Skip to content

feat: propagate gateway-name label to infra resources in default mode - #9478

Open
mmmommm wants to merge 1 commit into
envoyproxy:mainfrom
mmmommm:feat/gateway-name-label-default-mode
Open

feat: propagate gateway-name label to infra resources in default mode#9478
mmmommm wants to merge 1 commit into
envoyproxy:mainfrom
mmmommm:feat/gateway-name-label-default-mode

Conversation

@mmmommm

@mmmommm mmmommm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

In the default mode, generated proxy infrastructure resources were missing the standard Gateway API gateway.networking.k8s.io/gateway-name label.
That label was only applied in Gateway Namespace Mode, which is why the GatewayInfrastructurePropagation conformance feature passes there but not in the default mode.
This PR propagates the gateway-name label to the generated resources in the default mode as well.

Which issue(s) this PR fixes:

Fixes #9475

confirmed working

defaultMode

$ make kube-install-image
$ make kube-undeploy && make kube-deploy
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: eg
  namespace: default
spec:
  gatewayClassName: eg
  listeners:
    - name: http
      protocol: HTTP
      port: 80

when above Gateway/GatewayClass resources are created in default mode, the generated Deployment, Service, ConfigMap, and ServiceAccount have the metadata label gateway.networking.k8s.io/gateway-name: eg, and that spec.selector.matchLabels does not contain gateway-name.

deployment

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get deploy envoy-default-eg-e41e7b31 -oyaml | yq .metadata.labels
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway
app.kubernetes.io/name: envoy
gateway.envoyproxy.io/owning-gateway-name: eg
gateway.envoyproxy.io/owning-gateway-namespace: default
gateway.networking.k8s.io/gateway-name: eg

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get deploy envoy-default-eg-e41e7b31 -oyaml | yq .spec.selector
matchLabels:
  app.kubernetes.io/component: proxy
  app.kubernetes.io/managed-by: envoy-gateway
  app.kubernetes.io/name: envoy
  gateway.envoyproxy.io/owning-gateway-name: eg
  gateway.envoyproxy.io/owning-gateway-namespace: default

svc

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get svc envoy-default-eg-e41e7b31 -oyaml | yq .spec.selector
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway
app.kubernetes.io/name: envoy
gateway.envoyproxy.io/owning-gateway-name: eg
gateway.envoyproxy.io/owning-gateway-namespace: default
gateway.networking.k8s.io/gateway-name: eg

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get svc envoy-default-eg-e41e7b31 -oyaml | yq .metadata.labels
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway
app.kubernetes.io/name: envoy
gateway.envoyproxy.io/owning-gateway-name: eg
gateway.envoyproxy.io/owning-gateway-namespace: default

configmap

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get cm envoy-default-eg-e41e7b31 -oyaml | yq .metadata.labels
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway
app.kubernetes.io/name: envoy
gateway.envoyproxy.io/owning-gateway-name: eg
gateway.envoyproxy.io/owning-gateway-namespace: default
gateway.networking.k8s.io/gateway-name: eg

serviceAccount

[kind-envoy-gateway|envoy-gateway-system] $ kubectl get sa envoy-default-eg-e41e7b31 -oyaml | yq .metadata.labels
app.kubernetes.io/component: proxy
app.kubernetes.io/managed-by: envoy-gateway
app.kubernetes.io/name: envoy
gateway.envoyproxy.io/owning-gateway-name: eg
gateway.envoyproxy.io/owning-gateway-namespace: default
gateway.networking.k8s.io/gateway-name: eg

PR Checklist

  • Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
  • DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
  • API agreed first: If this PR contains API changes (changes under /api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes.
  • Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
  • Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes.
  • Docs: User-facing changes update the docs, either in this PR or a follow-up PR. N/A if this PR does not contain user-facing changes.
  • Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes.
  • Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed.
  • Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
  • Codex review: Requested a Codex review and addressed all of its comments.
  • Copilot review: Requested a Copilot review and addressed all of its comments.

