Skip to content

fix: oidc authentication endpoint was overwritten by discovered value#7460

Merged
zhaohuabing merged 4 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-7459
Nov 28, 2025
Merged

fix: oidc authentication endpoint was overwritten by discovered value#7460
zhaohuabing merged 4 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-7459

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Nov 10, 2025

fixes: #7459

@zhaohuabing zhaohuabing requested a review from a team as a code owner November 10, 2025 03:42
@codecov
Copy link
Copy Markdown

codecov bot commented Nov 10, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 64.70588% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.33%. Comparing base (ba8e0e2) to head (39f7094).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
internal/gatewayapi/securitypolicy.go 64.70% 2 Missing and 4 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #7460      +/-   ##
==========================================
+ Coverage   72.30%   72.33%   +0.02%     
==========================================
  Files         232      232              
  Lines       34117    34130      +13     
==========================================
+ Hits        24669    24687      +18     
+ Misses       7674     7669       -5     
  Partials     1774     1774

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zhaohuabing zhaohuabing changed the title fix: oid authentication endpoint was overwritten by discovered value fix: oidc authentication endpoint was overwritten by discovered value Nov 10, 2025
@zhaohuabing
fix: oid authentication endpoint was overriden by discovered value
4e67e7d 
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
@zhaohuabing
Merge branch 'main' into fix-7459
b60bb06 
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
@zhaohuabing
Merge branch 'main' into fix-7459
7adacc2 
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
arkodg
arkodg approved these changes Nov 26, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

@arkodg arkodg requested review from a team November 26, 2025 22:33
@zhaohuabing zhaohuabing merged commit 50dcb15 into envoyproxy:main Nov 28, 2025
53 of 55 checks passed
@zhaohuabing zhaohuabing deleted the fix-7459 branch November 28, 2025 04:11
zhaohuabing added a commit to zhaohuabing/gateway that referenced this pull request Dec 5, 2025
@zhaohuabing
fix: oidc authentication endpoint was overwritten by discovered value (…
0b82736 
…envoyproxy#7460)

fix: oid authentication endpoint was overriden by discovered value

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
(cherry picked from commit 50dcb15)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
@zhaohuabing zhaohuabing mentioned this pull request Dec 5, 2025
Closed
jukie pushed a commit to jukie/gateway that referenced this pull request Dec 5, 2025
@zhaohuabing @jukie
fix: oidc authentication endpoint was overwritten by discovered value (…
5ced175 
…envoyproxy#7460)

fix: oid authentication endpoint was overriden by discovered value

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>
jukie added a commit that referenced this pull request Dec 5, 2025
@jukie @Hackzzila
@zhaohuabing @shreealt @woodgear @zirain @sudiptob2 @rajsinghtech
[release-1.5] cherry-pick for v1.5.6 (#7665)
e5f2588 
* fix(xds-server): clear snapshot on stream close (#6618)

* fix(xds-server): clear snapshot on stream close

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>

* check if there are other active connections before clearning the snapshot

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* fix: oidc authentication endpoint was overwritten by discovered value (#7460)

fix: oid authentication endpoint was overriden by discovered value

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* ci: add script to free disk space (#7534)

* feat: free disk space

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* lint

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* cleanup

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* make target and tools/hack

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* lint

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* modular action

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

---------

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* treat too many addresses as programmed (#7542)

Signed-off-by: cong <q1875486458@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* feat: reclaim space in release pipeline (#7587)

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* chore: bump golang.org/x/crypto (#7588)

* chore: bump golang.org/x/crypto

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* findOwningGateway should return controller based on linked GatewayClass (#7611)

* fix: filter Gateway by controller in findOwningGateway

Prevent cross-controller Gateway mutations by validating GatewayClass

Signed-off-by: Sudipto Baral <sudiptobaral.me@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* fix: use default when namespace is unset (#7612)

* fix: use default when namespace is unset

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix test

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* fix: prevent skeleton route status entries for unmanaged GatewayClasses (#7536)

* fix: prevent skeleton route status entries for unmanaged GatewayClasses

When processing policies (EnvoyExtensionPolicy, SecurityPolicy), the translator
was calling GetRouteParentContext for ALL parentRefs in a route, even those
referencing gateways with different GatewayClasses not managed by this translator.

GetRouteParentContext creates a skeleton RouteParentStatus entry with just the
controllerName when called on a parentRef that hasn't been processed yet. Since
all GatewayClass instances share the same controller name, these skeleton entries
persisted in status without conditions.

The fix checks if a parentRef context already exists before attempting to apply
policy configuration to it. If the context doesn't exist, it means this parentRef
wasn't processed by this translator and should be skipped.

