AlinsRan commented on code in PR #2804:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2804#discussion_r3643723006
##########
internal/controller/utils.go:
##########
@@ -836,51 +916,53 @@ func getListenerStatus(
supportedKinds = []gatewayv1.RouteGroupKind{}
)
+ // A port serving more than one TLS mode cannot be programmed,
so the
+ // listener is rejected rather than accepted with undefined
behaviour.
+ if listener.Protocol == gatewayv1.TLSProtocolType &&
tlsModeConflictPorts[listener.Port] {
+ conditionAccepted.Status = metav1.ConditionFalse
+ conditionAccepted.Reason =
string(gatewayv1.ListenerReasonProtocolConflict)
+ conditionAccepted.Message = "listeners on this port
disagree on tls.mode"
+ conditionConflicted.Status = metav1.ConditionTrue
+ conditionConflicted.Reason =
string(gatewayv1.ListenerReasonProtocolConflict)
+ conditionProgrammed.Status = metav1.ConditionFalse
+ conditionProgrammed.Reason =
string(gatewayv1.ListenerReasonInvalid)
+
+ statusArray = append(statusArray,
reuseUnchangedListenerStatus(gateway, i, gatewayv1.ListenerStatus{
+ Name: listener.Name,
+ Conditions: []metav1.Condition{
+ conditionProgrammed,
+ conditionAccepted,
+ conditionConflicted,
+ conditionResolvedRefs,
+ },
+ SupportedKinds: supportedKinds,
+ AttachedRoutes: attachedRoutes,
+ }))
+ continue
Review Comment:
Correction: I reverted the *passthrough* half of this. Marking plain TLS
Passthrough listeners as non-programmable (Accepted=False/UnsupportedValue,
empty SupportedKinds) regressed three CORE GATEWAY-TLS conformance tests — they
run against Passthrough listeners and require Accepted=True with
SupportedKinds=[TLSRoute] (`TLSRouteListenerPassthroughSupportedKinds`,
`TLSRouteInvalidNoMatchingListenerHostname`, `TLSRouteInvalidReferenceGrant`).
Your ask was specifically about listeners on a *conflicting* tls.mode port, and
that handling (`portsWithConflictingTLSMode` → route-ineligible +
AttachedRoutes=0 + Conflicted) stays. Passthrough listeners are back to being
treated as normal TLS listeners. (5bc8a0e6)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
