Merge pull request #4577 from zac-nixon/main

correct regex value handling in gateway api

Author: k8s-ci-robot

pkg/gateway/routeutils/route_rule_condition.go

@@ -77,9 +77,16 @@ func buildHttpPathCondition(path *gwv1.HTTPPathMatch) ([]elbv2model.RuleConditio
 		pathValues = append(pathValues, pathValue)
 	}
 
-	// for regex match, we do not need special processing, it will be taken as it is
+	// for regex match, use RegexValues so ALB applies regex matching instead of glob/value matching
 	if pathType == gwv1.PathMatchRegularExpression {
-		pathValues = append(pathValues, pathValue)
+		return []elbv2model.RuleCondition{
+			{
+				Field: elbv2model.RuleConditionFieldPathPattern,
+				PathPatternConfig: &elbv2model.PathPatternConditionConfig{
+					RegexValues: []string{pathValue},
+				},
+			},
+		}, nil
 	}
 
 	return []elbv2model.RuleCondition{

pkg/gateway/routeutils/route_rule_condition_test.go

@@ -213,7 +213,7 @@ func Test_buildHttpPathCondition(t *testing.T) {
 				{
 					Field: elbv2model.RuleConditionFieldPathPattern,
 					PathPatternConfig: &elbv2model.PathPatternConditionConfig{
-						Values: []string{regexPathValue},
+						RegexValues: []string{regexPathValue},
 					},
 				},
 			},

test/e2e/gateway/alb_ip_target_test.go

@@ -1954,4 +1954,150 @@ var _ = Describe("test k8s alb gateway using ip targets reconciled by the aws lo
 			})
 		})
 	})
+	Context("with ALB ip target configuration with HTTPRoute path match types (Exact, Prefix, RegularExpression)", func() {
+		BeforeEach(func() {})
+		It("should create listener rules with correct path-pattern condition types on the ALB", func() {
+			interf := elbv2gw.LoadBalancerSchemeInternetFacing
+			lbcSpec := elbv2gw.LoadBalancerConfigurationSpec{
+				Scheme: &interf,
+			}
+			ipTargetType := elbv2gw.TargetTypeIP
+			tgSpec := elbv2gw.TargetGroupConfigurationSpec{
+				DefaultConfiguration: elbv2gw.TargetGroupProps{
+					TargetType: &ipTargetType,
+				},
+			}
+			lrcSpec := elbv2gw.ListenerRuleConfigurationSpec{}
+			gwListeners := []gwv1.Listener{
+				{
+					Name:     "test-listener",
+					Port:     80,
+					Protocol: gwv1.HTTPProtocolType,
+				},
+			}
+
+			httpr := BuildHTTPRoute([]string{}, httpRouteRulesWithPathMatchers, nil)
+			By("deploying stack", func() {
+				err := stack.DeployHTTP(ctx, nil, tf, gwListeners, []*gwv1.HTTPRoute{httpr}, lbcSpec, tgSpec, lrcSpec, nil, true)
+				Expect(err).NotTo(HaveOccurred())
+			})
+
+			By("checking gateway status for lb dns name", func() {
+				dnsName = stack.GetLoadBalancerIngressHostName()
+				Expect(dnsName).ToNot(BeEmpty())
+			})
+
+			By("querying AWS loadbalancer from the dns name", func() {
+				var err error
+				lbARN, err = tf.LBManager.FindLoadBalancerByDNSName(ctx, dnsName)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(lbARN).ToNot(BeEmpty())
+			})
+
+			By("verifying AWS loadbalancer resources", func() {
+				expectedTargetGroups := []verifier.ExpectedTargetGroup{
+					{
+						Protocol:      "HTTP",
+						Port:          80,
+						NumTargets:    int(*stack.albResourceStack.commonStack.dps[0].Spec.Replicas),
+						TargetType:    "ip",
+						TargetGroupHC: DEFAULT_ALB_TARGET_GROUP_HC,
+					},
+				}
+				err := verifier.VerifyAWSLoadBalancerResources(ctx, tf, lbARN, verifier.LoadBalancerExpectation{
+					Type:         "application",
+					Scheme:       "internet-facing",
+					Listeners:    stack.albResourceStack.getListenersPortMap(),
+					TargetGroups: expectedTargetGroups,
+				})
+				Expect(err).NotTo(HaveOccurred())
+			})
+
+			By("verifying listener rules have correct path condition types", func() {
+				err := verifier.VerifyLoadBalancerListenerRules(ctx, tf, lbARN, int32(gwListeners[0].Port), []verifier.ListenerRuleExpectation{
+					{
+						// Rule 1: Exact path match uses Values
+						Conditions: []elbv2types.RuleCondition{
+							{
+								Field: awssdk.String(string(elbv2model.RuleConditionFieldPathPattern)),
+								PathPatternConfig: &elbv2types.PathPatternConditionConfig{
+									Values: []string{testExactPath},
+								},
+							},
+						},
+						Actions: []elbv2types.Action{
+							{
+								Type: elbv2types.ActionTypeEnum(elbv2model.ActionTypeForward),
+								ForwardConfig: &elbv2types.ForwardActionConfig{
+									TargetGroups: []elbv2types.TargetGroupTuple{
+										{
+											TargetGroupArn: awssdk.String(testTargetGroupArn),
+											Weight:         awssdk.Int32(1),
+										},
+									},
+								},
+							},
+						},
+						Priority: 1,
+					},
+					{
+						// Rule 2: Prefix path match uses Values with wildcard expansion
+						Conditions: []elbv2types.RuleCondition{
+							{
+								Field: awssdk.String(string(elbv2model.RuleConditionFieldPathPattern)),
+								PathPatternConfig: &elbv2types.PathPatternConditionConfig{
+									Values: []string{testPrefixPath, fmt.Sprintf("%s/*", testPrefixPath)},
+								},
+							},
+						},
+						Actions: []elbv2types.Action{
+							{
+								Type: elbv2types.ActionTypeEnum(elbv2model.ActionTypeForward),
+								ForwardConfig: &elbv2types.ForwardActionConfig{
+									TargetGroups: []elbv2types.TargetGroupTuple{
+										{
+											TargetGroupArn: awssdk.String(testTargetGroupArn),
+											Weight:         awssdk.Int32(1),
+										},
+									},
+								},
+							},
+						},
+						Priority: 2,
+					},
+					{
+						// Rule 3: RegularExpression path match uses RegexValues
+						Conditions: []elbv2types.RuleCondition{
+							{
+								Field: awssdk.String(string(elbv2model.RuleConditionFieldPathPattern)),
+								PathPatternConfig: &elbv2types.PathPatternConditionConfig{
+									RegexValues: []string{testRegexPath},
+								},
+							},
+						},
+						Actions: []elbv2types.Action{
+							{
+								Type: elbv2types.ActionTypeEnum(elbv2model.ActionTypeForward),
+								ForwardConfig: &elbv2types.ForwardActionConfig{
+									TargetGroups: []elbv2types.TargetGroupTuple{
+										{
+											TargetGroupArn: awssdk.String(testTargetGroupArn),
+											Weight:         awssdk.Int32(1),
+										},
+									},
+								},
+							},
+						},
+						Priority: 3,
+					},
+				})
+				Expect(err).NotTo(HaveOccurred())
+			})
+
+			By("waiting for target group targets to be healthy", func() {
+				err := verifier.WaitUntilTargetsAreHealthy(ctx, tf, lbARN, int(*stack.albResourceStack.commonStack.dps[0].Spec.Replicas))
+				Expect(err).NotTo(HaveOccurred())
+			})
+		})
+	})
 })

