fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef

internal/gatewayapi/listenerset.go

@@ -113,48 +113,69 @@ func (t *Translator) ProcessListenerSetStatus(listenerSets []*gwapiv1.ListenerSe
 		}
 
 		// Calculate status based on listeners
-		allListenersValid := true
-		anyListenerValid := false
+		allListenersAccepted := true
+		anyListenerAccepted := false
+		allListenersProgrammed := true
+		anyListenerProgrammed := false
 
 		for _, lStatus := range ls.Status.Listeners {
 			accepted := false
+			programmed := false
 			for _, cond := range lStatus.Conditions {
 				if cond.Type == string(gwapiv1.ListenerEntryConditionAccepted) && cond.Status == metav1.ConditionTrue {
 					accepted = true
-					break
+				}
+				if cond.Type == string(gwapiv1.ListenerConditionProgrammed) && cond.Status == metav1.ConditionTrue {
+					programmed = true
 				}
 			}
-			anyListenerValid = anyListenerValid || accepted
-			allListenersValid = allListenersValid && accepted
+			anyListenerAccepted = anyListenerAccepted || accepted
+			allListenersAccepted = allListenersAccepted && accepted
+			anyListenerProgrammed = anyListenerProgrammed || programmed
+			allListenersProgrammed = allListenersProgrammed && programmed
 		}
 
 		var (
 			lsAccepted         bool
-			lsReason           gwapiv1.ListenerSetConditionReason
+			lsAcceptedReason   gwapiv1.ListenerSetConditionReason
+			lsAcceptedMsg      string
+			lsProgrammed       bool
 			lsProgrammedReason gwapiv1.ListenerSetConditionReason
-			lsMsg              string
+			lsProgrammedMsg    string
 		)
 
 		switch {
-		case allListenersValid:
+		case allListenersAccepted:
 			lsAccepted = true
-			lsReason = gwapiv1.ListenerSetReasonAccepted
-			lsProgrammedReason = gwapiv1.ListenerSetReasonProgrammed
-			lsMsg = "All listeners are valid"
-		case anyListenerValid: // TODO: implement PartiallyInvalid conditions when Gateway API supports it
+			lsAcceptedReason = gwapiv1.ListenerSetReasonAccepted
+			lsAcceptedMsg = "All listeners are accepted"
+		case anyListenerAccepted: // TODO: implement PartiallyInvalid conditions when Gateway API supports it
 			lsAccepted = true
-			lsReason = gwapiv1.ListenerSetReasonListenersNotValid
-			lsProgrammedReason = gwapiv1.ListenerSetReasonProgrammed
-			lsMsg = "Some listeners are invalid"
+			lsAcceptedReason = gwapiv1.ListenerSetReasonListenersNotValid
+			lsAcceptedMsg = "Some listeners are invalid"
 		default:
 			lsAccepted = false
-			lsReason = gwapiv1.ListenerSetReasonListenersNotValid
+			lsAcceptedReason = gwapiv1.ListenerSetReasonListenersNotValid
+			lsAcceptedMsg = "No listeners are accepted"
+		}
+
+		switch {
+		case allListenersProgrammed:
+			lsProgrammed = true
+			lsProgrammedReason = gwapiv1.ListenerSetReasonProgrammed
+			lsProgrammedMsg = "All listeners are programmed"
+		case anyListenerProgrammed:
+			lsProgrammed = true
+			lsProgrammedReason = gwapiv1.ListenerSetReasonProgrammed
+			lsProgrammedMsg = "Some listeners are not programmed"
+		default:
+			lsProgrammed = false
 			lsProgrammedReason = gwapiv1.ListenerSetReasonListenersNotValid
-			lsMsg = "All listeners are invalid"
+			lsProgrammedMsg = "No listeners are programmed"
 		}
 
