[feat gateway-api]implement gateway listener status #4357

shuqz · 2025-09-25T23:05:15Z

Description

add listener status to gateway status
there are several ListenerConditionTypes: Conflicted, Accepted, ResolvedRefs, Programmed, OverlappingTLSConfig. and each type gets its ListenerConditionReason. i did not get all of them implemented since some of them are not applied.
in short, the current behavior is: in loader phase, before mapGatewayAndRoutes, we will validate listeners configurations first. listener status should only related to listener configurations, it is different from what we are doing in mapGatewayAndRoutes, which checks listener <-> route. and this result is stored (won't break reconcile immediately) then during gateway status update, we include listener status based on validation results
Note 1: if any of the listener is invalid, gateway status will be updated as Accepted=false

Note 2: currently behavior is there will only be one type in listener status, either it is accepted=true, or not valid with reasons. So there won't be a case like: Accepted=true and Conflict=NoConflict. let me know if we want to change the behavior.

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
test case 1: (ALB, no routes attached to it, just want to see conflicts and invalid route kind)

# gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: xx-test-gw-listener-status
  namespace: xx-test-gateway-alb
spec:
  gatewayClassName: xx-test-alb-gateway-class
  listeners:
    - protocol: HTTP
      port: 81
      name: http3
#      hostname: "*.example.com"
      allowedRoutes:
        namespaces:
          from: Same
    - protocol: HTTP
      port: 81
      name: http6
      hostname: "*.example.com"
      allowedRoutes:
        namespaces:
          from: Same
        kinds:
          - kind: HTTPRoute
          - kind: InvalidRoute
    - protocol: HTTP
      port: 83
      name: http5
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              name: xx-random-ns

test case 2: have some routes attached to each listener, and verified allowedRoutes value is correct

tese case3: with NLB, conflict protocol, and no attached routes

---
# gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shuqz-test-gw-listener-status-nlb
  namespace: shuqz-test-gateway-nlb
spec:
  gatewayClassName: shuqz-test-nlb-gateway-class
  listeners:
    - protocol: UDP
      port: 81
      name: udp1
      allowedRoutes:
        namespaces:
          from: Same
    - protocol: TLS
      port: 81
      name: tcp1
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        certificateRefs:
          - kind: Secret
            group: ""
            name: tls-secret

Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

k8s-ci-robot · 2025-09-25T23:05:21Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shuqz
Once this PR has been reviewed and has the lgtm label, please assign m00nf1sh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

shuqz · 2025-09-25T23:05:35Z

controllers/gateway/gateway_controller.go

+
 	if needPatch {
 		if err := r.k8sClient.Status().Patch(ctx, gw, client.MergeFrom(gwOld)); err != nil {
+			fmt.Printf("failed to update status: %s\n", err.Error())


will remove it

shuqz · 2025-09-25T23:05:43Z

controllers/gateway/gateway_controller.go

+
 	if needPatch {
 		if err := r.k8sClient.Status().Patch(ctx, gw, client.MergeFrom(gwOld)); err != nil {
+			fmt.Printf("failed to update status: %s\n", err.Error())


will remove it

zac-nixon · 2025-09-26T01:01:32Z

controllers/gateway/gateway_controller.go


 	stack, lb, newAddOnConfig, backendSGRequired, secrets, err := r.buildModel(ctx, gw, mergedLbConfig, allRoutes, currentAddOns)

-	if err != nil {


Seems this got removed, then didn't get re-added at a later place.

zac-nixon · 2025-09-26T01:04:15Z

controllers/gateway/gateway_controller.go

 	}

+	// update listeners status
+	ListenerStatuses, err := buildListenerStatus(r.controllerName, *gw, attachedRoutesMap, nil)


It seems this not possible to fail, can you remove returning an error?

zac-nixon · 2025-09-26T01:34:06Z

pkg/gateway/routeutils/listener_utils.go

+			result.Reason = gwv1.ListenerReasonPortUnavailable
+			result.Message = fmt.Sprintf("Port %d is not available (listener name %s)", listener.Port, listener.Name)
+			results.HasErrors = true
+		} else if controllerName == gateway_constants.ALBGatewayController &&


