IIUC if a BackendRef is invalid(not necessarily nonexistent, maybe not allowed by a ReferenceGrant), we will generate the VS as is, but return 500 when traffic goes to the invalid BackendRef, right?

If so the current code would not work as expected, because it would just stop generating the VS and return

istio/pilot/pkg/config/kube/gateway/conversion.go

Lines 858 to 863 in dd72869

    
           if !refs.BackendAllowed(gvk.HTTPRoute, fwd.BackendRef.Name, *toNs, ns) { 
        
           	return nil, &ConfigError{ 
        
           		Reason:  InvalidDestination, 
        
           		Message: fmt.Sprintf("backendRef %v/%v not accessible to a route in namespace %q (missing a ReferenceGrant?)", fwd.BackendRef.Name, *toNs, ns), 
        
           	} 
        
           }

istio/pilot/pkg/config/kube/gateway/conversion.go

Lines 379 to 382 in dd72869

    
           if err := convertHTTPRoute(r); err != nil { 
        
           	reportError(err) 
        
           	return 
        
           }

So I think we should refactor this a little bit to meet the gateway-api requirements?

	if !refs.BackendAllowed(gvk.HTTPRoute, fwd.BackendRef.Name, *toNs, ns) {
	return nil, &ConfigError{
	Reason: InvalidDestination,
	Message: fmt.Sprintf("backendRef %v/%v not accessible to a route in namespace %q (missing a ReferenceGrant?)", fwd.BackendRef.Name, *toNs, ns),
	}
	}

	if err := convertHTTPRoute(r); err != nil {
	reportError(err)
	return
	}

Gateway conformance: support HTTPRouteInvalidNonExistentBackendRef #39919

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions