Skip to content

fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend#8654

Merged
zhaohuabing merged 4 commits intoenvoyproxy:mainfrom
zirain:fix-8616
Apr 9, 2026
Merged

fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend#8654
zhaohuabing merged 4 commits intoenvoyproxy:mainfrom
zirain:fix-8616

Conversation

@zirain
Copy link
Copy Markdown
Member

@zirain zirain commented Apr 2, 2026

fixes: #8616

@zirain
fix: client certificate secret never delivered when it is exclusively…
ae5d714 
… referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>
@zirain zirain requested a review from a team as a code owner April 2, 2026 03:58
@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 2, 2026 •
edited
Loading

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit 95f7b2e
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69d4838612fc710008c594cb

@zirain zirain changed the title fix: client certificate secret never delivered when it is exclusively… fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend Apr 2, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 2, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 42.85714% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.49%. Comparing base (3b4de6d) to head (95f7b2e).
⚠️ Report is 7 commits behind head on main.

Files with missing lines Patch % Lines
internal/xds/translator/extauth.go 25.00% 2 Missing and 4 partials ⚠️
internal/xds/translator/translator.go 53.84% 3 Missing and 3 partials ⚠️

❌ Your patch status has failed because the patch coverage (42.85%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8654      +/-   ##
==========================================
- Coverage   74.50%   74.49%   -0.02%     
==========================================
  Files         243      243              
  Lines       38689    38695       +6     
==========================================
  Hits        28826    28826              
- Misses       7872     7875       +3     
- Partials     1991     1994       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zirain
fix lint
95b9453 
Signed-off-by: zirain <zirain2009@gmail.com>
arkodg
arkodg previously approved these changes Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks ! can we also fix this for oidc and jwt cases either here or in a follow up ?

@arkodg arkodg requested review from a team April 6, 2026 04:52
@zirain zirain mentioned this pull request Apr 6, 2026
Closed
@zirain
Merge branch 'main' into fix-8616
b7f1584 
Signed-off-by: zirain <zirain2009@gmail.com>
@zirain zirain requested a review from arkodg April 6, 2026 12:36
@zhaohuabing zhaohuabing merged commit c7e21fa into envoyproxy:main Apr 9, 2026
37 of 38 checks passed
@zirain zirain deleted the fix-8616 branch April 9, 2026 03:04
@zirain zirain mentioned this pull request Apr 10, 2026
Merged
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Apr 16, 2026
@zirain @cnvergence
fix: client certificate secret never delivered when it is exclusively…
323cf9f 
… referenced by a SecurityPolicy extAuth Backend (envoyproxy#8654)

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit c7e21fa)
cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Apr 16, 2026
@zirain @cnvergence
fix: client certificate secret never delivered when it is exclusively…
89d8b72 
… referenced by a SecurityPolicy extAuth Backend (envoyproxy#8654)

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit c7e21fa)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence added a commit that referenced this pull request Apr 16, 2026
@cnvergence @rudrakhp
@zirain @aburanrbx @arkodg @stekole @felipesabadini @jukie @codefromthecrypt @kkk777-7
[release/v1.7] cherry-pick for v1.7.2 (#8768)
005d80e 
* fix: handle network errors in rate limit e2e tests (#8446)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit b0638d5)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* refactor/perf: use LuaPerRoute instead of FilterConfig (#8355)

perf: use LuaPerRoute instead of FilterConfig

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit f31ac4e)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: per-endpoint hostname override blocked by auto-generated wildcad host (#8565)

* fix: per-endpoint hostname override blocked by auto-generated wildcard host

Signed-off-by: zirain <zirain2009@gmail.com>

* add UT

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 595010a)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix bug with grpcroute mirror filter (#8541)

* fix bug with grpcroute mirror filter

Signed-off-by: Adam Buran <aburan@roblox.com>

* add indexers test

Signed-off-by: Adam Buran <aburan@roblox.com>

* add release note

Signed-off-by: Adam Buran <aburan@roblox.com>

---------

Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
(cherry picked from commit e633c08)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: normalize CRLF line endings in htpasswd basic auth secrets (#8557)

Fixes #8554

Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
(cherry picked from commit 9cac348)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: avoid metric increments on no-op delete reconcile paths (#8480)

* fix: avoid metric increments on no-op delete reconcile paths

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
(cherry picked from commit 7a2a4ec)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix(telemetry): support BackendTLSPolicy for telemetry backends (#8545)

* fix(telemetry): support BackendTLSPolicy for telemetry backends

processBackendRefs does not look up BackendTLSPolicy for telemetry
backends (access logs, tracing, metrics), so TLS can only be configured
via Backend.spec.tls. Replace inline processServerValidationTLSSettings
with applyBackendTLSSetting so telemetry backends get the full Backend +
BackendTLSPolicy + EnvoyProxy TLS merge.

Workaround: envoyproxy/ai-gateway#1964

Signed-off-by: Adrian Cole <adrian@tetrate.io>
(cherry picked from commit ac18feb)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: restore failure-path metric recording for delete and HPA reconcile (#8656)

Fixes #8651

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
(cherry picked from commit 2a5bfd0)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: status for mirror backend (#8675)

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
(cherry picked from commit fa81778)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend (#8654)

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit c7e21fa)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy jwt/oidc Backend (#8711)

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 95c3a79)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: helm secrets rbac for gateway namespace with watch list of namespaces (#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit c48a346)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Adrian Cole <adrian@tetrate.io>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: aburanrbx <aburan@roblox.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: stekole <30674956+stekole@users.noreply.github.com>
Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Adrian Cole <64215+codefromthecrypt@users.noreply.github.com>
Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com>
skos-ninja pushed a commit to skos-ninja/envoy-gateway that referenced this pull request May 1, 2026
@zirain @skos-ninja
fix: client certificate secret never delivered when it is exclusively…
c6680e2 
… referenced by a SecurityPolicy extAuth Backend (envoyproxy#8654)

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Jake Oliver <jake@truelayer.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zhaohuabing zhaohuabing zhaohuabing approved these changes

@arkodg arkodg arkodg approved these changes

Assignees

No one assigned

Labels

cherrypick/release-v1.7.2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Bug: SDS never delivers client certificate secret when it is exclusively referenced by a SecurityPolicy extAuth Backend

3 participants

@zirain @zhaohuabing @arkodg