refactor: convert IR map fields to slices to ensure deterministic Dee…

internal/gatewayapi/backendtrafficpolicy.go

@@ -952,10 +952,41 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy) (
 		RequestBuffer:     rb,
 		Compression:       cp,
 		HTTPUpgrade:       httpUpgrade,
-		Telemetry:         policy.Spec.Telemetry,
+		Telemetry:         buildBackendTelemetry(policy.Spec.Telemetry),
 	}, errs
 }
 
+func buildBackendTelemetry(telemetry *egv1a1.BackendTelemetry) *ir.BackendTelemetry {
+	if telemetry == nil {
+		return nil
+	}
+	return &ir.BackendTelemetry{
+		Tracing: buildBackendTracing(telemetry.Tracing),
+		Metrics: buildBackendMetrics(telemetry.Metrics),
+	}
+}
+
+func buildBackendTracing(tracing *egv1a1.Tracing) *ir.BackendTracing {
+	if tracing == nil {
+		return nil
+	}
+	return &ir.BackendTracing{
+		SamplingFraction: tracing.SamplingFraction,
+		CustomTags:       ir.CustomTagMapToSlice(tracing.CustomTags),
+		Tags:             ir.MapToSlice(tracing.Tags),
+		SpanName:         tracing.SpanName,
+	}
+}
+
+func buildBackendMetrics(metrics *egv1a1.BackendMetrics) *ir.BackendMetrics {
+	if metrics == nil {
+		return nil
+	}
+	return &ir.BackendMetrics{
+		RouteStatName: metrics.RouteStatName,
+	}
+}
+
 func (t *Translator) translateBackendTrafficPolicyForGateway(
 	policy *egv1a1.BackendTrafficPolicy, target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
 	gateway *GatewayContext, xdsIR resource.XdsIRMap,

internal/gatewayapi/listener.go

@@ -442,7 +442,7 @@ func buildListenerMetadata(listener *ListenerContext, gateway *GatewayContext) *
 		Kind:        gateway.GetObjectKind().GroupVersionKind().Kind,
 		Name:        gateway.GetName(),
 		Namespace:   gateway.GetNamespace(),
-		Annotations: filterEGPrefix(gateway.GetAnnotations()),
+		Annotations: ir.MapToSlice(filterEGPrefix(gateway.GetAnnotations())),
 		SectionName: string(listener.Name),
 	}
 }
@@ -585,7 +585,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 
 		if len(accessLog.Sinks) == 0 {
 			al := &ir.JSONAccessLog{
-				JSON:       format.JSON,
+				JSON:       ir.MapToSlice(format.JSON),
 				CELMatches: validExprs,
 				LogType:    accessLogType,
 				Path:       "/dev/stdout",
@@ -611,7 +611,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 				} else {
 					// Default to JSON format if type is nil or JSON
 					al := &ir.JSONAccessLog{
-						JSON:       format.JSON,
+						JSON:       ir.MapToSlice(format.JSON),
 						Path:       sink.File.Path,
 						CELMatches: validExprs,
 						LogType:    accessLogType,
@@ -668,7 +668,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 					al.Text = format.Text
 				} else {
 					// Default to JSON format if type is nil or JSON
-					al.Attributes = format.JSON
+					al.Attributes = ir.MapToSlice(format.JSON)
 				}
 
 				irAccessLog.ALS = append(irAccessLog.ALS, al)
@@ -691,7 +691,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 
 				al := &ir.OpenTelemetryAccessLog{
 					CELMatches:         validExprs,
-					ResourceAttributes: sink.OpenTelemetry.GetResourceAttributes(),
+					ResourceAttributes: ir.MapToSlice(sink.OpenTelemetry.GetResourceAttributes()),
 					Headers:            sink.OpenTelemetry.Headers,
 					Authority:          getAuthorityFromDestination(ds),
 					Destination: ir.RouteDestination{
@@ -720,7 +720,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 					al.Text = format.Text
 				}
 				if format.Type == nil || *format.Type == egv1a1.ProxyAccessLogFormatTypeJSON {
-					al.Attributes = format.JSON
+					al.Attributes = ir.MapToSlice(format.JSON)
 				}
 
