AlinsRan commented on code in PR #2882:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2882#discussion_r4244311929
##########
internal/adc/translator/tlsroute.go:
##########
@@ -143,18 +141,90 @@ func (t *Translator) TranslateTLSRoute(tctx
*provider.TranslateContext, tlsRoute
}
}
- for _, host := range hosts {
- streamRoutes, err := t.buildL4StreamRoutes(tctx,
tlsRoute.Namespace, tlsRoute.Name, ruleIndex, "TLS", "TLSRoute", labels)
- if err != nil {
- return nil, err
+ // One set of stream routes per rule carrying every SNI, not
one set per
+ // hostname: buildL4StreamRoutes names them by rule and port
only, so a per
+ // hostname loop produced N sets sharing one ID and only the
last survived.
+ streamRoutes, err := t.buildL4StreamRoutes(tctx,
tlsRoute.Namespace, tlsRoute.Name, ruleIndex, "TLS", "TLSRoute", labels)
+ if err != nil {
+ return nil, err
+ }
+ for _, streamRoute := range streamRoutes {
+ // A single SNI keeps using the singular form: it is
what every
+ // APISIX version understands, and snis only earns its
place once
+ // there is more than one to match.
+ if len(snis) == 1 {
+ streamRoute.SNI = snis[0]
+ } else {
+ streamRoute.SNIs = snis
}
Review Comment:
Fixed in 284fa5da. Each stream route now derives its SNIs from the listeners
on its own port:
```go
// internal/adc/translator/tlsroute.go
func tlsRouteSNIsForPort(listeners []gatewayv1.Listener, routeHostnames
[]gatewayv1.Hostname, port int32) []string {
matched := make([]gatewayv1.Listener, 0, len(listeners))
for _, listener := range listeners {
if listener.Protocol != gatewayv1.TLSProtocolType {
continue
}
if port != 0 && listener.Port != port {
continue
}
matched = append(matched, listener)
}
...
```
```go
// internal/adc/translator/tlsroute.go, in TranslateTLSRoute
for _, streamRoute := range streamRoutes {
snis := tlsRouteSNIsForPort(tctx.Listeners, tlsRoute.Spec.Hostnames,
streamRoute.ServerPort)
```
The hostname-less fallback had the mirror-image problem, which the same
change fixes: it skipped past a listener carrying no hostname and only reached
`"*"` when *no* listener had one, so a port with an unrestricted listener lost
its catch-all as soon as a sibling port named a hostname. `UnionHostnames` now
reports that case per port and the port gets `"*"`.
A route that does carry hostnames is narrowed against that port's listeners
rather than keeping the route-wide set.
`TestTranslateTLSRouteSNIsPerPort` covers both halves — `a hostname-less
route takes the hostnames of its own port`, `a port whose listener names no
hostname keeps the catch-all`, `route hostnames are narrowed to the listeners
of each port`. All three fail if the port filter is removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
