HTTPRoute validity

[jnauska]

How should one check the validity of a HTTPRoute?

For example if I create a HTTPRoute that gets correctly assigned to a Gateway, but later on I want to move the HTTPRoute to a different Gateway, I'm left with multiple valid statuses.

conditions:
  - lastTransitionTime: "2024-05-14T06:55:20Z"
    message: ""
    observedGeneration: 1
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2024-05-14T06:55:20Z"
    message: ""
    observedGeneration: 1
    reason: ReconciliationSucceeded
    status: "True"
    type: Reconciled
controllerName: networking.gke.io/gateway
parentRef:
  group: gateway.networking.k8s.io
  kind: Gateway
  name: test-gateway
  namespace: infra
conditions:
  - lastTransitionTime: "2024-06-10T10:00:36Z"
    message: ""
    observedGeneration: 7
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2024-06-10T10:00:36Z"
    message: ""
    observedGeneration: 7
    reason: ReconciliationSucceeded
    status: "True"
    type: Reconciled
controllerName: networking.gke.io/gateway
parentRef:
  group: gateway.networking.k8s.io
  kind: Gateway
  name: asm-gw-gke-test-asm-gateway
  namespace: infra-asm
conditions:
  - lastTransitionTime: "2024-06-12T11:40:52Z"
    message: ""
    observedGeneration: 10
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2024-06-12T11:40:52Z"
    message: ""
    observedGeneration: 10
    reason: ReconciliationSucceeded
    status: "True"
    type: Reconciled
controllerName: networking.gke.io/gateway
parentRef:
  group: gateway.networking.k8s.io
  kind: Gateway
  name: test-internal-gateway
  namespace: infra

Now normally this wouldn't be an issue, since the route can be only reached by the active Gateway, which in this case is test-internal-gateway

parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: test-internal-gateway
    namespace: infra

But as there are third-party integrations that are checking the validity of the HTTPRoute and doing things based on the reported status, there is some confusion (at least in my part).

As in our case we are using external-dns, that is checking the HTTPRoute status and propagating the Gateway IP addresses of the referenced Gateways to the DNS provider.

In this case we are left with 3 different IP addresses, two of them which aren't working because the HTTPRoute isn't attached to the Gateway which the IP address points to.

Should the 3rd party integrations trust the status field or should there be an additional check whether the spec.parentRefs has the same referenced Gateway or what?

[arkodg]

hey @jnauska I'd raise this with the gateway-api implementations, seems like a bug

[arkodg]

there's a caveat here

1. if the HTTPRoute's parentRef moved to another Gateway, then the corresponding controller linked to it (tied to the GatewayClass)
   should update the status (there may be multiple controllers watching all namespaces in the cluster, its becoming a common case with Service Mesh controllers and Ingress controllers co-existing in the same cluster both reconciling HTTPRoutes)
2. if the HTTPRoute's parentRef was removed, then neither controller can ascertain responsibility of the route, and the safest thing to do is ignore it

[youngnick]

I think the last caveat is that the observedGeneration field must match the metadata.generation field - if that's not the case, then the status for that controller is stale and can safely be ignored.

If everyone is doing what they should be, in @arkodg's case 2, then any new parentRefs should have the correct observedGeneration and the one that was removed will be stale.

[jnauska]

I created ticket for GKE networking, let's see what they think. But this observedGeneration seems to be like a proper check to check whether the route is active in a certain Gateway.