 				irAccessLog.OpenTelemetry = append(irAccessLog.OpenTelemetry, al)
@@ -782,9 +782,9 @@ func (t *Translator) processTracing(gw *gwapiv1.Gateway, envoyproxy *egv1a1.Envo
 		Authority:          authority,
 		ServiceName:        serviceName,
 		SamplingRate:       proxySamplingRate(tracing),
-		CustomTags:         tracing.CustomTags,
-		Tags:               tracing.Tags,
-		ResourceAttributes: getOpenTelemetryTracingResourceAttributes(&tracing.Provider),
+		CustomTags:         ir.CustomTagMapToSlice(tracing.CustomTags),
+		Tags:               ir.MapToSlice(tracing.Tags),
+		ResourceAttributes: ir.MapToSlice(getOpenTelemetryTracingResourceAttributes(&tracing.Provider)),
 		Destination: ir.RouteDestination{
 			Name:     destName,
 			Settings: ds,

internal/gatewayapi/listener_test.go

@@ -993,7 +993,7 @@ func TestProcessAccessLog(t *testing.T) {
 			expected: &ir.AccessLog{
 				JSON: []*ir.JSONAccessLog{
 					{
-						JSON: map[string]string{"start_time": "%START_TIME%"},
+						JSON: []ir.MapEntry{{Key: "start_time", Value: "%START_TIME%"}},
 						Path: "/dev/stdout",
 					},
 				},

internal/gatewayapi/route.go

@@ -1305,7 +1305,7 @@ func buildResourceMetadata(resource client.Object, sectionName *gwapiv1.SectionN
 		Kind:        resource.GetObjectKind().GroupVersionKind().Kind,
 		Name:        resource.GetName(),
 		Namespace:   resource.GetNamespace(),
-		Annotations: filterEGPrefix(resource.GetAnnotations()),
+		Annotations: ir.MapToSlice(filterEGPrefix(resource.GetAnnotations())),
 	}
 	if sectionName != nil {
 		metadata.SectionName = string(*sectionName)

internal/gatewayapi/testdata/accesslog-als-backend.out.yaml

@@ -190,7 +190,8 @@ xdsIR:
             name: accesslog_otel_0_0/backend/-1
             protocol: GRPC
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
     globalResources:

internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml

@@ -354,7 +354,8 @@ xdsIR:
             name: accesslog_otel_0_1/backend/-1
             protocol: GRPC
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         traffic:

internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml

@@ -232,16 +232,19 @@ xdsIR:
           telemetry:
             tracing:
               customTags:
-                env1:
+              - key: env1
+                value:
                   environment:
                     defaultValue: '-'
                     name: env1
                   type: Environment
-                literal1:
+              - key: literal1
+                value:
                   literal:
                     value: value1
                   type: Literal
-                req1:
+              - key: req1
+                value:
                   requestHeader:
                     defaultValue: '-'
                     name: X-Request-Id
@@ -250,9 +253,12 @@ xdsIR:
                 denominator: 100
                 numerator: 1
               tags:
-                env1: '%ENVIRONMENT(ENVOY_POD_NAME)%'
-                literal1: literal_value_1
-                req1: '%REQUEST_HEADER(X-Request-Id)%'
+              - key: env1
+                value: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+              - key: literal1
+                value: literal_value_1
+              - key: req1
+                value: '%REQUEST_HEADER(X-Request-Id)%'
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4

internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml

@@ -151,8 +151,10 @@ xdsIR:
     accessLog:
       als:
       - attributes:
-          attr1: val1
-          attr2: val2
+        - key: attr1
+          value: val1
+        - key: attr2
+          value: val2
         destination:
           metadata:
             kind: EnvoyProxy
@@ -181,8 +183,10 @@ xdsIR:
         name: accesslog
         type: HTTP
       - attributes:
-          attr1: val1
-          attr2: val2
+        - key: attr1
+          value: val1
+        - key: attr2
+          value: val2
         destination:
           metadata:
             kind: EnvoyProxy

internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml

@@ -158,7 +158,8 @@ xdsIR:
             name: accesslog_otel_0_1/backend/-1
             protocol: GRPC
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
       text:

internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml

@@ -185,7 +185,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
       text:

internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml

@@ -132,8 +132,10 @@ xdsIR:
     accessLog:
       json:
       - json:
-          duration: '%DURATION%'
-          protocol: '%PROTOCOL%'
+        - key: duration
+          value: '%DURATION%'
+        - key: protocol
+          value: '%PROTOCOL%'
         path: /dev/stdout
     globalResources:
       proxyServiceCluster:

internal/gatewayapi/testdata/envoyproxy-accesslog-otel-notype.out.yaml

@@ -90,9 +90,12 @@ xdsIR:
     accessLog:
       openTelemetry:
       - attributes:
-          method: '%REQ(:METHOD)%'
-          response_code: '%RESPONSE_CODE%'
-          start_time: '%START_TIME%'
+        - key: method
+          value: '%REQ(:METHOD)%'
+        - key: response_code
+          value: '%RESPONSE_CODE%'
+        - key: start_time
+          value: '%START_TIME%'
         authority: otel-collector.monitoring.svc.cluster.local
         destination:
           metadata:
@@ -109,7 +112,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: '%REQ(:METHOD)% %REQ(:PATH)% %PROTOCOL% %RESPONSE_CODE%'
     globalResources:
       proxyServiceCluster:

internal/gatewayapi/testdata/envoyproxy-accesslog-otel-text-attrs.out.yaml

@@ -90,9 +90,12 @@ xdsIR:
     accessLog:
       openTelemetry:
       - attributes:
-          response_code_details: '%RESPONSE_CODE_DETAILS%'
-          upstream_cluster: '%UPSTREAM_CLUSTER%'
-          upstream_host: '%UPSTREAM_HOST%'
+        - key: response_code_details
+          value: '%RESPONSE_CODE_DETAILS%'
+        - key: upstream_cluster
+          value: '%UPSTREAM_CLUSTER%'
+        - key: upstream_host
+          value: '%UPSTREAM_HOST%'
         authority: otel-collector.monitoring.svc.cluster.local
         destination:
           metadata:
@@ -109,7 +112,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: '%REQ(:METHOD)% %REQ(:PATH)% %PROTOCOL% %RESPONSE_CODE%'
     globalResources:
       proxyServiceCluster:

internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml

@@ -451,7 +451,8 @@ xdsIR:
             weight: 1
         logType: Route
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           this is a route log
       - authority: otel-collector.monitoring.svc.cluster.local
@@ -471,7 +472,8 @@ xdsIR:
             weight: 1
         logType: Listener
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           this is a listener log
       - authority: otel-collector.monitoring.svc.cluster.local
@@ -490,7 +492,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           this is a Global log
       text:

internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml

@@ -305,7 +305,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         traffic:

internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml

@@ -220,7 +220,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
     globalResources:
       proxyServiceCluster:
         metadata:

internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml

@@ -226,7 +226,8 @@ xdsIR:
             protocol: GRPC
             weight: 1
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
       text:

internal/gatewayapi/testdata/envoyproxy-otel-backend-custom-ca.out.yaml

@@ -179,7 +179,8 @@ xdsIR:
                 name: otel-collector/envoy-gateway-ca
               sni: otel-collector.example.com
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE%
     globalResources:

internal/gatewayapi/testdata/envoyproxy-otel-backend-tls.out.yaml

@@ -176,7 +176,8 @@ xdsIR:
               sni: otel-collector.example.com
               useSystemTrustStore: true
         resourceAttributes:
-          k8s.cluster.name: cluster-1
+        - key: k8s.cluster.name
+          value: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE%
     globalResources: