Skip to content

Conversation

@AndyMoreland
Copy link
Contributor

What this PR does / why we need it:

This fixes an unconditional panic when the RequestMirror filter is used with GRPCRoutes

Which issue(s) this PR fixes:

Fixes #6874

Release Notes: No

@AndyMoreland AndyMoreland requested a review from a team as a code owner August 30, 2025 04:50
@AndyMoreland AndyMoreland force-pushed the fix/6874-fix-request-mirror branch 2 times, most recently from 0261526 to da5dfd6 Compare August 30, 2025 05:00
@codecov
Copy link

codecov bot commented Aug 30, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.08%. Comparing base (c181d47) to head (c502048).
⚠️ Report is 200 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6875      +/-   ##
==========================================
- Coverage   71.10%   71.08%   -0.03%     
==========================================
  Files         225      225              
  Lines       39859    39868       +9     
==========================================
- Hits        28343    28340       -3     
- Misses       9848     9857       +9     
- Partials     1668     1671       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@AndyMoreland AndyMoreland force-pushed the fix/6874-fix-request-mirror branch from c2e5f76 to fea450c Compare August 30, 2025 17:47
return nil
}

func (t *Translator) processRequestMirrorFilter(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we eliminate this ?
validateBackendRef already accepts a backend interface

func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, route RouteContext,

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arkodg I think we need some kind of split in the concrete type of the iface approximately here, because validateBackendRefFilters needs GRPCRoutes to have a GRPCRouteFilter-containing-backendref, and HTTPRoutes to have an HTTPRouteFilter-containing-backendref -- the panic was caused by the existing unification causing the downstream cast to fail.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I'm not a go expert or familiar with the types in play, but this was the smallest code diff way I found to avoid the unchecked cast panic)

@arkodg arkodg requested a review from kkk777-7 August 30, 2025 21:38
@kkk777-7
Copy link
Member

kkk777-7 commented Sep 1, 2025

@AndyMoreland
thanks for raising the issue and working on the fix!
If we just want to switch the type of BackendRef, how about retrieving the RouteType from filterContext and converting it to the appropriate type?

e.g.

	var mirrorBackendRef BackendRefContext
	routeType := GetRouteType(filterContext.Route)
	if routeType == resource.KindGRPCRoute {
		mirrorBackendRef = gwapiv1.GRPCBackendRef{
			BackendRef: gwapiv1.BackendRef{
				BackendObjectReference: mirrorBackend,
				Weight:                 &weight,
			},
		}
	} else {
		mirrorBackendRef = gwapiv1.HTTPBackendRef{
			BackendRef: gwapiv1.BackendRef{
				BackendObjectReference: mirrorBackend,
				Weight:                 &weight,
			},
		}
	}

	// This sets the status on the HTTPRoute, should the usage be changed so that the status message reflects that the backendRef is from the filter?
	filterNs := filterContext.Route.GetNamespace()
	serviceNamespace := NamespaceDerefOr(mirrorBackend.Namespace, filterNs)
	err = t.validateBackendRef(mirrorBackendRef, filterContext.Route,
		resources, serviceNamespace, routeType)

@arkodg
Copy link
Contributor

arkodg commented Sep 2, 2025

+1 to #6875 (comment)

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
The validateBackendRefFilters function casts the Filters field to
the specific filter type (HTTPRouteFilter vs GRPCRouteFilter) based
on the routeKind. Using the wrong wrapper type causes a type assertion
panic, so we must keep the typed wrappers despite the duplication.

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Simplified the RequestMirror filter processing by:
- Getting RouteType directly from filterContext
- Creating appropriate BackendRef type (HTTP or gRPC) based on RouteType
- Consolidating logic into single processRequestMirrorFilter function
- Keeping processGRPCRequestMirrorFilter as a delegate for compatibility

This approach follows the review feedback and maintains the fix for
GRPCRoute panic while simplifying the code structure.

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
@AndyMoreland AndyMoreland force-pushed the fix/6874-fix-request-mirror branch from 521204e to 4740589 Compare September 2, 2025 18:52
@AndyMoreland
Copy link
Contributor Author

I've applied the suggested change

ProcessGRPCFilters now calls processRequestMirrorFilter directly since
it already handles both HTTP and gRPC routes based on RouteType.

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
@arkodg
Copy link
Contributor

arkodg commented Sep 2, 2025

thanks for addressing the comments @AndyMoreland, added one minor comment

Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Andrew Moreland <andy@andymo.org>
@AndyMoreland
Copy link
Contributor Author

I've merged your suggestion

Copy link
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

@arkodg arkodg requested a review from a team September 2, 2025 22:08
@arkodg arkodg requested a review from a team September 2, 2025 22:08
@arkodg arkodg merged commit a8c8487 into envoyproxy:main Sep 2, 2025
49 of 51 checks passed
shawnh2 pushed a commit to shawnh2/gateway that referenced this pull request Oct 15, 2025
…y#6875)

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
shawnh2 pushed a commit to shawnh2/gateway that referenced this pull request Oct 15, 2025
…y#6875)

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>
arkodg added a commit that referenced this pull request Oct 15, 2025
* fix(xds-server): clear snapshot on stream close (#6618)

* fix(xds-server): clear snapshot on stream close

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>

* check if there are other active connections before clearning the snapshot

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* bug: disable x-envoy-ratelimited by default (#7110)

* bug: disable x-envoy-ratelimited by default

* can be enabled with `enableEnvoyHeaders` in CTP

Relates to #7034

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* fix tests and release note

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

* fix testdata

Signed-off-by: Arko Dasgupta <arko@tetrate.io>

---------

Signed-off-by: Arko Dasgupta <arko@tetrate.io>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix(translator): Fix panic with request mirror + grpcroute (#6875)

Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix: bug in overlap detection of cert SANs (#7234)

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* bump golang for crypto/x509 reggression (#7236)

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>

* fix gen-check

Signed-off-by: shawnh2 <shawnhxh@outlook.com>

---------

Signed-off-by: Zachary Vacura <zvacura@digitalocean.com>
Signed-off-by: shawnh2 <shawnhxh@outlook.com>
Signed-off-by: Arko Dasgupta <arko@tetrate.io>
Signed-off-by: Andrew Moreland <andy@andymoreland.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Co-authored-by: Zach Vacura <zach@hackzzila.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Andrew Moreland <andy@andymo.org>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GRPCRoutes panic the controller translator when RequestMirror filter is used

4 participants