gateway-api icon indicating copy to clipboard operation
gateway-api copied to clipboard
verified publisher icon kubernetes-sigs

HTTPRoutes with invalid ParentRefs are easy to miss

Open robscott opened this issue 8 months ago • 5 comments

What would you like to be added: Some kind of warning(s) when a HTTPRoute is attached to an invalid ParentRef. This may involve some combination of:

  1. Adding a default status that indicates the unknown status similar to Gateway:

https://github.com/kubernetes-sigs/gateway-api/blob/3222422bb2124d8cdd072d710ffd2474d99431e1/apis/v1/gateway_types.go#L44

  1. Adding some guidance that providers that install/manage CRDs in a cluster can also populate warnings in CRD status in these cases. Although this is not universal, where it is present, it means that we have a single controller that is responsible for CRDs overall, and that could extend to unowned or orphaned CRDs like this.

Why this is needed: It's unfortunately easy to have an invalid ParentRef in an HTTPRoute without realizing. Because an HTTPRoute with an invalid ParentRef is inherently not tied to a controller, no single controller can populate a warning message when this happens today, leading to further confusion.

robscott avatar Apr 08 '25 23:04 robscott

I think that option 1 is fine, we already have the same thing for Gateways and Gateway Listeners.

I think the second is fine as a MAY, but must be an implementation-specific behavior.

youngnick avatar Apr 15 '25 04:04 youngnick

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jul 14 '25 05:07 k8s-triage-robot

/remove-lifecycle stale

I think adding default Conditions for HTTPRoute ParentStatus is a great idea though, that we probably should do in the v1.4 release.

@robscott thoughts?

youngnick avatar Aug 06 '25 04:08 youngnick

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Nov 04 '25 05:11 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Dec 04 '25 06:12 k8s-triage-robot