fix: skip backendResource watch when CRD is missing instead of crashing controller

[Siedlarczyk]

What this PR does

When an extension manager declares backendResources pointing at a custom CRD that is absent — or the controller's ServiceAccount lacks list/watch RBAC on it — the informer's initial LIST fails, WaitForCacheSync times out, and the controller crash-loops. This takes down the entire gateway controller, not just routes using the custom backend.

This PR adds a checkCRD call before registering each backendResources watch, following the same pattern already used for ServiceImport, Backend, HTTPRouteFilter, and other optional CRDs. If the CRD is missing, the watch is skipped with a warning log instead of propagating the error and failing cache sync.

Before

for _, gvk := range r.extBackendGVKs {
    u := &unstructured.Unstructured{}
    u.SetGroupVersionKind(gvk)
    if err := c.Watch(source.Kind(mgr.GetCache(), u, ...)); err != nil {
        return err  // crashes controller
    }
}

After

for _, gvk := range r.extBackendGVKs {
    crdExists, err := checkCRD(gvk.Kind, gvk.GroupVersion().String())
    if err != nil {
        return err
    }
    if !crdExists {
        r.log.Info("backend resource CRD not found, skipping watch", "resource", gvk.String())
        continue
    }
    // ... register watch as before
}

Validation

Tested in kind with Envoy Gateway v1.8.1 (image rebuilt with this patch):

• CRD absent: controller starts normally, logs backend resource CRD not found, skipping watch, 0 restarts, no crash-loop.
• CRD + RBAC installed after restart: controller registers the watch, logs Watching additional backend resource, 0 restarts.

Fixes #9807

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	60d3a99
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a8d279784cab100082c5eb3
😎 Deploy Preview	https://deploy-preview-9809--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dac43fb372

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Siedlarczyk]

Also pushed the recommended fix for the filter.go reconciliation process

[zirain]

@codex review

[zirain]

please add a release notes for backport.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 37ccfea15e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve errors unrelated to unavailable backend GVKs

When List fails for a transient or unexpected reason (for example a timeout, cache failure, or canceled context), this now treats the GVK as having no objects and lets reconciliation publish an incomplete resource snapshot. Routes using previously available custom backends are consequently translated as BackendNotFound, potentially replacing working configuration during a temporary failure. Only suppress errors that specifically identify the intended missing/unauthorized-resource cases; return other errors so the reconcile is retried.

Useful? React with 👍 / 👎.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.34%. Comparing base (4de02ef) to head (60d3a99).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/controller.go	12.50%	7 Missing ⚠️

❌ Your patch check has failed because the patch coverage (50.00%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9809   +/-   ##
=======================================
  Coverage   76.34%   76.34%           
=======================================
  Files         261      261           
  Lines       44523    44536   +13     
=======================================
+ Hits        33989    33999   +10     
- Misses       8285     8292    +7     
+ Partials     2249     2245    -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Siedlarczyk]

Hi, @zirain I added some more commits, following the guidance review from codex. I was continuing no matter what the error was, but it made more sense as the review suggested to isolate missing CRDs from other errors (timeouts, etc). Hope it gets clearer now

[Siedlarczyk]

Fixed some linting issue, should be fine now

[arkodg]

curious what is the impact of keeping the code in the initial state ( plus the above CRD check change)

[Siedlarczyk]

Hi @arkodg, tks for the comment. I am not sure whether I got you exact doubt (my bad if it's clear, this is my first contribution lol). If you are referring to the filter.go change in its entirety, the idea is pretty much to not break gateways conciliation process due to the absence of a CRD, which might be an error or many other scenarios. As we add gracefully degradation to the controller spin up, it made sense to me the abscence of CRDs don t crash the conciliation of the gateways. And it was also commenting spotted on by the review from codex, which makes sense to me. But if you are referring to treating the absence from other errors, is pretty much to only continue in the absence of CRDs, while other issues return error to the caller function, to retry the operation for instance. Hope that's clear enough, but I am ready anyways. Tks for the review!

[arkodg]

ack, we do have a pattern of saving the crdExists field and using that to skip vs skipping on error types

[Siedlarczyk]

I can work this, no problem. Just wanted to avoid changing the central structs of the reconciler, and make it simpler. I can add a new field, something like extBackendCRDExists map[schema.GroupVersionKind]bool, and change the code for the spin up to populate the struct. Just wanted to make it simpler and less invasive change. what do you think?

[arkodg]

yeah this works thanks

[zirain]

@Siedlarczyk can you take a look at the test failure?

[Siedlarczyk]

@Siedlarczyk can you take a look at the test failure?

@zirain done, it was failing because during the test the new struct was not being filled, resulting in a nil map. I just added a nil guard to my changes that fixes that and is a safer approach if this happens elsewhere. Pretty much not an issue as the watch always starts first and start the map

[zirain]

/retest

[kkk777-7]

LGTM, thanks!