Skip to content

fix(gatewayapi): keep the parentRef port in route policy ancestors - #10334

Open
kkk777-7 wants to merge 8 commits into
envoyproxy:mainfrom
kkk777-7:fix/route-policy-ancestor-port
Open

kkk777-7 wants to merge 8 commits into
envoyproxy:mainfrom
kkk777-7:fix/route-policy-ancestor-port

Conversation

@kkk777-7

@kkk777-7 kkk777-7 commented Oct 20, 2026 •

Copy link
Copy Markdown
Member

Depends on #10315 , needs to rebase after merging #10315.

What this PR does / why we need it:

The ancestor that a route policy reports for a route parentRef keeps the parentRef's sectionName but not its port, and ancestorRefsEqual does not compare Port. So when a route has parentRefs to the same Gateway or ListenerSet that differ only by port, a policy targeting the route reports a single ancestor for all of them, although each parentRef attaches to different listeners. The route status already reports these parentRefs separately (#10004).

This PR keeps the parentRef's port in that ancestor, so each parentRef gets its own ancestor, as parentRefs that differ by sectionName already do.

Today the shared ancestor loses nothing, since without mergeType the same result goes to every ancestor, and with mergeType the merge results go on per-listener ancestors (#10314). With #10315, which reports the merge results on the parentRef's ancestor, each parentRef merges with the parent policy of its own listeners, so without this fix only the last parentRef's result would remain.

Which issue(s) this PR fixes:

Fixes #10333


PR Checklist

  • Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
  • DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
  • API agreed first: If this PR contains API changes (changes under /api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes.
  • Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
  • Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes.
  • Docs: User-facing changes update the docs, either in this PR or a follow-up PR. N/A if this PR does not contain user-facing changes.
  • Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes.
  • Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed.
  • Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
  • Codex review: Requested a Codex review and addressed all of its comments.
  • Copilot review: Requested a Copilot review and addressed all of its comments.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7
kkk777-7 requested a review from a team as a code owner October 20, 2026 09:42
@netlify

netlify Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name Link
🔨 Latest commit 05c9852
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6ae43bdc2db5a5caa3337a37
😎 Deploy Preview https://deploy-preview-10334--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T07:14:37.092466Z 05c9852 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ddc456c2a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread internal/gatewayapi/helpers.go Resolved
@codecov

codecov Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.20%. Comparing base (b02cef4) to head (05c9852).

Additional details and impacted files
@@           Coverage Diff           @@
##             main   #10334   +/-   ##
=======================================
  Coverage   82.20%   82.20%           
=======================================
  Files         277      277           
  Lines       44014    44019    +5     
=======================================
+ Hits        36181    36187    +6     
+ Misses       7832     7831    -1     
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…te ancestors

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7

Copy link
Copy Markdown
Member Author

@codex

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: e5c747d8e4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@kkk777-7

Copy link
Copy Markdown
Member Author

/retest

zirain
zirain previously approved these changes Oct 22, 2026
@zirain

zirain commented Oct 22, 2026

Copy link
Copy Markdown
Member

/retest

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1684ca0c1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7

Copy link
Copy Markdown
Member Author

@codex

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05c9852468

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

policyStatus := ExtServerPolicyStatusAsPolicyStatus(policy)
gatewayNN := utils.NamespacedName(gtwCtx)
ancestorRef := getAncestorRefForPolicy(gatewayNN, p.SectionName)
ancestorRef := parentRefCtx.PolicyAncestorRef()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Truncate extension-policy ancestors after splitting by port

When an extension-server policy (for example, via a target selector) covers 17 or more routes whose parentRefs select distinct ports, this port-preserving reference makes SetConditionForPolicyAncestor retain one ancestor per port. That setter intentionally allows 17 entries so a later TruncatePolicyAncestors call can add the Aggregated condition, but ProcessExtensionServerPolicies returns without the truncation performed by the typed policy processors; the emitted status can therefore exceed the Gateway API limit of 16 ancestors and be rejected by a policy CRD using the standard status schema. Truncate the converted unstructured policy statuses before returning them.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Route policy ancestors drop the parentRef's port, so parentRefs that differ only by port share one ancestor

3 participants