I don't think this will ever happen. As the loader will only load specific routes according to the gateway type:

aws-load-balancer-controller/pkg/gateway/routeutils/loader.go

Lines 103 to 113 in f1566e2

for route, loader := range l.allRouteLoaders {

applicable := filter.IsApplicable(route)

l.logger.V(1).Info("Processing route", "route", route, "is applicable", applicable)

if applicable {

data, err := loader(ctx, l.k8sClient)

if err != nil {

return nil, err

}

loadedRoutes = append(loadedRoutes, data...)

}

}

I don't know if we'll want this check, because it would require users to install the NLB CRDs (even if they don't intend to use them)

Ah, I see. The user can specify routes manually, so we'll need this. Good catch.

zac-nixon · 2025-09-26T02:03:03Z

pkg/gateway/routeutils/listener_utils.go

+				}
+			}
+
+			// Check cross-namespace references


This looks duplicated, and potentially incorrect -

aws-load-balancer-controller/pkg/gateway/routeutils/backend.go

Line 277 in f1566e2

func referenceGrantCheck(ctx context.Context, k8sClient client.Client, svcIdentifier types.NamespacedName, routeIdentifier types.NamespacedName, routeKind RouteKind) (bool, error) {

correct me if i am wrong, i felt it is a bit different? the referenceGrantCheck we had is checking From and To. but this one here is checking if another ns is specified here, there should be a referenceGrant for it

allowedRoutes: namespaces: from: Selector selector: matchLabels: name: xx-random-ns

zac-nixon · 2025-09-26T02:03:19Z

pkg/gateway/routeutils/listener_utils.go

+			}
+
+			// Check hostname conflicts - only when hostname is specified
+			if listener.Hostname != nil {


Is this check duplicated too?

it is different from hostname check. the existing hostname check checks if hostname in Route and hostname in listeners are compatible. but this hostname check here checks if hostnames in listeners have conflict.

k8s-ci-robot · 2025-09-26T02:51:42Z

@shuqz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-aws-load-balancer-controller-e2e-test	`f1566e2`	link	true	`/test pull-aws-load-balancer-controller-e2e-test`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[feat gateway-api]implement gateway listener status

f1566e2

k8s-ci-robot requested review from M00nF1sh and wweiwei-li September 25, 2025 23:05

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 25, 2025

shuqz commented Sep 25, 2025

View reviewed changes

zac-nixon reviewed Sep 26, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[feat gateway-api]implement gateway listener status #4357

[feat gateway-api]implement gateway listener status #4357

Uh oh!

shuqz commented Sep 25, 2025 •

edited

Loading

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

shuqz Sep 25, 2025

Uh oh!

shuqz Sep 25, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

shuqz Sep 26, 2025

Uh oh!

zac-nixon Sep 26, 2025

Uh oh!

shuqz Sep 26, 2025

Uh oh!

k8s-ci-robot commented Sep 26, 2025

Uh oh!

Uh oh!


		stack, lb, newAddOnConfig, backendSGRequired, secrets, err := r.buildModel(ctx, gw, mergedLbConfig, allRoutes, currentAddOns)

		if err != nil {

	for route, loader := range l.allRouteLoaders {
	applicable := filter.IsApplicable(route)
	l.logger.V(1).Info("Processing route", "route", route, "is applicable", applicable)
	if applicable {
	data, err := loader(ctx, l.k8sClient)
	if err != nil {
	return nil, err
	}
	loadedRoutes = append(loadedRoutes, data...)
	}
	}

[feat gateway-api]implement gateway listener status #4357

Are you sure you want to change the base?

[feat gateway-api]implement gateway listener status #4357

Uh oh!

Conversation

shuqz commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Sep 26, 2025

Uh oh!

Uh oh!

shuqz commented Sep 25, 2025 •

edited

Loading