fix: watch change for the ca cert in the Backend #7294

zhaohuabing · 2025-10-21T09:01:41Z

Fixes the missing watch for ca cert in the Backend resource.

Release Notes: No

codecov · 2025-10-21T09:16:18Z

Codecov Report

❌ Patch coverage is 70.37037% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.97%. Comparing base (650fd83) to head (9b0c043).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/predicates.go	70.37%	6 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7294      +/-   ##
==========================================
+ Coverage   70.94%   70.97%   +0.03%     
==========================================
  Files         229      229              
  Lines       41071    41098      +27     
==========================================
+ Hits        29137    29170      +33     
+ Misses      10216    10205      -11     
- Partials     1718     1723       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg

LGTM thanks

Signed-off-by: Huabing Zhao <[email protected]>

zirain · 2025-10-21T23:16:28Z

internal/provider/kubernetes/predicates.go

 		}
 	}

+	if r.backendCRDExists {


Does the same problem exist for configmap/clustertrustebundle?

Ah we need to do this for cluster trust bundle as well, good catch

It's already handled here?

gateway/internal/provider/kubernetes/predicates.go

Lines 187 to 207 in 650fd83

func (r *gatewayAPIReconciler) validateClusterTrustBundleForReconcile(ctb *certificatesv1b1.ClusterTrustBundle) bool {

if !r.backendAPIDisabled() {

if r.isBackendReferencingClusterTrustBundle(ctb) {

return true

}

}

if r.bTLSPolicyCRDExists {

if r.isBackendTLSPolicyReferencingClusterTrustBundle(ctb) {

return true

}

}

if r.ctpCRDExists {

if r.isCtpReferencingClusterTrustBundle(ctb) {

return true

}

}

return false

}

looks like we missed for ConfigMap?

ConfigMap has also been handled in this PR #7294 (comment)

zirain · 2025-10-22T00:32:35Z

/retest

Signed-off-by: Huabing Zhao <[email protected]>

zhaohuabing · 2025-10-22T02:22:23Z

internal/provider/kubernetes/predicates.go

 		}
 	}

+	if !r.backendAPIDisabled() {


@arkodg @zirain configMap has been handled here.

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Lin Moskovitch <[email protected]>

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: EkLine AI <[email protected]>

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]>

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: zirain <[email protected]>

* fix: bug in overlap detection of cert SANs (#7234) Signed-off-by: zirain <[email protected]> * fix(translator): Fix panic with request mirror + grpcroute (#6875) Signed-off-by: Andrew Moreland <[email protected]> Signed-off-by: zirain <[email protected]> * fix: watch change for the ca cert in the Backend (#7294) * watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * fix ipFamily not set in UDPListener (#7313) fix: set ipfamily in udpistener (#7312) Signed-off-by: cong <[email protected]> Signed-off-by: zirain <[email protected]> * coalesce updates to reduce intermediate updates (#7328) * coalesce updates to reduce redundant processing in subscription handler Signed-off-by: Huabing Zhao <[email protected]> * retain order Signed-off-by: Huabing Zhao <[email protected]> * keep intermediate delete updates Signed-off-by: Huabing Zhao <[email protected]> * minor wording Signed-off-by: Huabing Zhao <[email protected]> * treat delete as normal operations Signed-off-by: Huabing Zhao <[email protected]> * retain the original order of the last updates for each key Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * fix: port typo (#7397) Signed-off-by: cong <[email protected]> Signed-off-by: zirain <[email protected]> * fix: validate EnvoyGateway configuration before reload (#7412) Signed-off-by: zirain <[email protected]> * fix: missing jwt provider when jwt is configured on multiple listeners sharing the same port (#7337) * fix jwt provider missing when jwt is configured at multiple ir listeners Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * fix: memory leak (#7429) Fix memory leak. Two watchable.Maps were never closed when shutting down the provider: - GatewayClassStatuses.Close() - missing in GatewayAPIStatuses.Close() - BackendTrafficPolicyStatuses.Close() - missing in PolicyStatuses.Close() Each unclosed map leaked 3 goroutines: 1. Internal watchable.Map.coalesce goroutine 2. HandleSubscription goroutine blocked on channel read 3. Error handler goroutine blocked on channel read Signed-off-by: Gonzalo Serrano <[email protected]> Signed-off-by: zirain <[email protected]> * fix gen after cherry-pick Signed-off-by: zirain <[email protected]> * fix watchutil test Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Andrew Moreland <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: cong <[email protected]> Signed-off-by: Gonzalo Serrano <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: Andrew Moreland <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: 聪 <[email protected]> Co-authored-by: Gonzalo Serrano <[email protected]>

zhaohuabing requested a review from a team as a code owner October 21, 2025 09:01

zhaohuabing force-pushed the fix-backend-ca-watch branch from 2576f09 to 2fa9750 Compare October 21, 2025 09:06

zhaohuabing changed the title ~~chore: watch change for the ca cert in the Backend~~ fix: watch change for the ca cert in the Backend Oct 21, 2025

arkodg previously approved these changes Oct 21, 2025

View reviewed changes

arkodg requested review from a team October 21, 2025 17:05

arkodg added the cherrypick/release-v1.5.5 label Oct 21, 2025

watch change for the ca cert in the Backend

1c223e6

Signed-off-by: Huabing Zhao <[email protected]>

zirain force-pushed the fix-backend-ca-watch branch from 2fa9750 to 1c223e6 Compare October 21, 2025 23:15

zirain approved these changes Oct 21, 2025

View reviewed changes

zirain reviewed Oct 21, 2025

View reviewed changes

zirain previously approved these changes Oct 21, 2025

View reviewed changes

zirain enabled auto-merge (squash) October 21, 2025 23:16

zirain mentioned this pull request Oct 22, 2025

Does the same problem exist for configmap/clustertrustebundle? #7297

Closed

check if backend API is enabled

9b0c043

Signed-off-by: Huabing Zhao <[email protected]>

zhaohuabing dismissed stale reviews from zirain and arkodg via 9b0c043 October 22, 2025 01:05

zhaohuabing requested review from arkodg and zirain October 22, 2025 01:06

zhaohuabing commented Oct 22, 2025

View reviewed changes

zirain approved these changes Oct 22, 2025

View reviewed changes

arkodg approved these changes Oct 22, 2025

View reviewed changes

arkodg disabled auto-merge October 22, 2025 03:13

arkodg merged commit d307304 into envoyproxy:main Oct 22, 2025
48 of 53 checks passed

zhaohuabing deleted the fix-backend-ca-watch branch October 22, 2025 04:45

zirain pushed a commit to zirain/gateway that referenced this pull request Nov 14, 2025

fix: watch change for the ca cert in the Backend (envoyproxy#7294)

bfe6f91

* watch change for the ca cert in the Backend Signed-off-by: Huabing Zhao <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: watch change for the ca cert in the Backend #7294

fix: watch change for the ca cert in the Backend #7294

zhaohuabing commented Oct 21, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 21, 2025 •

edited

Loading

Uh oh!

arkodg left a comment

Uh oh!

zirain Oct 21, 2025

Uh oh!

arkodg Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 •

edited

Loading

Uh oh!

zirain Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025

Uh oh!

zirain commented Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	func (r gatewayAPIReconciler) validateClusterTrustBundleForReconcile(ctb certificatesv1b1.ClusterTrustBundle) bool {
	if !r.backendAPIDisabled() {
	if r.isBackendReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	if r.bTLSPolicyCRDExists {
	if r.isBackendTLSPolicyReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	if r.ctpCRDExists {
	if r.isCtpReferencingClusterTrustBundle(ctb) {
	return true
	}
	}

	return false
	}

fix: watch change for the ca cert in the Backend #7294

fix: watch change for the ca cert in the Backend #7294

Conversation

zhaohuabing commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

zirain Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

arkodg Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

zirain commented Oct 22, 2025

Uh oh!

zhaohuabing Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zhaohuabing commented Oct 21, 2025 •

edited

Loading

codecov bot commented Oct 21, 2025 •

edited

Loading

zhaohuabing Oct 22, 2025 •

edited

Loading

zhaohuabing Oct 22, 2025 •

edited

Loading