.
kevwilliams
approved these changes
Nov 3, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
Verified moving the dropped-listener summary after the certificate service is what lets the not-entitled reason be seen, and the new tests cover both the status reason and the reconcile path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Scot Schuchert-Wells
When the only listener a gateway drops is a wildcard hostname the project is not entitled to, the gateway (and its HTTPProxy) reported Programmed=False with reason
Pending. Pending means a certificate is still being issued and will clear on its own, but this case never clears, so the proxy stays Pending indefinitely and looks like a stuck platform reconcile in the HTTPProxy programming metrics.It now reports
ListenersNotValid, matching the listener's own status. A listener waiting on a certificate that is actually being issued still reports Pending.Adds a case to the gateway status test that fails before the change.
Related: datum-cloud/enhancements#921