test/e2e/gateway/consts.go

@@ -318,4 +318,45 @@ const (
 	testOidcAuthorizationEndpoint = "https://test-oidc-provider.example.com/oauth2/authorize"
 	testOidcTokenEndpoint         = "https://test-oidc-provider.example.com/oauth2/token"
 	testOidcUserInfoEndpoint      = "https://test-oidc-provider.example.com/oauth2/userinfo"
+	// constants used in path matcher tests
+	testExactPath  = "/exact-match-path"
+	testPrefixPath = "/prefix-match"
+	testRegexPath  = "/regex/[a-z]+/items"
 )
+
+// httpRouteRulesWithPathMatchers defines HTTPRoute rules exercising Exact, Prefix, and RegularExpression path types.
+var httpRouteRulesWithPathMatchers = []gwv1.HTTPRouteRule{
+	{
+		Matches: []gwv1.HTTPRouteMatch{
+			{
+				Path: &gwv1.HTTPPathMatch{
+					Type:  &[]gwv1.PathMatchType{gwv1.PathMatchExact}[0],
+					Value: awssdk.String(testExactPath),
+				},
+			},
+		},
+		BackendRefs: DefaultHttpRouteRuleBackendRefs,
+	},
+	{
+		Matches: []gwv1.HTTPRouteMatch{
+			{
+				Path: &gwv1.HTTPPathMatch{
+					Type:  &[]gwv1.PathMatchType{gwv1.PathMatchPathPrefix}[0],
+					Value: awssdk.String(testPrefixPath),
+				},
+			},
+		},
+		BackendRefs: DefaultHttpRouteRuleBackendRefs,
+	},
+	{
+		Matches: []gwv1.HTTPRouteMatch{
+			{
+				Path: &gwv1.HTTPPathMatch{
+					Type:  &[]gwv1.PathMatchType{gwv1.PathMatchRegularExpression}[0],
+					Value: awssdk.String(testRegexPath),
+				},
+			},
+		},
+		BackendRefs: DefaultHttpRouteRuleBackendRefs,
+	},
+}

test/framework/verifier/aws_resource_verifier.go

@@ -490,6 +490,9 @@ func verifyListenerRuleConditions(actual, expected []elbv2types.RuleCondition) e
 					if !slices.Equal(actualCondition.PathPatternConfig.Values, expectedCondition.PathPatternConfig.Values) {
 						return errors.Errorf("expected listener rule condition path-pattern values %v, got %v", expectedCondition.PathPatternConfig.Values, actualCondition.PathPatternConfig.Values)
 					}
+					if !slices.Equal(actualCondition.PathPatternConfig.RegexValues, expectedCondition.PathPatternConfig.RegexValues) {
+						return errors.Errorf("expected listener rule condition path-pattern regex values %v, got %v", expectedCondition.PathPatternConfig.RegexValues, actualCondition.PathPatternConfig.RegexValues)
+					}
 				}
 			}
 			if !foundPath {