Merge branch 'main' into envoy-1.32-bump2

changelog/v1.19.0-beta6/check-gw.yaml

@@ -0,0 +1,7 @@
+changelog:
+  - type: FIX
+    issueLink: https://github.com/solo-io/solo-projects/issues/7768
+    resolvesIssue: false
+    description: |
+      Fixes a bug where we translate Gateways that do not belong to us.
+

changelog/v1.19.0-beta6/fix-http-listener-flake.yaml

@@ -0,0 +1,4 @@
+changelog:
+- type: NON_USER_FACING
+  issueLink: https://github.com/solo-io/gloo/issues/10594
+  description: Potentially fixes the TestConfigureNotAttachedHttpListenerOptions flake. It was noticed that the second test generally took longer to run since the inital connections to the proxy would fail. This could be because the proxy does not come up in time or the DNS cache became out of date, and we would curl the old IP

changelog/v1.19.0-beta6/solo-kit-bump.yaml

@@ -0,0 +1,9 @@
+changelog:
+  - type: DEPENDENCY_BUMP
+    dependencyOwner: solo-io
+    dependencyRepo: solo-kit
+    dependencyTag: v0.36.4
+  - type: FIX
+    issueLink: https://github.com/kgateway-dev/kgateway/issues/8626
+    resolvesIssue: false
+    description: Pull in solo-kit fix to reduce log level of snapshot cache watches.

go.mod

@@ -58,7 +58,7 @@ require (
 	// Ref: https://github.com/solo-io/gloo/pull/9463/files#r1594409655 && https://solo-io-corp.slack.com/archives/C03MFATU265/p1716913420716729?thread_ts=1716476992.938679&cid=C03MFATU265
 	// as to why it is now based off `gloo-main` and not `gloo-repo-branch`
 	github.com/solo-io/solo-apis v0.0.0-20240917212400-9103ca169358
-	github.com/solo-io/solo-kit v0.36.3
+	github.com/solo-io/solo-kit v0.36.4
 	github.com/spf13/afero v1.11.0
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5

go.sum

@@ -2705,8 +2705,8 @@ github.com/solo-io/skv2 v0.41.0 h1:NRZUe83LquB8zR++SY36JKhw1abRd+SBuGUGAHS9rWA=
 github.com/solo-io/skv2 v0.41.0/go.mod h1:GtEN0CCne94tm710YbefQh9YcMFcIu2X490g7Loq/Zs=
 github.com/solo-io/solo-apis v0.0.0-20240917212400-9103ca169358 h1:yNJpr6sKTBUJ0XbYEdOZuFEr+umyq4XgB/GR1cbhCCI=
 github.com/solo-io/solo-apis v0.0.0-20240917212400-9103ca169358/go.mod h1:xWaT1lP+nkAGYCuAtRdG1l4MsdKwphqeomC41AIsemY=
-github.com/solo-io/solo-kit v0.36.3 h1:ElzKyTgJLxyiyxQhkAwzukDfIFshA3LER44SIIA9cRY=
-github.com/solo-io/solo-kit v0.36.3/go.mod h1:tLK3BllHZZUZsvgG3paVzux8ccmItKadqLSg7nOltDw=
+github.com/solo-io/solo-kit v0.36.4 h1:P1EsMDS81jNj2DK33GpKLxZ07vDmdZcGamKtenGIYuA=
+github.com/solo-io/solo-kit v0.36.4/go.mod h1:tLK3BllHZZUZsvgG3paVzux8ccmItKadqLSg7nOltDw=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=

projects/gateway2/controller/start.go

@@ -87,11 +87,12 @@ type StartConfig struct {
 // It is intended to be run in a goroutine as the function will block until the supplied
 // context is cancelled
 type ControllerBuilder struct {
-	proxySyncer     *proxy_syncer.ProxySyncer
-	inputChannels   *proxy_syncer.GatewayInputChannels
-	cfg             StartConfig
-	k8sGwExtensions ext.K8sGatewayExtensions
-	mgr             ctrl.Manager
+	proxySyncer           *proxy_syncer.ProxySyncer
+	inputChannels         *proxy_syncer.GatewayInputChannels
+	cfg                   StartConfig
+	k8sGwExtensions       ext.K8sGatewayExtensions
+	mgr                   ctrl.Manager
+	allowedGatewayClasses sets.Set[string]
 }
 
 func NewControllerBuilder(ctx context.Context, cfg StartConfig) (*ControllerBuilder, error) {
@@ -173,6 +174,8 @@ func NewControllerBuilder(ctx context.Context, cfg StartConfig) (*ControllerBuil
 		return nil, err
 	}
 
