Tenants see no status on Envoy Gateway policies: manager lacks /status RBAC

[ecv]

Summary

Tenants get no status on their Envoy Gateway policies. The manager's role grants no status subresource on any gateway.envoyproxy.io type, so every status write the gateway resource replicator attempts is denied.

Two things break for tenants:

• No feedback when a policy is held. A tenant whose OIDC SecurityPolicy references a missing client secret sees login silently fail with nothing to act on. The operator correctly refuses to push the broken policy to the shared gateway — the protection works — but cannot write the reason onto the tenant's resource. No Accepted=False, no PendingSecret.
• No status at all on four policy types. SecurityPolicy, BackendTrafficPolicy, Backend, and HTTPRouteFilter never reflect edge reality. Tenants cannot tell whether a policy was accepted, rejected, or programmed. Stale status is never cleared either.

Every reconcile of an affected resource logs an error, indefinitely.

Cause

The markers on gateway_resource_replicator_controller.go:59-60 cover the resources and finalizers only — no /status — so config/rbac/role.yaml has no /status rule for gateway.envoyproxy.io at all. BackendTLSPolicy is the one replicated policy whose writes succeed, because gateway.networking.k8s.io/*/status is granted (role.yaml:204-207).

Denied write paths:

Path	Location
Held-policy condition	gateway_resource_replicator_securitypolicy_guard.go:176
Downstream→upstream status sync	gateway_resource_replicator_controller.go:487
Upstream status clear	gateway_resource_replicator_controller.go:526

The last two run for every replicated GVK without skipUpstreamStatusSync:

GVK	Writes status	/status RBAC
envoyproxy.io/SecurityPolicy	guard + sync	missing
envoyproxy.io/BackendTrafficPolicy	sync	missing
envoyproxy.io/Backend	sync	missing
envoyproxy.io/HTTPRouteFilter	sync	missing
gateway.networking.k8s.io/BackendTLSPolicy	sync	granted
TrafficProtectionPolicy, HTTPProxy, Connector	no	n/a

httproutefilters has resource-level RBAC only incidentally, from an unrelated marker on httpproxy_controller.go:88. The replicator's own marker never names it.

ERROR	Reconciler error	{"controller": "gateway_resource_replicator", "error": "failed to record held status on SecurityPolicy chainsaw-legal-aardvark/tenant-oidc: securitypolicies.gateway.envoyproxy.io \"tenant-oidc\" is forbidden: User \"system:serviceaccount:network-services-operator-system:network-services-operator-controller-manager\" cannot update resource \"securitypolicies/status\" in API group \"gateway.envoyproxy.io\""}

Unit tests miss it: gateway_resource_replicator_controller_test.go:963 asserts PendingSecret against a fake client that does not enforce RBAC.

Also blocked

• test: gate OIDC missing-secret gateway isolation #312 (oidc-missing-secret-isolation e2e) fails in Arm 1 waiting for Accepted=False, reason=PendingSecret. Arm 2 — shared-gateway restart isolation — never runs, leaving the upgrade gate for Envoy OIDC SecurityPolicy fails on startup and doesn't recover envoyproxy/gateway#6123 unverified.
• feat: aggregate SecurityPolicy status from edge #311 (aggregate SecurityPolicy status from edge) depends on the same write path.

Acceptance criteria

• Role grants get, update, patch on securitypolicies/status, backendtrafficpolicies/status, backends/status, and httproutefilters/status
• config/rbac/role.yaml regenerated from markers, not hand-edited
• On a real cluster: a held SecurityPolicy reports Accepted=False, reason=PendingSecret, and edge status for a replicated BackendTrafficPolicy appears upstream
• No failed to record held status or failed to update upstream status in manager logs
• oidc-missing-secret-isolation reaches Arm 2 and passes on pinned Envoy Gateway v1.7.4

Notes

Distinct from #97, which covers propagating status back from edge clusters via a Karmada resource interpreter. This is the operator's own upstream write being denied.

Related to #194

[ecv]

Verified fixed on staging, and shipped to production in v0.25.0.

On staging (v0.0.0-main-20260730-163828) I created a throwaway OIDC SecurityPolicy referencing a secret that does not exist. The operator held it and wrote the reason back onto the tenant's own resource:

Accepted=False  reason=PendingSecret
message: held from the shared gateway until referenced secret(s) are present
         downstream: default/verify-322-missing-secret

with the matching guard log line, holding SecurityPolicy: referenced secret not present downstream. Test object deleted afterwards; the replicator finalizer released cleanly.

The other three acceptance items also check out:

• Edge status reaches upstream — e2e-rate-limiting-1785431984-btp carries Accepted=True from gateway.networking.datumapis.com/external-global-proxy-controller.
• Zero failed to record held status / failed to update upstream status ... forbidden across 90 minutes of manager logs on all three replicas (~66k lines). Every remaining status-write failure is an optimistic-concurrency conflict, i.e. the write now reaches the API server.
• Production is on v0.25.0, 3/3 replicas ready, no restarts.

Two follow-ups rather than leaving them attached here:

• Gateway policy status writes fail the reconcile on conflict instead of retrying #329 — those conflicts fail the whole reconcile instead of retrying, which adds log noise and eats into the ControllerReconcileErrorRatio* budgets.
• https://github.com/datum-cloud/infra/issues/3745 — NSO has no metrics scrape target in production at all, so this bug's signature (a sustained ~100% reconcile error ratio on gateway_resource_replicator) was invisible to prod alerting. That gap is why this was found by reading logs.

The last acceptance item, oidc-missing-secret-isolation reaching Arm 2, stays with #312 — that test isn't merged yet.