This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch feat/gateway-api-1.6.0
in repository https://gitbox.apache.org/repos/asf/apisix-ingress-controller.git
The following commit(s) were added to refs/heads/feat/gateway-api-1.6.0 by this
push:
new ec69be2d fix: report AllowInsecureFallback frontendValidation as not
Programmed on the listener
ec69be2d is described below
commit ec69be2dac7ea2a1582c6f0fdc3273e0352fee65
Author: AlinsRan <[email protected]>
AuthorDate: Thu Jul 23 15:09:04 2026 +0800
fix: report AllowInsecureFallback frontendValidation as not Programmed on
the listener
The translator already rejects the unsupported AllowInsecureFallback mode,
but the
listener status path did not, so a listener would report Programmed=True
while its
translation fails. Surface the unsupported mode as Programmed=False on the
listener
status so it matches the translation outcome.
---
internal/controller/utils.go | 10 ++++++++++
internal/controller/utils_frontendca_test.go | 14 ++++++++++++++
2 files changed, 24 insertions(+)
diff --git a/internal/controller/utils.go b/internal/controller/utils.go
index 734c3ac5..df43a018 100644
--- a/internal/controller/utils.go
+++ b/internal/controller/utils.go
@@ -1104,6 +1104,16 @@ func validateListenerFrontendValidation(
frontendValidation *gatewayv1.FrontendTLSValidation,
conditionResolvedRefs, conditionProgrammed, conditionAccepted
*metav1.Condition,
) {
+ // AllowInsecureFallback cannot be represented on APISIX (see
translateFrontendValidation),
+ // so the listener is not programmable. Surface that on the status too,
otherwise the
+ // listener would report Programmed=True while translation fails.
+ if frontendValidation.Mode == gatewayv1.AllowInsecureFallback {
+ conditionProgrammed.Status = metav1.ConditionFalse
+ conditionProgrammed.Reason =
string(gatewayv1.ListenerReasonInvalid)
+ conditionProgrammed.Message = "frontendValidation mode
AllowInsecureFallback is not supported: APISIX cannot make client certificate
verification optional"
+ return
+ }
+
setInvalid := func(reason gatewayv1.ListenerConditionReason, message
string) {
conditionResolvedRefs.Status = metav1.ConditionFalse
conditionResolvedRefs.Reason = string(reason)
diff --git a/internal/controller/utils_frontendca_test.go
b/internal/controller/utils_frontendca_test.go
index 4c2fd8b0..80349cc9 100644
--- a/internal/controller/utils_frontendca_test.go
+++ b/internal/controller/utils_frontendca_test.go
@@ -87,6 +87,20 @@ func TestValidateListenerFrontendValidation(t *testing.T) {
assert.Equal(t,
string(gatewayv1.ListenerReasonNoValidCACertificate), accepted.Reason)
})
+ t.Run("AllowInsecureFallback mode is not programmable", func(t
*testing.T) {
+ cli := fake.NewClientBuilder().WithScheme(scheme).Build()
+ resolvedRefs, programmed, accepted := newFrontendConditions()
+ validateListenerFrontendValidation(context.Background(), cli,
gateway,
+ &gatewayv1.FrontendTLSValidation{
+ Mode:
gatewayv1.AllowInsecureFallback,
+ CACertificateRefs:
[]gatewayv1.ObjectReference{ref("ConfigMap", "ca")},
+ },
+ &resolvedRefs, &programmed, &accepted)
+
+ assert.Equal(t, metav1.ConditionFalse, programmed.Status)
+ assert.Contains(t, programmed.Message, "AllowInsecureFallback")
+ })
+
t.Run("one valid ref keeps Accepted True while ResolvedRefs stays
False", func(t *testing.T) {
validCM := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{Namespace: "default",
Name: "ca"},