+	allowedGatewayClasses := sets.New(append(cfg.SetupOpts.ExtraGatewayClasses, wellknown.GatewayClassName)...)
+
 	// Create the proxy syncer for the Gateway API resources
 	setupLog.Info("initializing proxy syncer")
 	proxySyncer := proxy_syncer.NewProxySyncer(
@@ -193,6 +196,7 @@ func NewControllerBuilder(ctx context.Context, cfg StartConfig) (*ControllerBuil
 		cfg.SyncerExtensions,
 		cfg.GlooStatusReporter,
 		cfg.SetupOpts.ProxyReconcileQueue,
+		allowedGatewayClasses,
 	)
 	proxySyncer.Init(ctx, cfg.Debugger)
 	if err := mgr.Add(proxySyncer); err != nil {
@@ -201,11 +205,12 @@ func NewControllerBuilder(ctx context.Context, cfg StartConfig) (*ControllerBuil
 	}
 
 	return &ControllerBuilder{
-		proxySyncer:     proxySyncer,
-		inputChannels:   inputChannels,
-		cfg:             cfg,
-		k8sGwExtensions: k8sGwExtensions,
-		mgr:             mgr,
+		proxySyncer:           proxySyncer,
+		inputChannels:         inputChannels,
+		cfg:                   cfg,
+		k8sGwExtensions:       k8sGwExtensions,
+		mgr:                   mgr,
+		allowedGatewayClasses: allowedGatewayClasses,
 	}, nil
 }
 
@@ -249,7 +254,7 @@ func (c *ControllerBuilder) Start(ctx context.Context) error {
 
 	gwCfg := GatewayConfig{
 		Mgr:            c.mgr,
-		GWClasses:      sets.New(append(c.cfg.SetupOpts.ExtraGatewayClasses, wellknown.GatewayClassName)...),
+		GWClasses:      c.allowedGatewayClasses,
 		ControllerName: wellknown.GatewayControllerName,
 		AutoProvision:  AutoProvision,
 		ControlPlane: deployer.ControlPlaneInfo{

projects/gateway2/proxy_syncer/proxy_syncer.go

@@ -24,6 +24,7 @@ import (
 	"github.com/solo-io/gloo/projects/gloo/pkg/syncer/setup"
 	"github.com/solo-io/gloo/projects/gloo/pkg/xds"
 	rlkubev1a1 "github.com/solo-io/solo-apis/pkg/api/ratelimit.solo.io/v1alpha1"
+	"k8s.io/apimachinery/pkg/util/sets"
 
 	"github.com/solo-io/solo-kit/pkg/api/v1/clients/common"
 	"github.com/solo-io/solo-kit/pkg/api/v1/clients/kubesecret"
@@ -93,8 +94,9 @@ type ProxySyncer struct {
 	proxiesToReconcile      krt.Singleton[proxyList]
 	proxyTrigger            *krt.RecomputeTrigger
 
-	destRules  DestinationRuleIndex
-	translator setup.TranslatorFactory
+	destRules             DestinationRuleIndex
+	translator            setup.TranslatorFactory
+	allowedGatewayClasses sets.Set[string]
 
 	waitForSync []cache.InformerSynced
 }
@@ -133,6 +135,7 @@ func NewProxySyncer(
 	syncerExtensions []syncer.TranslatorSyncerExtension,
 	glooReporter reporter.StatusReporter,
 	proxyReconcileQueue ggv2utils.AsyncQueue[gloov1.ProxyList],
+	allowedGatewayClasses sets.Set[string],
 ) *ProxySyncer {
 	return &ProxySyncer{
 		initialSettings:     initialSettings,
@@ -154,7 +157,8 @@ func NewProxySyncer(
 		// once we audit the plugins to be safe for concurrent use, we can instantiate the translator here.
 		// this will also have the advantage, that the plugin life-cycle will outlive a single translation
 		// so that they could own krt collections internally.
-		translator: translator,
+		translator:            translator,
+		allowedGatewayClasses: allowedGatewayClasses,
 	}
 }
 
