fix: grant status RBAC for Envoy Gateway policies - #324
Merged
Conversation
The manager's role granted no status subresource on any gateway.envoyproxy.io type, so every upstream status write the gateway resource replicator attempted was denied. Tenants saw no status on their SecurityPolicy, BackendTrafficPolicy, Backend, or HTTPRouteFilter resources, and a policy held back for a missing secret reported no reason at all. Three write paths were affected: the held-policy condition write in the SecurityPolicy guard, the downstream-to-upstream status sync, and the upstream status clear. The latter two run for every replicated GVK that does not set skipUpstreamStatusSync, so the gap was never limited to the held-SecurityPolicy case. Also name httproutefilters in the replicator's own resource marker. It previously had access only through an unrelated marker on the HTTPProxy controller, which would silently revoke the replicator's access if that marker ever changed. The generated role is unchanged by this, since the verb set already matched. Key changes: - Add a status marker covering backends/status, backendtrafficpolicies/status, httproutefilters/status, and securitypolicies/status with get, update, patch - Add httproutefilters to the replicator's resource marker - Regenerate config/rbac/role.yaml from the markers
JoseSzycho
approved these changes
Jul 29, 2026
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The manager's role grants no
statussubresource on anygateway.envoyproxy.iotype, so every upstream status write the gateway resource replicator attempts is denied — logging an error on every reconcile, indefinitely.Two symptoms for tenants:
SecurityPolicyreferences a missing secret gets no reason back. The operator correctly holds the broken policy off the shared gateway but cannot writeAccepted=False, reason=PendingSecretonto the tenant's resource, so login silently fails with nothing to act on.SecurityPolicy,BackendTrafficPolicy,Backend, andHTTPRouteFilternever reflect edge status, and stale status is never cleared.Three write paths were denied: the held-policy condition (
gateway_resource_replicator_securitypolicy_guard.go:176), the downstream→upstream sync (gateway_resource_replicator_controller.go:487), and the status clear (:526). The last two run for every replicated GVK withoutskipUpstreamStatusSync, so the gap was never limited to held SecurityPolicies.BackendTLSPolicywas unaffected —gateway.networking.k8s.io/*/statusis already granted.This adds the missing marker and regenerates the role. It also names
httproutefiltersin the replicator's own marker, which previously relied on an unrelated HTTPProxy controller marker for access; the generated role is unchanged by that.Note
Unit tests cannot catch this: the replicator tests use a fake client that does not enforce RBAC. The real gate is #312.
Test plan
make manifestsregeneratesconfig/rbac/role.yamlwith the four/statusrules; no CRD churngo build ./...make testAccepted=False, reason=PendingSecretBackendTrafficPolicyappears upstreamfailed to record held statusorfailed to update upstream statusin manager logsoidc-missing-secret-isolation) reaches Arm 2 and passesRelated to #322