fix: gateway router should wait for accepted condition

It can take some time for changes to propagate for cloud load balancers,
so flagger should ensure the route changes are current before proceeding
with any more.

Author: steved

go.mod

@@ -29,6 +29,7 @@ require (
 	k8s.io/client-go v0.32.3
 	k8s.io/code-generator v0.31.4
 	k8s.io/klog/v2 v2.130.1
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
 	knative.dev/serving v0.44.0
 )
 
@@ -99,7 +100,6 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
 	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
 	knative.dev/networking v0.0.0-20250117155906-67d1c274ba6a // indirect
 	knative.dev/pkg v0.0.0-20250117084104-c43477f0052b // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect

pkg/router/gateway_api.go

@@ -273,6 +273,26 @@ func (gwr *GatewayAPIRouter) GetRoutes(canary *flaggerv1.Canary) (
 		err = fmt.Errorf("HTTPRoute %s.%s get error: %w", apexSvcName, hrNamespace, err)
 		return
 	}
+
+	currentGeneration := httpRoute.GetGeneration()
+	for _, parentRef := range httpRoute.Spec.CommonRouteSpec.ParentRefs {
+		for _, parentStatus := range httpRoute.Status.Parents {
+			if !reflect.DeepEqual(parentStatus.ParentRef, parentRef) {
+				continue
+			}
+
+			for _, condition := range parentStatus.Conditions {
+				if condition.Type == string(v1.RouteConditionAccepted) && (condition.Status != metav1.ConditionTrue || condition.ObservedGeneration < currentGeneration) {
+					err = fmt.Errorf(
+						"HTTPRoute %s.%s parent %s is not ready (status: %s, observed generation: %d, current generation: %d)",
+						apexSvcName, hrNamespace, parentRef.Name, string(condition.Status), condition.ObservedGeneration, currentGeneration,
+					)
+					return 0, 0, false, err
+				}
+			}
+		}
+	}
+
 	var weightedRule *v1.HTTPRouteRule
 	for _, rule := range httpRoute.Spec.Rules {
 		// If session affinity is enabled, then we are only interested in the rule

pkg/router/gateway_api_test.go

@@ -31,6 +31,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
 )
 
 func TestGatewayAPIRouter_Reconcile(t *testing.T) {
@@ -516,3 +517,106 @@ func TestGatewayAPIRouter_makeFilters(t *testing.T) {
 		assert.Equal(t, "", filtersDiff)
 	}
 }
+
+func TestGatewayAPIRouter_GetRoutes(t *testing.T) {
+	canary := newTestGatewayAPICanary()
+	mocks := newFixture(canary)
+	router := &GatewayAPIRouter{
+		gatewayAPIClient: mocks.meshClient,
+		kubeClient:       mocks.kubeClient,
+		logger:           mocks.logger,
+	}
+
+	httpRoute := &v1.HTTPRoute{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:       "podinfo",
+			Generation: 1,
+		},
+		Spec: v1.HTTPRouteSpec{
+			Rules: []v1.HTTPRouteRule{
+				{
+					BackendRefs: []v1.HTTPBackendRef{
+						{
+							BackendRef: v1.BackendRef{
+								BackendObjectReference: v1.BackendObjectReference{
+									Name: "podinfo-canary",
+								},
+								Weight: ptr.To(int32(10)),
+							},
+						},
+						{
+							BackendRef: v1.BackendRef{
+								BackendObjectReference: v1.BackendObjectReference{
+									Name: "podinfo-primary",
+								},
+								Weight: ptr.To(int32(90)),
+							},
+						},
+					},
+				},
+			},
+			CommonRouteSpec: v1.CommonRouteSpec{
+				ParentRefs: []v1.ParentReference{
+					{
+						Name: "podinfo",
+					},
+				},
+			},
+		},
+	}
+	httpRoute, err := router.gatewayAPIClient.GatewayapiV1().HTTPRoutes("default").Create(context.TODO(), httpRoute, metav1.CreateOptions{})
+	require.NoError(t, err)
+
+	t.Run("httproute generation", func(t *testing.T) {
+		httpRoute.ObjectMeta.Generation = 5
+		httpRoute.Status.Parents = []v1.RouteParentStatus{
+			{
+				ParentRef: v1.ParentReference{
+					Name:        "podinfo",
+					SectionName: ptr.To(v1.SectionName("https")),
+				},
+				Conditions: []metav1.Condition{
+					{
+						Type:               string(v1.RouteConditionAccepted),
+						Status:             metav1.ConditionTrue,
+						ObservedGeneration: 1,
+					},
+				},
+			},
+			{
+				ParentRef: v1.ParentReference{
+					Name: "podinfo",
+				},
+				Conditions: []metav1.Condition{
+					{
+						Type:               string(v1.RouteConditionAccepted),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: 4,
+					},
+				},
+			},
+		}
+		httpRoute, err := router.gatewayAPIClient.GatewayapiV1().HTTPRoutes("default").Update(context.TODO(), httpRoute, metav1.UpdateOptions{})
+		require.NoError(t, err)
+
+		_, _, _, err = router.GetRoutes(canary)
+		require.Error(t, err)
+
+		httpRoute.Status.Parents[1].Conditions[0].ObservedGeneration = 5
+		_, err = router.gatewayAPIClient.GatewayapiV1().HTTPRoutes("default").Update(context.TODO(), httpRoute, metav1.UpdateOptions{})
+		require.NoError(t, err)
+
+		_, _, _, err = router.GetRoutes(canary)
+		require.Error(t, err)
+
+		httpRoute.Status.Parents[1].Conditions[0].Status = metav1.ConditionTrue
+		_, err = router.gatewayAPIClient.GatewayapiV1().HTTPRoutes("default").Update(context.TODO(), httpRoute, metav1.UpdateOptions{})
+		require.NoError(t, err)
+
+		primaryWeight, canaryWeight, mirrored, err := router.GetRoutes(canary)
+		require.NoError(t, err)
+		assert.Equal(t, 90, primaryWeight)
+		assert.Equal(t, 10, canaryWeight)
+		assert.False(t, mirrored)
+	})
+}