fix: XListenerSet allows route from same namespace by krishicks · Pull Request #8226 · envoyproxy/gateway

krishicks · 2026-02-09T17:37:29Z

What this PR does / why we need it:

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace.

All of the previous tests I saw for this included allowedRoutes .. All, so the bug wasn't clear.

This is the last reference to the listener's gateway's namespace that I found that isn't gated by an isFromXListenerSet() check, so maybe the end of this category of bug.

fixes: #8230

Release Notes: Yes

netlify · 2026-02-09T17:37:36Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`9ed5427`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/698a1c07db59d800081165b2

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com>

codecov · 2026-02-09T17:50:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.80%. Comparing base (5c2075b) to head (9ed5427).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8226      +/-   ##
==========================================
- Coverage   73.81%   73.80%   -0.02%     
==========================================
  Files         241      241              
  Lines       36608    36608              
==========================================
- Hits        27021    27017       -4     
- Misses       7681     7683       +2     
- Partials     1906     1908       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

krishicks · 2026-02-09T22:22:27Z

Looks like the one e2e test failure was maybe a flake given the other ones passed..?

zhaohuabing

LGTM thanks!

cnvergence

Thanks @krishicks!

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com>

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix up release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <youssef.rabie@procore.com> * polish Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <zirain2009@gmail.com> * remove skipped tests Signed-off-by: zirain <zirain2009@gmail.com> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix gen-check Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Kris Hicks <khicks@nvidia.com>

krishicks requested a review from a team as a code owner February 9, 2026 17:37

fix: XListenerSet allows route from same namespace

9ed5427

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com>

krishicks force-pushed the main branch from 50664c1 to 9ed5427 Compare February 9, 2026 17:40

zhaohuabing mentioned this pull request Feb 10, 2026

XListenerSet "allowedRoutes" matches against gateway's namespace, not XListenerSet namespace #8230

Closed

zhaohuabing approved these changes Feb 10, 2026

View reviewed changes

zhaohuabing added the cherrypick/release-v1.7.1 label Feb 10, 2026

zhaohuabing requested a review from a team February 10, 2026 07:56

cnvergence approved these changes Feb 10, 2026

View reviewed changes

cnvergence merged commit 017f4c3 into envoyproxy:main Feb 10, 2026
57 of 59 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: XListenerSet allows route from same namespace#8226

fix: XListenerSet allows route from same namespace#8226
cnvergence merged 1 commit intoenvoyproxy:mainfrom
krishicks:main

krishicks commented Feb 9, 2026 •

edited by zhaohuabing

Loading

netlify bot commented Feb 9, 2026 •

edited

Loading

codecov bot commented Feb 9, 2026 •

edited

Loading

krishicks commented Feb 9, 2026

zhaohuabing left a comment

cnvergence left a comment

Uh oh!

Labels

3 participants

Conversation

krishicks commented Feb 9, 2026 • edited by zhaohuabing Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

netlify bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

codecov bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

krishicks commented Feb 9, 2026

zhaohuabing left a comment

Choose a reason for hiding this comment

cnvergence left a comment

Choose a reason for hiding this comment

Uh oh!

Labels

3 participants

krishicks commented Feb 9, 2026 •

edited by zhaohuabing

Loading

netlify bot commented Feb 9, 2026 •

edited

Loading

codecov bot commented Feb 9, 2026 •

edited

Loading