gatewayapi: deduplicate upstream TLS clusters by Aias00 · Pull Request #9510 · envoyproxy/gateway

Aias00 · 2026-07-16T00:38:09Z

Fixes #9489.

Summary

reuse stable backend hash cluster names for HTTPRoute/GRPCRoute upstream TLS destinations when the backend and cluster-level configuration match
keep route metadata on the IR while using backend metadata for stable xDS clusters
add regression coverage for cross-route upstream TLS cluster reuse and refresh affected gatewayapi golden outputs
add a breaking-change release note for generated xDS cluster name changes

Tests

git diff --check
go test ./internal/gatewayapi -run 'TestStableClusterRouteDestinationReusesSameTLSBackend|TestStableClusterRouteDestinationUsesXDSClusterInputs|TestTranslateReusesUpstreamTLSClusterForSameBackend|TestTranslate/(backend-tls-auto-host-sni|backend-tls-settings|backend-with-auto-san-sni|backend-with-skip-tls-verify|backendtlspolicy-ca-clustertrustbundle|backendtlspolicy-ca-only-secret|backendtlspolicy-ca-only|backendtlspolicy-conflict|backendtlspolicy-default-ns-targetrefs|backendtlspolicy-multiple-targets|backendtlspolicy-not-conflict-service|backendtlspolicy-not-conflict|backendtlspolicy-serviceimport-target|backendtlspolicy-status-conditions-truncated|backendtlspolicy-subjectaltnames|backendtlspolicy-system-truststore|backendtlspolicy-wildcard-older-than-sectioned|envoyproxy-tls-settings|gateway-tls-frontend-backend|httproute-dynamic-resolver-host-rewriting|httproute-dynamic-resolver|httproute-rule-with-non-service-backends-and-websocket-app-protocols|sds)$'\n- go test ./internal/xds/translator\n- go test ./... fails only in TestTranslate/securitypolicy-with-oidc because https://accounts.google.com/.well-known/openid-configuration times out in this environment\n

Signed-off-by: liuhy <liuhongyu@apache.org>

netlify · 2026-07-16T00:38:14Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`4f7b06b`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a587e11158db40008f126bb
😎 Deploy Preview	https://deploy-preview-9510--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 37f6d25f26

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-16T00:43:12Z

+type stableClusterNameInput struct {
+	RouteType         gwapiv1.Kind               `json:"routeType"`
+	Settings          []stableDestinationSetting `json:"settings"`
+	Traffic           *stableClusterTraffic      `json:"traffic,omitempty"`
+	UseClientProtocol *bool                      `json:"useClientProtocol,omitempty"`
+	StatName          *string                    `json:"statName,omitempty"`
+	RouteHostname     string                     `json:"routeHostname,omitempty"`


Include listener HTTP/1 settings in stable cluster key

When the same upstream-TLS backend is used from two HTTP listeners with different ClientTrafficPolicy HTTP/1 settings, this stable-name input still hashes to the same value. The xDS path passes httpListener.HTTP1 through HTTPRouteTranslator.asClusterArgs and buildTypedExtensionProtocolOptions uses EnableTrailers, PreserveHeaderCase, and HTTP10 to build the cluster's upstream protocol options, so addXdsCluster will skip the second cluster and one listener silently gets the other's upstream HTTP/1 behavior. Include these listener HTTP/1 settings in the stable key or avoid stable naming when they are set.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-16T00:43:12Z

+	Ciphers                     []string                `json:"ciphers,omitempty"`
+	ECDHCurves                  []string                `json:"ecdhCurves,omitempty"`
+	SignatureAlgorithms         []string                `json:"signatureAlgorithms,omitempty"`
+	ALPNProtocols               []string                `json:"alpnProtocols,omitempty"`


Preserve nil versus empty ALPN in stable TLS key

For backend TLS, an empty ALPNProtocols slice explicitly disables ALPN while nil leaves it unset, and the xDS translator only writes CommonTlsContext.AlpnProtocols when the slice is non-nil. Because this field is serialized with omitempty, nil and [] hash identically; two routes to the same backend with otherwise identical TLS settings but different Gateway/EnvoyProxy backend TLS ALPN intent will collide and the first cluster's ALPN behavior will be reused for both.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

This PR addresses Envoy memory growth from duplicated upstream TLS clusters by generating stable, backend-hash-based cluster names for upstream-TLS destinations (when cluster-level inputs match), enabling cluster reuse across routes and reducing redundant TLS context instantiation in Envoy.

Changes:

Introduces stable cluster naming for eligible upstream-TLS destinations in the Gateway API translator.
Adjusts xDS translation to keep IR route metadata while emitting backend metadata on stable backend-hash xDS clusters.
Adds regression tests and refreshes affected golden outputs; adds a breaking-change release note for cluster name changes.

Review findings (required):

internal/gatewayapi/route.go: stableClusterName() returns "" on json.Marshal error, which can silently produce invalid/empty cluster names (see stored comment).

