Skip to content

fix: Filter chain translation uses incorrect parent ns#12936

Merged
davidjumani merged 4 commits intomainfrom
fix-incorrect-l-ns
Nov 21, 2025
Merged

fix: Filter chain translation uses incorrect parent ns#12936
davidjumani merged 4 commits intomainfrom
fix-incorrect-l-ns

Conversation

@davidjumani
Copy link
Copy Markdown
Contributor

@davidjumani davidjumani commented Nov 20, 2025

Description

Fixes #12935

The bug was caused by using the gateway's namespace as the listener's parent's namespace. This namespace is then used to fetch the secret referenced by the certificateRef. If the incorrect namespace is specified, it fails to fetch the secret, resulting in the error described in the issue.
This PR resolves the issue by ensuring the filter chain (generated per listener) contains the listener's parent's namespace and not the gateway namespace.

Change Type

/kind fix

Changelog

Fix a bug where a listener on a listenerset can not read a secret in its own namespace

@gateway-bot gateway-bot added kind/fix Categorizes issue or PR as related to a bug. release-note labels Nov 20, 2025
Signed-off-by: David Jumani <dj.davidjumani1994@gmail.com>
Signed-off-by: David Jumani <dj.davidjumani1994@gmail.com>
Copy link
Copy Markdown
Contributor

@puertomontt puertomontt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe add unit test with John's config or similar

@davidjumani davidjumani added this pull request to the merge queue Nov 21, 2025
Merged via the queue into main with commit e69c99d Nov 21, 2025
30 checks passed
@davidjumani davidjumani deleted the fix-incorrect-l-ns branch November 21, 2025 17:19
davidjumani added a commit that referenced this pull request Nov 26, 2025
Signed-off-by: David Jumani <dj.davidjumani1994@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/fix Categorizes issue or PR as related to a bug. release-note

Projects

None yet

Development

Successfully merging this pull request may close these issues.

XListenerSet: invalid ReferenceGrant requirement for Secret

3 participants