Add GatewayPolicy to generate-manifests and rewrite targetRef group v1beta1 to v1 by binilvrgs · Pull Request #5604 · hashicorp/consul-k8s

binilvrgs · 2026-08-22T15:07:09Z

Changes proposed in this PR

Add GatewayPolicy to the generate-manifests pre-upgrade snapshot job which was previously missing, causing GatewayPolicy resources to be silently lost during Consul Helm upgrades
Add convertGatewayPolicyTargetRef() to rewrite spec.targetRef.group from gateway.networking.k8s.io/v1beta1 to gateway.networking.k8s.io/v1 in both the gatewayapi and consulapi snapshot paths, to match the graduated Gateway API version
Update gatewayForGatewayPolicy() index function to accept both v1 and v1beta1 group strings for backward compatibility during transition
Add kindGatewayPolicy constant and GatewayPolicyList case in extractItems() following existing patterns

How I've tested this PR

Tested against a live EKS cluster (v1.34.9-eks-b3f9404, us-east-1):

Test 1: Created a GatewayPolicy in the cluster with spec.targetRef.group: gateway.networking.k8s.io/v1beta1 to simulate pre-upgrade customer state
Test 2: Built the old binary (before fix), ran generate-manifests — confirmed gatewaypolicies/ folder was absent from snapshot (bug proven)
Test 3: Built the new binary (after fix), ran generate-manifests — confirmed gatewaypolicies/ folder present in both gatewayapi/ and consulapi/ snapshot paths
Test 4: Inspected generated YAML — confirmed spec.targetRef.group was correctly rewritten from v1beta1 to v1

Unit tests:
ok github.com/hashicorp/consul-k8s/control-plane/subcommand/generate-manifests 2.907s
ok github.com/hashicorp/consul-k8s/control-plane/api/v1alpha1 1.620s

How I expect reviewers to test this PR

Create a GatewayPolicy with spec.targetRef.group: gateway.networking.k8s.io/v1beta1 in a test cluster
Run generate-manifests with the new binary
Verify gatewaypolicies/ folder is created under the output directory
Verify spec.targetRef.group in the generated YAML is gateway.networking.k8s.io/v1

Checklist

Tests added
CHANGELOG entry added

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

…f group v1beta1 to v1

… for gatewayapi snapshot path

…ading_gateway_policy

github-actions · 2026-08-22T15:25:35Z

Go Test Coverage: 61.5%

Patch coverage: 100.0% (36/36 changed lines covered)

See the workflow run for the full per-package breakdown and downloadable HTML report.

codecov-commenter · 2026-08-22T15:28:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.67%. Comparing base (cb007b6) to head (bde7dfd).
⚠️ Report is 15 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5604      +/-   ##
==========================================
+ Coverage   58.62%   58.67%   +0.05%     
==========================================
  Files         298      298              
  Lines       36767    36796      +29     
==========================================
+ Hits        21554    21590      +36     
+ Misses      13268    13263       -5     
+ Partials     1945     1943       -2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

vdinesh4738 · 2026-08-25T04:14:50Z

 		convertToConsulRoute(raw)

+	case kindGatewayPolicy:
+		convertGatewayPolicyTargetRef(raw)


Why are you enforcing the gateway.networking.k8s.io in here?

Instead it should be the consul.hashicorp.com/v1beta1

enforceConsulApiVersion() is the /consulapi/ path where the Gateway is already converted to consul.hashicorp.com. So GatewayPolicy.spec.targetRef.group must also point to consul.hashicorp.com in that path, not gateway.networking.k8s.io/v1.

Proposed fix:

// Replace convertGatewayPolicyTargetRef(raw) with a new helper: case kindGatewayPolicy: convertToConsulGatewayPolicy(raw)

func convertToConsulGatewayPolicy(raw map[string]interface{}) { raw["apiVersion"] = consulAPIGroup + "/" + "v1alpha1" spec := getSpec(raw) if spec == nil { return } targetRef, ok := spec["targetRef"].(map[string]interface{}) if !ok { return } // rewrite targetRef.group to consul.hashicorp.com // so it references the consul-managed gateway if targetRef["group"] == K8sGatewayAPIGroup+"/"+K8sGatewayAPIVersionV1Beta1 || targetRef["group"] == K8sGatewayAPIGroup+"/"+K8sGatewayAPIVersionV1 { targetRef["group"] = consulAPIGroup } }

Does this look correct to you?

