fix deletions for secrets

[arkodg]

Fixes: #588

Signed-off-by: Arko Dasgupta arko@tetrate.io

[codecov-commenter]

Codecov Report

Merging #611 (5db11a0) into main (4d722b2) will decrease coverage by 0.14%.
The diff coverage is 18.18%.

@@            Coverage Diff             @@
##             main     #611      +/-   ##
==========================================
- Coverage   60.61%   60.47%   -0.15%     
==========================================
  Files          47       47              
  Lines        5721     5731      +10     
==========================================
- Hits         3468     3466       -2     
- Misses       2034     2044      +10     
- Partials      219      221       +2     

Impacted Files	Coverage Δ
internal/provider/kubernetes/gateway.go	50.85% <18.18%> (-0.90%)	⬇️
internal/provider/kubernetes/gatewayclass.go	73.18% <0.00%> (-2.18%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[arkodg]

apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1beta1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1beta1","kind":"Gateway","metadata":{"annotations":{},"name":"eg","namespace":"default"},"spec":{"gatewayClassName":"eg","listeners":[{"name":"https","port":8080,"protocol":"HTTPS","tls":{"certificateRefs":[{"group":"","kind":"Secret","name":"example-cert"}],"mode":"Terminate"}}]}}
    creationTimestamp: "2022-10-19T07:00:53Z"
    generation: 1
    name: eg
    namespace: default
    resourceVersion: "2076"
    uid: 59851661-7551-4d81-98bc-5c3cb3b01461
  spec:
    gatewayClassName: eg
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: https
      port: 8080
      protocol: HTTPS
      tls:
        certificateRefs:
        - group: ""
          kind: Secret
          name: example-cert
        mode: Terminate
  status:
    addresses:
    - type: IPAddress
      value: 127.0.0.1
    - type: Hostname
      value: localhost
    conditions:
    - lastTransitionTime: "2022-10-19T07:00:53Z"
      message: The Gateway has been scheduled by Envoy Gateway
      observedGeneration: 1
      reason: Scheduled
      status: "True"
      type: Scheduled
    - lastTransitionTime: "2022-10-19T07:00:54Z"
      message: Address assigned to the Gateway, 1/1 envoy Deployment replicas available
      observedGeneration: 1
      reason: Ready
      status: "True"
      type: Ready
    listeners:
    - attachedRoutes: 1
      conditions:
      - lastTransitionTime: "2022-10-19T07:00:53Z"
        message: Listener is ready
        observedGeneration: 1
        reason: Ready
        status: "True"
        type: Ready
      name: https
      supportedKinds:
      - group: gateway.networking.k8s.io
        kind: HTTPRoute
kind: List
metadata:
  resourceVersion: ""

🐳 ~/go-workspace/src/github.com/envoyproxy/gateway$ kubectl delete secret example-cert
secret "example-cert" deleted
🐳 ~/go-workspace/src/github.com/envoyproxy/gateway$ kubectl get gateway -A -o yaml
apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1beta1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1beta1","kind":"Gateway","metadata":{"annotations":{},"name":"eg","namespace":"default"},"spec":{"gatewayClassName":"eg","listeners":[{"name":"https","port":8080,"protocol":"HTTPS","tls":{"certificateRefs":[{"group":"","kind":"Secret","name":"example-cert"}],"mode":"Terminate"}}]}}
    creationTimestamp: "2022-10-19T07:00:53Z"
    generation: 1
    name: eg
    namespace: default
    resourceVersion: "2320"
    uid: 59851661-7551-4d81-98bc-5c3cb3b01461
  spec:
    gatewayClassName: eg
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: https
      port: 8080
      protocol: HTTPS
      tls:
        certificateRefs:
        - group: ""
          kind: Secret
          name: example-cert
        mode: Terminate
  status:
    addresses:
    - type: IPAddress
      value: 127.0.0.1
    - type: Hostname
      value: localhost
    conditions:
    - lastTransitionTime: "2022-10-19T07:00:53Z"
      message: The Gateway has been scheduled by Envoy Gateway
      observedGeneration: 1
      reason: Scheduled
      status: "True"
      type: Scheduled
    - lastTransitionTime: "2022-10-19T07:04:02Z"
      message: Deployment replicas unavailable
      observedGeneration: 1
      reason: NoResources
      status: "False"
      type: Ready
    listeners:
    - attachedRoutes: 0
      conditions:
      - lastTransitionTime: "2022-10-19T07:04:02Z"
        message: Secret default/example-cert does not exist.
        observedGeneration: 1
        reason: InvalidCertificateRef
        status: "False"
        type: ResolvedRefs
      - lastTransitionTime: "2022-10-19T07:04:02Z"
        message: Listener is invalid, see other Conditions for details.
        observedGeneration: 1
        reason: Invalid
        status: "False"
        type: Ready
      name: https
      supportedKinds:
      - group: gateway.networking.k8s.io
        kind: HTTPRoute
kind: List
metadata:
  resourceVersion: ""

[danehans]

@arkodg please test to see if the HTTPS backend is reachable after deleting the secret and comment here.

[danehans]

I tested this PR using #542 and the backend is not reachable when the secret is deleted:

$ kubectl get gateways  -o yaml
...
    - attachedRoutes: 1
      conditions:
      - lastTransitionTime: "2022-10-19T16:47:48Z"
        message: Secret default/example-cert does not exist.
        observedGeneration: 2
        reason: InvalidCertificateRef
        status: "False"
        type: ResolvedRefs
      - lastTransitionTime: "2022-10-19T16:47:48Z"
        message: Listener is invalid, see other Conditions for details.
        observedGeneration: 2
        reason: Invalid
        status: "False"
        type: Ready
      name: https
      supportedKinds:
      - group: gateway.networking.k8s.io
        kind: HTTPRoute
...

$ curl -v -HHost:www.example.com --resolve "www.example.com:8443:${GATEWAY_HOST}" \
--cacert example.com.crt https://www.example.com:8443/get
* Added www.example.com:8443:172.18.255.200 to DNS cache
* Hostname www.example.com was found in DNS cache
*   Trying 172.18.255.200:8443...
* connect to 172.18.255.200 port 8443 failed: Operation timed out
* Failed to connect to www.example.com port 8443 after 75002 ms: Operation timed out
* Closing connection 0
curl: (28) Failed to connect to www.example.com port 8443 after 75002 ms: Operation timed out

[Alice-Lilith]

Awesome, thanks!