bugfix: fix hpa/pdb deletion issue

charts/gateway-helm/templates/_rbac.tpl

@@ -226,6 +226,7 @@ verbs:
   verbs:
   - create
   - get
+  - list
   - delete
   - deletecollection
   - patch

internal/infrastructure/kubernetes/infra_resource.go

@@ -287,6 +287,29 @@
 		}
 	)
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplyTotal.WithSuccess(labels...).Increment()
+		} else {
+			resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
+		}
+
+		if pdb != nil {
+			deleteErr := i.Client.DeleteAllExcept(ctx, &policyv1.PodDisruptionBudgetList{}, client.ObjectKey{
+				Namespace: pdb.Namespace,
+				Name:      pdb.Name,
+			}, &client.ListOptions{
+				Namespace:     pdb.Namespace,
+				LabelSelector: r.LabelSelector(),
+			})
+			if deleteErr != nil {
+				i.logger.Error(deleteErr, "failed to delete all except PodDisruptionBudget",
+					"name", r.Name(), "namespace", r.Namespace())
+			}
+		}
+	}()
+
 	if pdb, err = r.PodDisruptionBudget(); err != nil {
 		resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
 		return err
@@ -298,15 +321,6 @@
 		return i.deletePDB(ctx, r)
 	}
 
-	defer func() {
-		if err == nil {
-			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
-			resourceApplyTotal.WithSuccess(labels...).Increment()
-		} else {
-			resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
-		}
-	}()
-
 	return i.Client.ServerSideApply(ctx, pdb)
 }
 
@@ -324,8 +338,30 @@
 		}
 	)
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplyTotal.WithSuccess(labels...).Increment()
+		} else {
+			resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
+		}
+
+		if hpa != nil {
+			deleteErr := i.Client.DeleteAllExcept(ctx, &autoscalingv2.HorizontalPodAutoscalerList{}, client.ObjectKey{
+				Namespace: hpa.Namespace,
+				Name:      hpa.Name,
+			}, &client.ListOptions{
+				Namespace:     hpa.Namespace,
+				LabelSelector: r.LabelSelector(),
+			})
+			if deleteErr != nil {
+				i.logger.Error(deleteErr, "failed to delete all except HorizontalPodAutoscaler",
+					"name", r.Name(), "namespace", r.Namespace())
+			}
+		}
+	}()
+
 	if hpa, err = r.HorizontalPodAutoscaler(); err != nil {
-		resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
 		return err
 	}
 
@@ -335,15 +371,6 @@
 		return i.deleteHPA(ctx, r)
 	}
 
-	defer func() {
-		if err == nil {
-			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
-			resourceApplyTotal.WithSuccess(labels...).Increment()
-		} else {
-			resourceApplyTotal.WithFailure(metrics.ReasonError, labels...).Increment()
-		}
-	}()
-
 	return i.Client.ServerSideApply(ctx, hpa)
 }
 

internal/infrastructure/kubernetes/proxy/resource_provider.go

@@ -535,6 +535,8 @@ func (r *ResourceRender) PodDisruptionBudget() (*policyv1.PodDisruptionBudget, e
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:       r.Namespace(),
 			OwnerReferences: r.OwnerReferences(),
+			Annotations:     r.infra.GetProxyMetadata().Annotations,
+			Labels:          r.stableSelector().MatchLabels,
 		},
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "policy/v1",
@@ -577,7 +579,7 @@ func (r *ResourceRender) HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPod
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:       r.Namespace(),
 			Annotations:     r.infra.GetProxyMetadata().Annotations,
-			Labels:          r.infra.GetProxyMetadata().Labels,
+			Labels:          r.stableSelector().MatchLabels,
 			OwnerReferences: r.OwnerReferences(),
 		},
 		Spec: autoscalingv2.HorizontalPodAutoscalerSpec{

internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/hpa.yaml

@@ -3,8 +3,12 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: gateway-1
     gateway.envoyproxy.io/owning-gateway-namespace: namespace-1
+    gateway.networking.k8s.io/gateway-name: gateway-1
   name: gateway-1
   namespace: namespace-1
   ownerReferences:
@@ -35,8 +39,12 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: gateway-2
     gateway.envoyproxy.io/owning-gateway-namespace: namespace-2
+    gateway.networking.k8s.io/gateway-name: gateway-2
   name: gateway-2
   namespace: namespace-2
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1

internal/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1

internal/infrastructure/kubernetes/proxy/testdata/hpa/gateway-namespace-mode.yaml

@@ -3,8 +3,12 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: gateway-1
     gateway.envoyproxy.io/owning-gateway-namespace: ns1
+    gateway.networking.k8s.io/gateway-name: gateway-1
   name: gateway-1
   namespace: ns1
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/hpa/patch-json-hpa.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: foo

internal/infrastructure/kubernetes/proxy/testdata/hpa/patch-strategic-hpa.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: foo

internal/infrastructure/kubernetes/proxy/testdata/hpa/with-deployment-name.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1

internal/infrastructure/kubernetes/proxy/testdata/hpa/with-name.yaml

@@ -3,6 +3,9 @@ kind: HorizontalPodAutoscaler
 metadata:
   creationTimestamp: null
   labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
     gateway.envoyproxy.io/owning-gateway-name: default
     gateway.envoyproxy.io/owning-gateway-namespace: default
   name: custom-hpa-name

internal/infrastructure/kubernetes/proxy/testdata/pdb/default.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/gateway-namespace-mode.yaml

@@ -2,6 +2,13 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: gateway-1
+    gateway.envoyproxy.io/owning-gateway-namespace: ns1
+    gateway.networking.k8s.io/gateway-name: gateway-1
   name: gateway-1
   namespace: ns1
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/max-unavailable-percent.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/max-unavailable.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/min-available-percent.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: envoy-default-37a8eec1
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/patch-json-pdb.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: foo
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/patch-pdb-no-minmax.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: foo
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/patch-strategic-pdb.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: foo
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy/testdata/pdb/with-name.yaml

@@ -2,6 +2,12 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    gateway.envoyproxy.io/owning-gateway-name: default
+    gateway.envoyproxy.io/owning-gateway-namespace: default
   name: custom-pdb-name
   namespace: envoy-gateway-system
   ownerReferences:

internal/infrastructure/kubernetes/proxy_infra_test.go

@@ -20,6 +20,8 @@ import (
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
@@ -123,13 +125,34 @@ func TestCreateProxyInfra(t *testing.T) {
 	// Infra with Gateway owner labels.
 	infraWithLabels := infra.DeepCopy()
 	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels = proxy.EnvoyAppLabel()
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayClassLabel] = "testGatewayClass"
 	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
 	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = "test-gw"
 	infraWithLabels.GetProxyInfra().GetProxyMetadata().OwnerReference = &ir.ResourceMetadata{
 		Kind: resource.KindGateway,
 		Name: testGatewayClass,
 	}
 
+	ep := &egv1a1.EnvoyProxy{
+		Spec: egv1a1.EnvoyProxySpec{
+			Provider: &egv1a1.EnvoyProxyProvider{
+				Type:       egv1a1.ProviderTypeKubernetes,
+				Kubernetes: egv1a1.DefaultEnvoyProxyKubeProvider(),
+			},
+		},
+	}
+	infraWithPDB := infraWithLabels.DeepCopy()
+	infraWithPDB.GetProxyInfra().Config = ep.DeepCopy()
+	infraWithPDB.GetProxyInfra().Config.Spec.Provider.Kubernetes.EnvoyPDB = &egv1a1.KubernetesPodDisruptionBudgetSpec{
+		MinAvailable: ptr.To(intstr.IntOrString{Type: intstr.Int, IntVal: 1}),
+	}
+
+	infraWithHPA := infraWithLabels.DeepCopy()
+	infraWithHPA.GetProxyInfra().Config = ep.DeepCopy()
+	infraWithHPA.GetProxyInfra().Config.Spec.Provider.Kubernetes.EnvoyHpa = &egv1a1.KubernetesHorizontalPodAutoscalerSpec{
+		MinReplicas: ptr.To[int32](1),
+	}
+
 	testCases := []struct {
 		name   string
 		in     *ir.Infra
@@ -157,6 +180,16 @@ func TestCreateProxyInfra(t *testing.T) {
 			},
 			expect: false,
 		},
+		{
+			name:   "pdb enabled",
+			in:     infraWithPDB,
+			expect: true,
+		},
+		{
+			name:   "hpa enabled",
+			in:     infraWithHPA,
+			expect: true,
+		},
 	}
 
 	for _, tc := range testCases {