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
release-notes/current/breaking_changes/9489-upstream-tls-cluster-deduplication.md	Documents the breaking change in generated cluster names due to upstream TLS cluster deduplication.
internal/xds/translator/translator.go	Selects backend vs route metadata for xDS clusters when stable backend-hash cluster names are used.
internal/gatewayapi/translator_test.go	Adds regression coverage asserting cross-route reuse of the same upstream TLS cluster and validating emitted cluster metadata.
internal/gatewayapi/route.go	Implements stable backend-hash naming for eligible upstream-TLS route destinations and supporting hashing utilities.
internal/gatewayapi/route_test.go	Adds unit tests for stable cluster destination naming inputs and reuse behavior.
internal/gatewayapi/testdata/sds.out.yaml	Updates golden output to reflect stable backend-hash cluster names.
internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-wildcard-older-than-sectioned.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-not-conflict.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-not-conflict-service.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-conflict.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backendtlspolicy-ca-clustertrustbundle.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backend-with-auto-san-sni.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backend-tls-settings.out.yaml	Updates golden output cluster names to stable backend-hash form.
internal/gatewayapi/testdata/backend-tls-auto-host-sni.out.yaml	Updates golden output cluster names to stable backend-hash form.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+	data, err := json.Marshal(input)
+	if err != nil {
+		return ""
+	}


chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 041015cb10

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-16T02:48:57Z

+					irRoute.Traffic,
+					irRoute.UseClientProtocol,


Include BackendTrafficPolicy inputs in stable cluster key

When two HTTPRoutes or GRPCRoutes share the same upstream-TLS backend but only one is targeted by a BackendTrafficPolicy, this hashes the destination before ProcessBackendTrafficPolicies runs; applyTrafficFeatureToRoute later mutates r.Traffic and r.UseClientProtocol, which are cluster-level inputs used by the xDS translator. Both routes can therefore keep the same backend/<hash> name, so addXdsCluster skips the second cluster and one route silently uses the other's timeout/load-balancer/circuit-breaker/use-client-protocol settings. The stable name either needs to be assigned after policy application or recomputed when these policy-derived fields are set.

Useful? React with 👍 / 👎.

Signed-off-by: liuhy <liuhongyu@apache.org>

codecov · 2026-07-16T06:55:46Z

Codecov Report

❌ Patch coverage is 89.45455% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.55%. Comparing base (3e18557) to head (4f7b06b).

Files with missing lines	Patch %	Lines
internal/gatewayapi/route.go	91.14%	11 Missing and 6 partials ⚠️
internal/xds/translator/translator.go	85.54%	6 Missing and 6 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9510      +/-   ##
==========================================
+ Coverage   75.51%   75.55%   +0.04%     
==========================================
  Files         252      252              
  Lines       41669    41930     +261     
==========================================
+ Hits        31465    31680     +215     
- Misses       8079     8108      +29     
- Partials     2125     2142      +17

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-07-16T10:19:28Z

Hi, @Aias00 I think we should address this as part of mergeBackend feature discussed in #5307.

Aias00 · 2026-07-16T13:28:20Z

address this as part of mergeBackend feature

I agree 🚀🚀

gatewayapi: deduplicate upstream TLS clusters

37f6d25

Signed-off-by: liuhy <liuhongyu@apache.org>

Copilot AI review requested due to automatic review settings July 16, 2026 00:38

Aias00 requested a review from a team as a code owner July 16, 2026 00:38

Copilot started reviewing on behalf of Aias00 July 16, 2026 00:38 View session

Aias00 marked this pull request as draft July 16, 2026 00:40

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread internal/gatewayapi/route.go

Comment on lines +2155 to +2158

data, err := json.Marshal(input)

if err != nil {

return ""

}

Aias00 marked this pull request as ready for review July 16, 2026 02:44

Merge branch 'main' into worktree-issue-9489-upstream-tls-dedup

041015c

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Aias00 added 3 commits July 15, 2026 19:53

gatewayapi: handle stable cluster review feedback

089d3ba

Signed-off-by: liuhy <liuhongyu@apache.org>

xds: include route cluster inputs in stable names

82b2332

Signed-off-by: liuhy <liuhongyu@apache.org>

gatewayapi: fix stable cluster CI failures

4f7b06b

Signed-off-by: liuhy <liuhongyu@apache.org>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

gatewayapi: deduplicate upstream TLS clusters#9510

gatewayapi: deduplicate upstream TLS clusters#9510
Aias00 wants to merge 5 commits into
envoyproxy:mainfrom
Aias00:worktree-issue-9489-upstream-tls-dedup

Aias00 commented Jul 16, 2026

Uh oh!

netlify Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Uh oh!

codecov Bot commented Jul 16, 2026

Uh oh!

zhaohuabing commented Jul 16, 2026

Uh oh!

Aias00 commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Aias00 commented Jul 16, 2026

Summary

Tests

Uh oh!

netlify Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 16, 2026

Codecov Report

Uh oh!

zhaohuabing commented Jul 16, 2026

Uh oh!

Aias00 commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Jul 16, 2026 •

edited

Loading