fix(gateway): pin identical allowedRoutes.kinds on port 443 listeners (cilium#45559) - #3084

Code Review

This pull request addresses an issue (cilium#45559) where divergent allowedRoutes.kinds on the same port causes Cilium to collapse port-443 listeners and drop HTTPRoutes. To resolve this, both HTTPS-terminate and TLS-passthrough listeners on port 443 now share the same kinds set containing both HTTPRoute and TLSRoute. The corresponding unit tests have been updated, and a new regression test TestReconcile_Port443ListenersShareKinds has been added to ensure port-443 listeners share the same kinds. There are no review comments to assess, and the changes look correct and well-tested.

NOT LGTM — the fix is correct and security-preserving (verified against the shipped Cilium 1.19.5 source), but the test suite is incomplete: it pins only positive/happy-path behavior in one cert mode and has no negative tests documenting what must not be rendered.

Business context: default TenantGateways on Cilium 1.19.x silently drop HTTPRoutes because divergent per-listener allowedRoutes.kinds on port 443 trigger cilium#45559 (issue #3070).

Blockers

B1: Tests are positive-only — missing negative tests and the bug's real cert mode

Treat the tests as the executable spec for this contract: they must document both how it should work and how it must not. Right now every assertion is happy-path ("the rendered listener carries {HTTPRoute, TLSRoute}"), and the one test that collects all port-443 listeners and asserts they're identical (TestReconcile_Port443ListenersShareKinds) runs in HTTP-01 only. Three things are unpinned:

1. Negative — forbidden kinds (security boundary). No test asserts that GRPCRoute / TCPRoute / UDPRoute never appear on any port-443 listener. This is the whole reason the kinds set is restricted rather than dropped: those kinds aren't covered by the cozystack-route-hostname-policy VAP, so allowing them would let a route attach by hostname and bypass the apex check. Today this is only implied by len(kinds)==2; it should be asserted by name so the contract is explicit.
2. Negative — no empty/default set. No test asserts that no port-443 listener has empty or nil AllowedRoutes.Kinds. An empty set means the Gateway API default (all kinds for the protocol) applies — the same VAP-bypass hole. The "restricted, never default" property is the security invariant and isn't pinned.
3. Anti-collapse not covered in the bug's actual mode. The reported shape (#3070) is the DNS-01 / existingSecret root gateway: wildcard + apex + child-apex terminate listeners rendered together with TLS-passthrough on :443. The DNS-01 subtest of TestReconcile_HTTPSListenersRestrictRouteKindsToHTTPRoute has no passthrough services, and TestReconcile_ExistingSecretModeKeepsHTTPRedirectAndPassthrough renders the mix but asserts only that the passthrough listener exists — not its kinds, not the cross-listener identity. So the fix could regress in exactly the mode the bug manifests in and the suite would stay green.

How to close it (guidance, not a prescription):

• Make the "collect every port-443 listener" assertion table-driven over all three cert modes (HTTP-01, DNS-01, existingSecret); each case seeds ≥1 terminate listener and TLSPassthroughServices, and the DNS-01/existingSecret cases also seed an inheriting child namespace so the *.<child-apex> listener is included in the sweep.
• In that sweep assert the full contract per listener: (a) kinds equal the canonical set {HTTPRoute, TLSRoute} including the API group; (b) the set is identical across all :443 listeners; (c) it is non-empty; (d) it contains none of GRPCRoute / TCPRoute / UDPRoute.
• Add at least one explicitly negative case whose name and comment state the failure mode it guards (e.g. "forbidden route kinds never reach a :443 listener — they would bypass the route-hostname VAP" and "divergent kinds across :443 listeners — would re-trigger cilium#45559"). The test name should read as the requirement.

Non-blocking follow-ups

1. The code comment ("listing HTTPRoute here is harmless") understates one effect: on Cilium 1.19.x every port-443 listener surfaces ResolvedRefs=False / InvalidRouteKinds on the raw Gateway. It's cosmetic (Accepted/Programmed, traffic, security, and TenantGateway readiness are all unaffected — readiness checks only Accepted+Programmed), but worth a one-line note so operators inspecting kubectl get gateway -o yaml aren't surprised. Removable once Cilium 1.20 (with #45693) ships.
2. Add Closes #3070.
3. A gateway e2e run on a live 1.19.x cluster would turn the static proof that routing/passthrough still works into empirical confirmation.

LGTM — the test-completeness blocker from the previous review is resolved.

The new assertPort443Contract sweep pins all three parts of the contract on every port-443 listener: (1) identical kinds across all listeners, (2) the forbidden kinds GRPCRoute/TCPRoute/UDPRoute never appear by name (with the route-hostname VAP-bypass rationale spelled out), and (3) the set is non-empty/non-nil. It runs table-driven across all three cert modes — HTTP-01, DNS-01, and existingSecret — each with a TLS-passthrough service so a terminate + passthrough mix is actually rendered on port 443. The DNS-01 and existingSecret cases seed an inheriting child namespace (namespace.cozystack.io/gateway + host labels) so collectInheritingChildApexes renders the per-child-apex listener and it is included in the sweep — covering the production root-gateway shape the bug manifests in, not just HTTP-01. I ran the package locally and all tests pass.

The reconciler.go comment now also documents the cosmetic ResolvedRefs=False/InvalidRouteKinds condition every port-443 listener surfaces on Cilium 1.19.x (Accepted/Programmed/traffic/TenantGateway-readiness all unaffected; removable once Cilium 1.20 ships), which addresses the earlier non-blocking note.

Approving.