cilium-operator not respecting hostname config on HTTPRoutes and Gateway Listeners

[cjvirtucio87]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

Given the following Gateway manifest deployed in the cilium namespace:

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: default
  namespace: cilium
  labels:
    app: cilium
spec:
  gatewayClassName: cilium
  addresses:
    - value: "<ip address>"
  listeners:
  - hostname: bar-dev.home
    name: bar-dev-home-http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "bar-dev"
  - hostname: bar-dev.home
    name: bar-dev-home-https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: frigate-tls
        namespace: bar-dev
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "bar-dev"
  - hostname: foo-dev.home
    name: foo-dev-home-http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "foo-dev"
  - hostname: foo-dev.home
    name: foo-dev-home-https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: foo-dev.home-tls
        namespace: foo-dev
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "foo-dev"

and the following HTTPRoute manifest deployed in a separate namespace:

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: keycloakx
  namespace: foo-dev
spec:
  hostnames:
    - foo-dev.home.io
  parentRefs:
    - name: default
      namespace: cilium
  rules:
    - backendRefs:
        - name: keycloakx
          port: 8080
      matches:
        - path:
            type: PathPrefix
            value: /

the HTTPRoute is stuck with the following status:

Status:
  Parents:
    Conditions:
      Last Transition Time:  2024-02-08T21:15:52Z
      Message:               HTTPRoute is not allowed to attach to this Gateway due to namespace selector restrictions
      Observed Generation:   1
      Reason:                NotAllowedByListeners
      Status:                False
      Type:                  Accepted
      Last Transition Time:  2024-02-08T21:15:52Z
      Message:               Service reference is valid
      Observed Generation:   1
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         io.cilium/gateway-controller
    Parent Ref:
      Group:      gateway.networking.k8s.io
      Kind:       Gateway
      Name:       default
      Namespace:  cilium

Cilium Version

quay.io/cilium/operator-generic:v1.15.0@sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79

Kernel Version

Linux cluster-control.home 5.14.0-362.13.1.el9_3.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Dec 13 14:07:45 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Kubernetes Version

Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.27.2+k3s1

Sysdump

sysdump.zip

Relevant log output

No response

Anything else?

PR with proposed changes.

Also, here is the pertinent portion of the kubectl explain gateway.spec.listeners.hostname output:

     For HTTPRoute and TLSRoute resources, there is an interaction with the
    `spec.hostnames` array. When both listener and route specify hostnames,
    there MUST be an intersection between the values for a Route to be accepted.

Code of Conduct

• I agree to follow this project's Code of Conduct