@netlify

netlify Bot commented Jul 12, 2026

Copy link
Copy Markdown

Deploy Preview for cerulean-figolla-1f9435 ready!

Name Link
🔨 Latest commit 3aa5fda
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a65e65ba3a897000813c076
😎 Deploy Preview https://deploy-preview-9478--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@mmmommm
mmmommm force-pushed the feat/gateway-name-label-default-mode branch 2 times, most recently from 96b0a66 to 804c7ac Compare July 18, 2026 09:33
@mmmommm
mmmommm marked this pull request as ready for review July 18, 2026 10:45
@mmmommm
mmmommm requested a review from a team as a code owner July 18, 2026 10:45
@mmmommm

mmmommm commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@mmmommm

mmmommm commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 804c7ac888

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

labels := r.envoyLabels(extraLabels)
if !r.GatewayNamespaceMode {
if gwName := labels[gatewayapi.OwningGatewayNameLabel]; gwName != "" {
labels[gatewayapi.GatewayNameLabel] = gwName

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Enable the default conformance feature

This adds the gateway-name label in default mode, but default conformance still skips tests.GatewayInfrastructure and still excludes GatewayInfrastructurePropagationFeature in test/conformance/suite.go:77 and test/conformance/suite.go:92. In default-mode conformance reports this change will therefore continue to be reported as unsupported even though the PR is intended to make the feature pass; please remove/update those skips when the default-mode behavior is actually supported.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The GatewayInfrastructure conformance test hardcodes ns to "gateway-conformance-infra" and lists ServiceAccounts/Pods/Services only in that namespace. In default mode, GetResourceNamespace() always returns ControllerNamespace (typically envoy-gateway-system), so the test finds no resources regardless of this label — the namespace model, not the label, is the blocker.

This is consistent with EG's own published default-mode report, where GatewayInfrastructurePropagation is under unsupportedFeatures. It's only supported in gateway-namespace-mode (where infra lives in the Gateway's namespace), which is exactly why the skip is default-mode-only today. Un-skipping would fail the suite.

Happy to file a separate issue to track default-mode support if the upstream test becomes namespace-configurable.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Originally I intended this PR to also enable the default-mode conformance feature, but it turned out not to be feasible 😢

@arkodg

arkodg commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

@zhaohuabing / @zirain any idea why we didnt set this for default case ?

@zhaohuabing

Copy link
Copy Markdown
Member

@zhaohuabing / @zirain any idea why we didnt set this for default case ?

I guess it's because we can't set a proper owner label for mergedGateway, but we should still set it for the non-merged case.

@kkk777-7

Copy link
Copy Markdown
Member

I guess it's because we can't set a proper owner label for mergedGateway, but we should still set it for the non-merged case.

+1
Now we support GWAPI ListenerSet. imo, I'd like to recommend ListenerSet instead of mergedGateway for new deployment.
So, setting label will be better in most case.

@kkk777-7

Copy link
Copy Markdown
Member

Hi @mmmommm , thanks for working this.
could you update PR that set gateway-name label only when non-mergedGateway mode?

@mmmommm

mmmommm commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sure, I’ll update it right away. Thanks for pointing that out!

@mmmommm

mmmommm commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

@kkk777-7

Thanks for the review, the current implementation already handles set gateway-name label only when non-mergedGateway mode.
In merged gateway mode, OwnerLabels() returns only OwningGatewayClassLabel, so the gateway-name label is skipped

https://github.com/envoyproxy/gateway/pull/9478/changes#diff-5404f50bbfe5f6c25e98f8acdf57d874e6fc15b8be0ea84bb1dea0880759de16R199

Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com>
@mmmommm
mmmommm force-pushed the feat/gateway-name-label-default-mode branch from 804c7ac to 3aa5fda Compare July 26, 2026 10:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support GatewayInfrastructurePropagation in default mode

4 participants