From 17fe4a1de6a5462662dd30d52982354ea494d220 Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Tue, 28 Jul 2026 13:09:17 -0400 Subject: [PATCH] fix: grant status RBAC for Envoy Gateway policies The manager's role granted no status subresource on any gateway.envoyproxy.io type, so every upstream status write the gateway resource replicator attempted was denied. Tenants saw no status on their SecurityPolicy, BackendTrafficPolicy, Backend, or HTTPRouteFilter resources, and a policy held back for a missing secret reported no reason at all. Three write paths were affected: the held-policy condition write in the SecurityPolicy guard, the downstream-to-upstream status sync, and the upstream status clear. The latter two run for every replicated GVK that does not set skipUpstreamStatusSync, so the gap was never limited to the held-SecurityPolicy case. Also name httproutefilters in the replicator's own resource marker. It previously had access only through an unrelated marker on the HTTPProxy controller, which would silently revoke the replicator's access if that marker ever changed. The generated role is unchanged by this, since the verb set already matched. Key changes: - Add a status marker covering backends/status, backendtrafficpolicies/status, httproutefilters/status, and securitypolicies/status with get, update, patch - Add httproutefilters to the replicator's resource marker - Regenerate config/rbac/role.yaml from the markers --- config/rbac/role.yaml | 11 +++++++++++ .../gateway_resource_replicator_controller.go | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 7a6f0004..fd1e8b98 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -174,6 +174,17 @@ rules: - securitypolicies/finalizers verbs: - update +- apiGroups: + - gateway.envoyproxy.io + resources: + - backends/status + - backendtrafficpolicies/status + - httproutefilters/status + - securitypolicies/status + verbs: + - get + - patch + - update - apiGroups: - gateway.networking.k8s.io resources: diff --git a/internal/controller/gateway_resource_replicator_controller.go b/internal/controller/gateway_resource_replicator_controller.go index 7e949232..c7a48415 100644 --- a/internal/controller/gateway_resource_replicator_controller.go +++ b/internal/controller/gateway_resource_replicator_controller.go @@ -56,8 +56,9 @@ const gatewayResourceReplicatorFinalizer = "gateway.networking.datumapis.com/gat // resource (including TrafficProtectionPolicy/HTTPProxy/Connector). See config.go // SetDefaults_GatewayResourceReplicatorConfig. // +kubebuilder:rbac:groups="",resources=configmaps;secrets,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends;backendtrafficpolicies;securitypolicies,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends;backendtrafficpolicies;httproutefilters;securitypolicies,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends/finalizers;backendtrafficpolicies/finalizers;securitypolicies/finalizers,verbs=update +// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends/status;backendtrafficpolicies/status;httproutefilters/status;securitypolicies/status,verbs=get;update;patch type statusTransformFunc func(ctx context.Context, upstreamNamespace string, controllerName string, status map[string]any) (map[string]any, error)