@@ -409,6 +413,9 @@ func (s *ProxySyncer) Init(ctx context.Context, dbg *krt.DebugHandler) error {
 	s.proxyTrigger = krt.NewRecomputeTrigger(true)
 
 	glooProxies := krt.NewCollection(kubeGateways, func(kctx krt.HandlerContext, gw *gwv1.Gateway) *glooProxy {
+		if !s.allowedGatewayClasses.Has(string(gw.Spec.GatewayClassName)) {
+			return nil
+		}
 		logger.Debugf("building proxy for kube gw %s version %s", client.ObjectKeyFromObject(gw), gw.GetResourceVersion())
 		s.proxyTrigger.MarkDependant(kctx)
 		proxy := s.buildProxy(ctx, gw)

test/kubernetes/e2e/features/http_listener_options/http_lis_opt_suite.go

@@ -48,18 +48,27 @@ func (s *testingSuite) SetupSuite() {
 	s.testInstallation.Assertions.EventuallyPodsRunning(s.ctx, testdefaults.CurlPod.GetNamespace(), metav1.ListOptions{
 		LabelSelector: "app=curl",
 	})
+	s.testInstallation.Assertions.EventuallyObjectsExist(s.ctx, proxyService, proxyDeployment)
+	s.testInstallation.Assertions.EventuallyPodsRunning(s.ctx, proxyDeployment.ObjectMeta.GetNamespace(), metav1.ListOptions{
+		LabelSelector: "app.kubernetes.io/name=gloo-proxy-gw",
+	})
 
 	// include gateway manifests for the tests, so we recreate it for each test run
 	s.manifests = map[string][]string{
-		"TestConfigureHttpListenerOptions":            {gatewayManifest, basicLisOptManifest},
-		"TestConfigureNotAttachedHttpListenerOptions": {gatewayManifest, notAttachedLisOptManifest},
+		"TestConfigureHttpListenerOptions":            {basicLisOptManifest},
+		"TestConfigureNotAttachedHttpListenerOptions": {notAttachedLisOptManifest},
 	}
 }
 
 func (s *testingSuite) TearDownSuite() {
 	// Check that the common setup manifest is deleted
 	output, err := s.testInstallation.Actions.Kubectl().DeleteFileWithOutput(s.ctx, setupManifest)
 	s.testInstallation.Assertions.ExpectObjectDeleted(setupManifest, err, output)
+
+	s.testInstallation.Assertions.EventuallyObjectsNotExist(s.ctx, proxyService, proxyDeployment)
+	s.testInstallation.Assertions.EventuallyPodsNotExist(s.ctx, proxyDeployment.ObjectMeta.GetNamespace(), metav1.ListOptions{
+		LabelSelector: "app.kubernetes.io/name=gloo-proxy-gw",
+	})
 }
 
 func (s *testingSuite) BeforeTest(suiteName, testName string) {
@@ -72,13 +81,6 @@ func (s *testingSuite) BeforeTest(suiteName, testName string) {
 		err := s.testInstallation.Actions.Kubectl().ApplyFile(s.ctx, manifest)
 		s.Assert().NoError(err, "can apply manifest "+manifest)
 	}
-
-	// we recreate the `Gateway` resource (and thus dynamically provision the proxy pod) for each test run
-	// so let's assert the proxy svc and pod is ready before moving on
-	s.testInstallation.Assertions.EventuallyObjectsExist(s.ctx, proxyService, proxyDeployment)
-	s.testInstallation.Assertions.EventuallyPodsRunning(s.ctx, proxyDeployment.ObjectMeta.GetNamespace(), metav1.ListOptions{
-		LabelSelector: "app.kubernetes.io/name=gloo-proxy-gw",
-	})
 }
 
 func (s *testingSuite) AfterTest(suiteName, testName string) {
@@ -91,10 +93,6 @@ func (s *testingSuite) AfterTest(suiteName, testName string) {
 		output, err := s.testInstallation.Actions.Kubectl().DeleteFileWithOutput(s.ctx, manifest)
 		s.testInstallation.Assertions.ExpectObjectDeleted(manifest, err, output)
 	}
-	s.testInstallation.Assertions.EventuallyObjectsNotExist(s.ctx, proxyService, proxyDeployment)
-	s.testInstallation.Assertions.EventuallyPodsNotExist(s.ctx, proxyDeployment.ObjectMeta.GetNamespace(), metav1.ListOptions{
-		LabelSelector: "app.kubernetes.io/name=gloo-proxy-gw",
-	})
 }
 
 func (s *testingSuite) TestConfigureHttpListenerOptions() {

test/kubernetes/e2e/features/http_listener_options/testdata/setup.yaml

@@ -1,3 +1,23 @@
+kind: Gateway
+apiVersion: gateway.networking.k8s.io/v1
+metadata:
+  name: gw
+spec:
+  gatewayClassName: gloo-gateway
+  listeners:
+    - protocol: HTTP
+      port: 8080
+      name: http
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - protocol: HTTP
+      port: 8081
+      name: other
+      allowedRoutes:
+        namespaces:
+          from: Same
+---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata: