gateway: the port-80 allow-list contains the namespace its own comment says it excludes #3788

The comment above buildHTTPListenerAllowedRoutes says the port-80 listener is closed to the namespaces applications live in. The code puts one of those namespaces on the allow-list.

// created before the controller's redirect would silently serve
// plaintext on port 80 and leak credentials. Restricting the HTTP
// listener's allowedRoutes namespaces excludes the cozy-* / tenant-*
// namespaces apps live in, while keeping cert-manager's challenge
// namespace open so ACME still completes.
func buildHTTPListenerAllowedRoutes(tgw *gatewayv1alpha1.TenantGateway) *gatewayv1.AllowedRoutes {
	values := []string{tgw.Namespace}

When a tenant runs its own gateway, tgw.Namespace is that tenant's namespace, which is exactly where its applications live. The allow-list therefore contains what the comment promises to exclude, in the configuration the comment was written for.

What follows from that, as far as I traced it: an application chart placing an HTTPRoute in its release namespace and naming the gateway in parentRefs passes the namespace filter. Charts that do not set sectionName (harbor is one) attach to every listener, port 80 included. Between that route's exact hostname and the redirect's wildcard, Gateway API gives precedence to the longer non-wildcard match, so the request is served by the backend rather than redirected.

Marking the evidence, since the two halves are not equally established. The allow-list contents and the comment text are read directly from main. The precedence rule is taken from the spec text (go doc sigs.k8s.io/gateway-api/apis/v1.HTTPRouteSpec: precedence to the rule with the most "characters in a matching non-wildcard hostname"), not reproduced on a cluster.

packages/extra/gateway/README.md repeats the claim in its Layer 1 section, so the same statement is in two places.

This is pre-existing and is not introduced by any open PR: the paragraph is present on main unchanged, and the behaviour predates the redirect gaining hostnames — before that the redirect matched everything and ranked even lower by the same rule.

The case the comment describes correctly is the other one: an application whose namespace differs from the gateway's is filtered out as intended. What is not covered is the tenant-owned gateway, where the two namespaces coincide.

Either the allow-list needs to stop being the gateway's own namespace for this case, or the comment and the README need to say what actually holds. The first is a behaviour change and needs someone who knows why the namespace was put there.