Skip to content

fix: exclude unmanaged route parents from xPolicy status ancestors#8321

Merged
cnvergence merged 3 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-policy-status-mixed-parents
Feb 24, 2026
Merged

fix: exclude unmanaged route parents from xPolicy status ancestors#8321
cnvergence merged 3 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-policy-status-mixed-parents

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Feb 22, 2026

This PR fixes xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs.

When an HTTPRoute has both:

  • a parent Gateway managed by Envoy Gateway, and
  • a parent Gateway from a different GatewayClass,

xPolicy.status.ancestors should only include the Envoy Gateway-managed parent(s).
Before this change, unmanaged parents could appear in xPolicy.status.ancestors.

Example:

Given:

  • managed-gateway with gatewayClassName: envoy-gateway-class
  • unmanaged-gateway with gatewayClassName: other-gateway-class
  • HTTPRoute mixed-parents-route with both parentRefs
  • SecurityPolicy route-policy targeting mixed-parents-route

Before this PR, SecurityPolicy.status.ancestors could include both gateways:

status:
  ancestors:
  - ancestorRef:
      name: managed-gateway
      kind: Gateway
      group: gateway.networking.k8s.io
      namespace: default
      sectionName: http
  - ancestorRef:
      name: unmanaged-gateway
      kind: Gateway
      group: gateway.networking.k8s.io
      namespace: default
      sectionName: http

After this PR, only EG-managed ancestors are reported:

  status:
    ancestors:
    - ancestorRef:
        name: managed-gateway
        kind: Gateway
        group: gateway.networking.k8s.io
        namespace: default
        sectionName: http

Fixes: #8320

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zhaohuabing zhaohuabing requested a review from a team as a code owner February 22, 2026 15:26
@zhaohuabing zhaohuabing marked this pull request as draft February 22, 2026 15:27
@netlify
Copy link
Copy Markdown

netlify bot commented Feb 22, 2026

Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit d5ea0a4
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/699bafecef762e0008dd0d69
@zhaohuabing zhaohuabing changed the title add test for mixed managed and unmanaged Gateway parents Feb 22, 2026
@zhaohuabing zhaohuabing changed the title Fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs. Feb 22, 2026
@zhaohuabing zhaohuabing changed the title fix: xPolicy route-target status ancestors for mixed managed and unmanaged parentRefs. Feb 22, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 22, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.67%. Comparing base (7031394) to head (d5ea0a4).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8321      +/-   ##
==========================================
+ Coverage   73.66%   73.67%   +0.01%     
==========================================
  Files         242      242              
  Lines       37007    37014       +7     
==========================================
+ Hits        27261    27270       +9     
  Misses       7826     7826              
+ Partials     1920     1918       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: unmanaged-gateway
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The unmanaged-gateway should not be in status.

…nged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zhaohuabing zhaohuabing force-pushed the fix-policy-status-mixed-parents branch from 00d163f to d347e43 Compare February 22, 2026 15:57
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zhaohuabing zhaohuabing force-pushed the fix-policy-status-mixed-parents branch from 6ec20c0 to d5ea0a4 Compare February 23, 2026 01:39
@zhaohuabing zhaohuabing marked this pull request as ready for review February 23, 2026 01:45
@zhaohuabing zhaohuabing requested a review from arkodg February 23, 2026 03:13
@kkk777-7
Copy link
Copy Markdown
Member

LGTM, thanks!

@cnvergence cnvergence merged commit 26fa4e6 into envoyproxy:main Feb 24, 2026
57 of 59 checks passed
@zhaohuabing zhaohuabing deleted the fix-policy-status-mixed-parents branch March 2, 2026 05:16
antonio-mazzini pushed a commit to antonio-mazzini/gateway that referenced this pull request Mar 5, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
jukie pushed a commit that referenced this pull request Mar 12, 2026
* api: make ConnectionLimit.Value optional (#8478)

* api: make ConnectionLimit.Value optional

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* release-notes: add entry for ConnectionLimit.Value optional

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* fix: add CEL rule to require value when closeDelay is set

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix up release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387)

* fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner

Signed-off-by: y-rabie <youssef.rabie@procore.com>

* polish

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add e2e test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* truncate policy status & add tests

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: active health check respect endpoint hostname (#8452)

revert unrelated changes

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: exclude unmanaged route parents from xPolicy status ancestors (#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358)

Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: computeHosts doesn't work when listener and route both wildcard  (#8186)

* fix: computeHosts doesn't work when listener and route both wildcard

Signed-off-by: zirain <zirain2009@gmail.com>

* remove skipped tests

Signed-off-by: zirain <zirain2009@gmail.com>

* Update internal/gatewayapi/helpers.go

Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: XListenerSet allows route from same namespace (#8226)

Previously, using allowedRoutes/Same for an XListenerSet with an xRoute
in the same namespace would return an error. Now it properly allows
xRoutes from the same namespace.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: API key auth (#8267)

* add test for multiple keys

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* revert secret transform

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix gen-check

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes for envoy proxy image

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Kris Hicks <khicks@nvidia.com>
Co-authored-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: y-rabie <youssef.rabie@procore.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Co-authored-by: Kris Hicks <khicks@nvidia.com>
rudrakhp pushed a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
rudrakhp pushed a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
rudrakhp pushed a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
rudrakhp pushed a commit to rudrakhp/gateway that referenced this pull request Mar 12, 2026
…nvoyproxy#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
rudrakhp added a commit that referenced this pull request Mar 12, 2026
* fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: exclude unmanaged route parents from xPolicy status ancestors (#8321)

* add test for mixed managed and unmanaged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix the policy status when the targeting routes have managed and unmanged Gateway parents

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: computeHosts doesn't work when listener and route both wildcard  (#8186)

* fix: computeHosts doesn't work when listener and route both wildcard

Signed-off-by: zirain <zirain2009@gmail.com>

* remove skipped tests

Signed-off-by: zirain <zirain2009@gmail.com>

* Update internal/gatewayapi/helpers.go

Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387)

* fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner

Signed-off-by: y-rabie <youssef.rabie@procore.com>

* polish

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add e2e test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* truncate policy status & add tests

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358)

Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* api: make ConnectionLimit.Value optional (#8478)

* api: make ConnectionLimit.Value optional

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* release-notes: add entry for ConnectionLimit.Value optional

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* fix: add CEL rule to require value when closeDelay is set

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix test race (#8180)

* fix test race

Signed-off-by: zirain <zirain2009@gmail.com>

* use io.Discard

Signed-off-by: zirain <zirain2009@gmail.com>

* use sync.WaitGroup

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix gen check

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

---------

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: y-rabie <youssef.rabie@procore.com>
Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com>
Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: y-rabie <youssef.rabie@procore.com>
Co-authored-by: Teja079 <117351771+Teja079@users.noreply.github.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment