diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go index e147589577af..3a137030a1eb 100644 --- a/internal/gatewayapi/backendtlspolicy.go +++ b/internal/gatewayapi/backendtlspolicy.go @@ -9,7 +9,6 @@ import ( "fmt" corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/utils/ptr" gwapiv1 "sigs.k8s.io/gateway-api/apis/v1" gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2" @@ -30,19 +29,17 @@ func (t *Translator) processBackendTLSPolicy( policy := getBackendTLSPolicy(resources.BackendTLSPolicies, backendRef, backendNamespace) - ancestor := gwapiv1a2.PolicyAncestorStatus{ - AncestorRef: parent, - ControllerName: gwapiv1.GatewayController(t.GatewayControllerName), + ancestorRefs := []gwapiv1a2.ParentReference{ + parent, } if err != nil { - status.SetBackendTLSPolicyCondition( - policy, - ancestor, - gwapiv1a2.PolicyConditionAccepted, - metav1.ConditionFalse, - gwapiv1a2.PolicyReasonInvalid, - status.Error2ConditionMsg(err)) + status.SetTranslationErrorForPolicyAncestors(&policy.Status, + ancestorRefs, + t.GatewayControllerName, + policy.Generation, + status.Error2ConditionMsg(err), + ) return nil } @@ -67,25 +64,21 @@ func (t *Translator) processBackendTLSPolicy( }, resources.ReferenceGrants, ) { - status.SetBackendTLSPolicyCondition( - policy, - ancestor, - gwapiv1a2.PolicyConditionAccepted, - metav1.ConditionFalse, - gwapiv1a2.PolicyReasonInvalid, - fmt.Sprintf("target ref to %s %s/%s not permitted by any ReferenceGrant", - backendRefKind, backendNamespace, backendRef.Name)) + err = fmt.Errorf("target ref to %s %s/%s not permitted by any ReferenceGrant", + backendRefKind, backendNamespace, backendRef.Name) + + status.SetTranslationErrorForPolicyAncestors(&policy.Status, + ancestorRefs, + t.GatewayControllerName, + policy.Generation, + status.Error2ConditionMsg(err), + ) return nil } } - status.SetBackendTLSPolicyCondition( - policy, - ancestor, - gwapiv1a2.PolicyConditionAccepted, - metav1.ConditionTrue, - gwapiv1a2.PolicyReasonAccepted, - "BackendTLSPolicy is Accepted") + status.SetAcceptedForPolicyAncestors(&policy.Status, ancestorRefs, t.GatewayControllerName) + return tlsBundle } diff --git a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml index b38d38425b9f..eb1d0a7ff99f 100644 --- a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml @@ -26,7 +26,7 @@ backendTLSPolicies: sectionName: http conditions: - lastTransitionTime: null - message: BackendTLSPolicy is Accepted + message: Policy has been accepted. reason: Accepted status: "True" type: Accepted diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml index 8b258dac8db5..e26e069dfd29 100644 --- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml @@ -25,7 +25,7 @@ backendTLSPolicies: sectionName: http conditions: - lastTransitionTime: null - message: BackendTLSPolicy is Accepted + message: Policy has been accepted. reason: Accepted status: "True" type: Accepted diff --git a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml index 760e78640484..bc1904e2b464 100644 --- a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml @@ -22,7 +22,7 @@ backendTLSPolicies: sectionName: http conditions: - lastTransitionTime: null - message: BackendTLSPolicy is Accepted + message: Policy has been accepted. reason: Accepted status: "True" type: Accepted diff --git a/internal/gatewayapi/testdata/backendtlspolicy-without-referencegrant.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-without-referencegrant.out.yaml index d2f92086f1a9..57382ac76500 100755 --- a/internal/gatewayapi/testdata/backendtlspolicy-without-referencegrant.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-without-referencegrant.out.yaml @@ -26,7 +26,7 @@ backendTLSPolicies: sectionName: http conditions: - lastTransitionTime: null - message: target ref to Service backends/http-backend not permitted by any + message: Target ref to Service backends/http-backend not permitted by any ReferenceGrant reason: Invalid status: "False" diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml index 5879169de289..e964b48155cd 100755 --- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml +++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml @@ -27,7 +27,7 @@ backendTLSPolicies: namespace: default conditions: - lastTransitionTime: null - message: BackendTLSPolicy is Accepted + message: Policy has been accepted. reason: Accepted status: "True" type: Accepted @@ -59,7 +59,7 @@ backendTLSPolicies: namespace: default conditions: - lastTransitionTime: null - message: BackendTLSPolicy is Accepted + message: Policy has been accepted. reason: Accepted status: "True" type: Accepted diff --git a/internal/status/backendtlspolicy.go b/internal/status/backendtlspolicy.go deleted file mode 100644 index 313cab2f595f..000000000000 --- a/internal/status/backendtlspolicy.go +++ /dev/null @@ -1,32 +0,0 @@ -// Copyright Envoy Gateway Authors -// SPDX-License-Identifier: Apache-2.0 -// The full text of the Apache license is available in the LICENSE file at -// the root of the repo. - -package status - -import ( - "time" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2" -) - -func SetBackendTLSPolicyCondition(c *gwv1a2.BackendTLSPolicy, policyAnces gwv1a2.PolicyAncestorStatus, conditionType gwv1a2.PolicyConditionType, status metav1.ConditionStatus, reason gwv1a2.PolicyConditionReason, message string) { - - if c.Status.Ancestors == nil { - c.Status.Ancestors = []gwv1a2.PolicyAncestorStatus{} - } - - cond := newCondition(string(conditionType), status, string(reason), message, time.Now(), c.Generation) - for i, ancestor := range c.Status.Ancestors { - if ancestor.AncestorRef.Name == policyAnces.AncestorRef.Name && - (ancestor.AncestorRef.Namespace == nil || *ancestor.AncestorRef.Namespace == *policyAnces.AncestorRef.Namespace) { - c.Status.Ancestors[i].Conditions = MergeConditions(c.Status.Ancestors[i].Conditions, cond) - return - } - } - len := len(c.Status.Ancestors) - c.Status.Ancestors = append(c.Status.Ancestors, policyAnces) - c.Status.Ancestors[len].Conditions = MergeConditions(c.Status.Ancestors[len].Conditions, cond) -}