-		status.UpdateListenerSetStatusAccepted(ls, lsAccepted, lsReason, lsMsg)
-		status.UpdateListenerSetStatusProgrammed(ls, lsAccepted, lsProgrammedReason, lsMsg)
+		status.UpdateListenerSetStatusAccepted(ls, lsAccepted, lsAcceptedReason, lsAcceptedMsg)
+		status.UpdateListenerSetStatusProgrammed(ls, lsProgrammed, lsProgrammedReason, lsProgrammedMsg)
 	}
 }
 

internal/gatewayapi/testdata/backendtrafficpolicy-with-routing-type-listener.out.yaml

@@ -126,6 +126,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/gateway-with-attached-routes.out.yaml

@@ -108,6 +108,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/gateway-with-conflicting-listeners-one-invalid-ref.out.yaml

@@ -39,6 +39,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml

@@ -97,6 +97,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml

@@ -27,6 +27,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml

@@ -27,6 +27,11 @@ gateways:
         reason: InvalidCertificateRef
         status: "False"
         type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/listenerset-conflict-listeners.out.yaml

@@ -130,12 +130,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are invalid
+      message: No listeners are accepted
       reason: ListenersNotValid
       status: "False"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are invalid
+      message: No listeners are programmed
       reason: ListenersNotValid
       status: "False"
       type: Programmed
@@ -215,7 +215,7 @@ listenerSets:
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: Some listeners are invalid
+      message: Some listeners are not programmed
       reason: Programmed
       status: "True"
       type: Programmed
@@ -300,7 +300,7 @@ listenerSets:
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: Some listeners are invalid
+      message: Some listeners are not programmed
       reason: Programmed
       status: "True"
       type: Programmed

internal/gatewayapi/testdata/listenerset-cross-namespace.out.yaml

@@ -170,12 +170,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are accepted
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are programmed
       reason: Programmed
       status: "True"
       type: Programmed
@@ -227,12 +227,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are accepted
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are programmed
       reason: Programmed
       status: "True"
       type: Programmed

internal/gatewayapi/testdata/listenerset-grpcroute.out.yaml

@@ -198,12 +198,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are accepted
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are programmed
       reason: Programmed
       status: "True"
       type: Programmed
@@ -254,12 +254,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are accepted
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are programmed
       reason: Programmed
       status: "True"
       type: Programmed

internal/gatewayapi/testdata/listenerset-httproute.out.yaml

@@ -240,12 +240,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are accepted
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are valid
+      message: All listeners are programmed
       reason: Programmed
       status: "True"
       type: Programmed

internal/gatewayapi/testdata/listenerset-https-tls-misuses-gateway-namespace.out.yaml

@@ -128,12 +128,12 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are invalid
+      message: No listeners are accepted
       reason: ListenersNotValid
       status: "False"
       type: Accepted
     - lastTransitionTime: null
-      message: All listeners are invalid
+      message: No listeners are programmed
       reason: ListenersNotValid
       status: "False"
       type: Programmed

internal/gatewayapi/testdata/listenerset-https-tls-mixed-valid-and-missing-secret.in.yaml

@@ -0,0 +1,112 @@
+namespaces:
+- apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: gateway
+- apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: xls
+    labels:
+      allow-xls: "true"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: gateway
+    name: composite-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    allowedListeners:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            allow-xls: "true"
+    listeners:
+    - name: core-http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+listenerSets:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: ListenerSet
+  metadata:
+    namespace: xls
+    name: https-xls
+  spec:
+    parentRef:
+      name: composite-gateway
+      namespace: gateway
+    listeners:
+    - name: extra-https-valid
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+        - group: ""
+          kind: Secret
+          name: tls-secret-1
+          namespace: xls
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: extra-https-missing-cert
+      protocol: HTTPS
+      port: 8444
+      tls:
+        mode: Terminate
+        certificateRefs:
+        - group: ""
+          kind: Secret
+          name: tls-secret-missing
+          namespace: xls
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: route-valid
+  spec:
+    parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: ListenerSet
+      namespace: xls
+      name: https-xls
+      sectionName: extra-https-valid
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: route-missing-cert
+  spec:
+    parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: ListenerSet
+      namespace: xls
+      name: https-xls
+      sectionName: extra-https-missing-cert
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: xls
+    name: tls-secret-1
+  type: kubernetes.io/tls
+  data:
+    tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+    tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K