Conflicted listener status is not surfaced for gateways when MergeGateways enabled

[shawnh2]

Description:

Applying these config, the listener of GTW merged-eg-3 is conflicted with the listener GTW merged-eg-2. But there is no status surfaced about these conflicted listener.

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: mg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: custom-proxy-config
    namespace: envoy-gateway-system
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: custom-proxy-config
  namespace: envoy-gateway-system
spec:
  mergeGateways: true
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: merged-eg-1
  namespace: default
spec:
  gatewayClassName: mg
  listeners:
     - name: http
       port: 8080
       protocol: HTTP
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: merged-eg-2
  namespace: default
spec:
  gatewayClassName: mg
  listeners:
     - name: http
       port: 8081
       protocol: HTTP
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: merged-eg-3
  namespace: default
spec:
  gatewayClassName: mg
  listeners:
     - name: http
       port: 8081
       protocol: HTTP

According to the validation method, the conflicted status should be computed, but somehow is not surfaced.

gateway/internal/gatewayapi/validate.go

Line 541 in 4c79ef9

func (t *Translator) validateConflictedMergedListeners(gateways []*GatewayContext) {

k get gtw -o yaml                                                 ✱

apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1","kind":"Gateway","metadata":{"annotations":{},"name":"merged-eg-1","namespace":"default"},"spec":{"gatewayClassName":"mg","listeners":[{"name":"http","port":8080,"protocol":"HTTP"}]}}
    creationTimestamp: "2024-02-21T14:43:57Z"
    generation: 1
    name: merged-eg-1
    namespace: default
    resourceVersion: "7869"
    uid: 2285a144-8c92-4ab3-81d4-fd485723f246
  spec:
    gatewayClassName: mg
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: http
      port: 8080
      protocol: HTTP
  status:
    addresses:
    - type: IPAddress
      value: 172.18.255.200
    conditions:
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: The Gateway has been scheduled by Envoy Gateway
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: Address assigned to the Gateway, 1/1 envoy Deployment replicas available
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
- apiVersion: gateway.networking.k8s.io/v1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1","kind":"Gateway","metadata":{"annotations":{},"name":"merged-eg-2","namespace":"default"},"spec":{"gatewayClassName":"mg","listeners":[{"name":"http","port":8081,"protocol":"HTTP"}]}}
    creationTimestamp: "2024-02-21T14:43:57Z"
    generation: 1
    name: merged-eg-2
    namespace: default
    resourceVersion: "7870"
    uid: 27440145-0932-46dd-aba1-d8dcf53a7f0d
  spec:
    gatewayClassName: mg
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: http
      port: 8081
      protocol: HTTP
  status:
    addresses:
    - type: IPAddress
      value: 172.18.255.200
    conditions:
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: The Gateway has been scheduled by Envoy Gateway
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: Address assigned to the Gateway, 1/1 envoy Deployment replicas available
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
- apiVersion: gateway.networking.k8s.io/v1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1","kind":"Gateway","metadata":{"annotations":{},"name":"merged-eg-3","namespace":"default"},"spec":{"gatewayClassName":"mg","listeners":[{"name":"http","port":8081,"protocol":"HTTP"}]}}
    creationTimestamp: "2024-02-21T14:43:57Z"
    generation: 1
    name: merged-eg-3
    namespace: default
    resourceVersion: "7871"
    uid: 7bc0dc08-f145-4310-b18d-6dc86a123151
  spec:
    gatewayClassName: mg
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: http
      port: 8081
      protocol: HTTP
  status:
    addresses:
    - type: IPAddress
      value: 172.18.255.200
    conditions:
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: The Gateway has been scheduled by Envoy Gateway
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2024-02-21T14:43:58Z"
      message: Address assigned to the Gateway, 1/1 envoy Deployment replicas available
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
kind: List
metadata:
  resourceVersion: ""

Environment:

lattest

[arkodg]

good find,

gateway/internal/gatewayapi/validate.go

Line 543 in 4c79ef9

for _, gateway := range gateways {

looks fine from a first glance which is being tested here https://github.com/envoyproxy/gateway/blob/main/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml

[shawnh2]

the conflicted listener sure has been found and set to listener's status in this method:

gateway/internal/gatewayapi/validate.go

Line 541 in 4c79ef9

func (t *Translator) validateConflictedMergedListeners(gateways []*GatewayContext) {

but when mergeGateways enabled, predicates for Service and Deployment

gateway/internal/provider/kubernetes/predicates.go

Line 361 in 4c79ef9

func (r *gatewayAPIReconciler) validateDeploymentForReconcile(obj client.Object) bool {

gateway/internal/provider/kubernetes/predicates.go

Line 207 in 4c79ef9

func (r *gatewayAPIReconciler) validateServiceForReconcile(obj client.Object) bool {

will update GTW status again, during this update, GTWs are loaded from GatewayAPIResources which does not contains any computed (translated) status. so will overwrite previous listener's status to empty, casue the missing of listener's status.

gateway/internal/provider/kubernetes/predicates.go

Line 231 in 4c79ef9

r.updateStatusForGateway(ctx, gw)

---

so the fix here would be:

since we cannot get computed (translated) status in gatewayapi-layer, so directly get the GTW via k8s client instead of loading it from GatewayAPIResources

[cnvergence]

+1 I think it would solve this issue

[arkodg]

good find @shawnh2 ! this probably explains a lot of the flakiness in CI :)