Signed-off-by: Raj Singh <raj@tailscale.com>

* fix: also prevent skeleton entries in BackendTrafficPolicy processing

The same issue exists in BackendTrafficPolicy route processing - calling
GetRouteParentContext for all parentRefs creates skeleton status entries.

Apply the same fix: check if parentRef context exists before adding to list.

Signed-off-by: Raj Singh <raj@tailscale.com>

---------

Signed-off-by: Raj Singh <raj@tailscale.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

* lint

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

---------

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>
Signed-off-by: cong <q1875486458@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Sudipto Baral <sudiptobaral.me@gmail.com>
Signed-off-by: Raj Singh <raj@tailscale.com>
Co-authored-by: Zach Vacura <zach@hackzzila.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: shreealt <shreemaanabhishek@apache.org>
Co-authored-by: 聪 <q1875486458@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: Sudipto Baral <sudiptobaral.me@gmail.com>
Co-authored-by: Raj Singh <raj@tailscale.com>
zhaohuabing added a commit that referenced this pull request Dec 5, 2025
@zhaohuabing @rajsinghtech
@woodgear @zirain @sudiptob2 @shreealt
[release-1.6] cherry-pick for v1.6.1 (#7664)
bd8cc04 
* fix: oidc authentication endpoint was overwritten by discovered value (#7460)

fix: oid authentication endpoint was overriden by discovered value

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
(cherry picked from commit 50dcb15)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix: do not return 500 for all requests when part of BackendRefs are invalid (#7488)

* do not return 500 for all requests when part of BackendRefs are invalid

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
(cherry picked from commit 2899416)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix: prevent skeleton route status entries for unmanaged GatewayClasses (#7536)

* fix: prevent skeleton route status entries for unmanaged GatewayClasses

When processing policies (EnvoyExtensionPolicy, SecurityPolicy), the translator
was calling GetRouteParentContext for ALL parentRefs in a route, even those
referencing gateways with different GatewayClasses not managed by this translator.

GetRouteParentContext creates a skeleton RouteParentStatus entry with just the
controllerName when called on a parentRef that hasn't been processed yet. Since
all GatewayClass instances share the same controller name, these skeleton entries
persisted in status without conditions.

The fix checks if a parentRef context already exists before attempting to apply
policy configuration to it. If the context doesn't exist, it means this parentRef
wasn't processed by this translator and should be skipped.

Signed-off-by: Raj Singh <raj@tailscale.com>

* fix: also prevent skeleton entries in BackendTrafficPolicy processing

The same issue exists in BackendTrafficPolicy route processing - calling
GetRouteParentContext for all parentRefs creates skeleton status entries.

Apply the same fix: check if parentRef context exists before adding to list.

Signed-off-by: Raj Singh <raj@tailscale.com>

---------

Signed-off-by: Raj Singh <raj@tailscale.com>
(cherry picked from commit ff13742)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* treat too many addresses as programmed (#7542)

Signed-off-by: cong <q1875486458@gmail.com>
(cherry picked from commit 7cb5f72)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* bechmark: fix cpu sampling (#7581)

use fixed duration for cpu rate

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
(cherry picked from commit 536486f)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* chore: bump golang.org/x/crypto (#7588)

* chore: bump golang.org/x/crypto

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 70fa59a)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* findOwningGateway should return controller based on linked GatewayClass (#7611)

* fix: filter Gateway by controller in findOwningGateway

Prevent cross-controller Gateway mutations by validating GatewayClass

Signed-off-by: Sudipto Baral <sudiptobaral.me@gmail.com>
(cherry picked from commit ba8e0e2)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix: use default when namespace is unset (#7612)

* fix: use default when namespace is unset

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

* fix test

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit be2cc73)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* bump Gateway API v1.4.1 (#7653)

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 0fa26d7)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* update release note

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix gen check

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* ci: add script to free disk space (#7534)

* feat: free disk space

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* lint

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* cleanup

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* make target and tools/hack

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* lint

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

* modular action

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

---------

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>
(cherry picked from commit 4312f38)
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Raj Singh <raj@tailscale.com>
Signed-off-by: cong <q1875486458@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Sudipto Baral <sudiptobaral.me@gmail.com>
Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>
Co-authored-by: Raj Singh <raj@tailscale.com>
Co-authored-by: 聪 <q1875486458@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: Sudipto Baral <sudiptobaral.me@gmail.com>
Co-authored-by: shreealt <shreemaanabhishek@apache.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zirain zirain zirain approved these changes

@arkodg arkodg arkodg approved these changes

Assignees

No one assigned

Labels

cherrypick/release-v1.5.6 cherrypick/release-v1.6.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

SecurityPolicy oidc.provider.authorizationEndpoint ineffective without tokenEndpoint

3 participants

@zhaohuabing @zirain @arkodg