kacerr/gatewayapi-certificates-operator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: produce valid listener names for wildcard and unusual DNS names

Browse Source 
A DNS name like *.home.hrajfrisbee.cz put "*" into the listener name; the
API server rejected the patch, which blocked every certificate on that
Gateway.

- lowercase the DNS part, spell "*" as "wildcard", map other characters
  outside [a-z0-9] to "-"
- names over 253 chars are cut and get a hash suffix instead of a blind cut
- names that were valid before are unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
kacerr
2026-10-08 20:47:44 +02:00
co-authored by Claude Opus 5.5
parent 6698eab1d8
commit 42b53b7538
5 changed files with 137 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+7 -4
View File
@@ -55,8 +55,10 @@ A reverse watch maps Gateway events back to the targeting Certificates through t
same index. Manual edits to `auto-*` listeners are reverted only in the fields
`ListenersEqual` compares, and only while at least one Certificate targets the Gateway.
Listeners named `auto-{certName}-{dnsName with dots as dashes}` belong to the
operator. Any other listener is never modified or removed.
Listeners named `auto-{certName}-{sanitized dnsName}` belong to the operator. The DNS
name is lowercased, `*` becomes `wildcard`, anything else outside `[a-z0-9]` becomes
`-`; names over 253 chars are cut and get a hash suffix. Changing this scheme renames
existing listeners on live Gateways. Any other listener is never modified or removed.
`docs/flows.md` has the full control-path reference (startup, watch wiring, decision
tree, scenarios).
@@ -241,8 +243,9 @@ Gitea Actions, workflows in `.gitea/workflows/`:
it does not clean up the old Gateway. A sibling Certificate's next reconcile fixes
it; with no sibling the listener stays forever.
- **A single bad listener blocks the whole Gateway.** The patch replaces the full
listeners array, so a wildcard DNS name (`*` ends up in the listener name) or a name
collision makes the API server reject every update for that Gateway.
listeners array, so a listener-name collision (same cert name in two namespaces,
or two DNS names that sanitize alike, such as `a.b.com` and `a-b.com`) makes the
API server reject every update for that Gateway.
- **`ListenersEqual` is partial**: name, hostname, port and the first secret ref only.
Changing what `BuildListenersFromCertificates` generates in other fields will not
roll out to existing listeners.