…rom v1beta1 to v1

…ading_gateway_policy

vdinesh4738 · 2026-08-25T17:27:22Z

@@ -0,0 +1,3 @@
+```release-note:bug
+control-plane: add GatewayPolicy to generate-manifests snapshot and rewrite targetRef group from gateway.networking.k8s.io/v1beta1 to v1


please update the change log to "api-gateway: Fix generate-manifest to correctly generate GatewayPolicy manifests."

Updated the changelog

vdinesh4738 · 2026-08-25T17:29:31Z

+// and updates the targetRef group to consul.hashicorp.com so the policy correctly
+// references the consul-managed Gateway in the consulapi snapshot path.
+func convertToConsulGatewayPolicy(raw map[string]interface{}) {
+	raw["apiVersion"] = consulAPIGroup + "/" + "v1alpha1"


gateway policies are already under the apiVersion consul.hashicorp.com/v1alpha1

Removed redundant apiVersion set in convertToConsulGatewayPolicy

vdinesh4738 · 2026-08-25T17:31:01Z

+	}
+	if targetRef["group"] == K8sGatewayAPIGroup+"/"+K8sGatewayAPIVersionV1Beta1 ||
+		targetRef["group"] == K8sGatewayAPIGroup+"/"+K8sGatewayAPIVersionV1 {
+		targetRef["group"] = consulAPIGroup


shouldn't this be targetRef["group"] = consulAPIGroup+"/" +consulAPIVersionV1Alpha2

The group field in spec.targetRef is an API group — it is consul.hashicorp.com, never consul.hashicorp.com/v1alpha2. API groups never carry a version suffix. The version lives in apiVersion (group/version) but group alone is just consul.hashicorp.com.

apiVersion: consul.hashicorp.com/v1alpha1 kind: GatewayPolicy metadata: name: my-gateway-policy namespace: default spec: targetRef: group: "gateway.networking.k8s.io/v1beta1" # must match hardcoded check in webhook kind: Gateway name: my-gateway namespace: default sectionName: "https-listener"

this is the sample for GatewayPolicy.

the example you are telling is for Gateway not for GatewayPolicy

applied the changed mentioned,
But it should be consulAPIGroup+"/" + consulAPIVersionV1Alpha1 not ...V1Alpha2

vdinesh4738 · 2026-08-25T17:31:52Z

+		{
+			name:          "v1 group (already rewritten) rewritten to consul",
+			inputGroup:    "gateway.networking.k8s.io/v1",
+			wantTargetRef: "consul.hashicorp.com",


It should be consul.hashicorp.com/v1alpha2

targetRef.group is an API group identifier, not an apiVersion — it never carries a version suffix.

vdinesh4738 · 2026-08-25T17:32:01Z

+		{
+			name:          "v1beta1 group rewritten to consul",
+			inputGroup:    "gateway.networking.k8s.io/v1beta1",
+			wantTargetRef: "consul.hashicorp.com",


It should be consul.hashicorp.com/v1alpha2

targetRef.group is an API group identifier, not an apiVersion — it never carries a version suffix.

…pdate changelog

…oConsulGatewayPolicy for consistency with group/version convention

…ConsulGatewayPolicy to match converted Gateway apiVersion

…ading_gateway_policy

…itch cases

vdinesh4738 · 2026-08-31T08:38:15Z

 		{"UDPRoute", "UDPRoute", "gateway.networking.k8s.io/v1alpha2", "gateway.networking.k8s.io/v1alpha2"},
 		{"TLSRoute", "TLSRoute", "gateway.networking.k8s.io/v1alpha2", "gateway.networking.k8s.io/v1alpha2"},
 		{"TCPRoute", "TCPRoute", "gateway.networking.k8s.io/v1alpha2", "gateway.networking.k8s.io/v1alpha2"},
+		{"GatewayPolicy", "GatewayPolicy", "gateway.networking.k8s.io/v1beta1", "gateway.networking.k8s.io/v1beta1"},


GatewayPolicy API group is "consul.hashicorp.com/v1alpha1". Please update it. Also add a test case for the GatewayPolicy check at targetRef level.

…nsul apiVersion and assert targetRef group rewrite

vdinesh4738 · 2026-08-31T09:29:24Z

+				"kind":       tc.kind,
+				"apiVersion": tc.APIGroup,
+				"spec": map[string]interface{}{
+					"targetRef": map[string]interface{}{


this will be there only for gatewayPolicy. Though it is a test case we should not enforce it on all the objects. Have a kind check for "gatewayPolicy" and have the targetRef only for GatewayPolicy

…tewayAPIVersion

binilvrgs added 2 commits August 20, 2026 12:57

add GatewayPolicy to generate-manifests snapshot and rewrite targetRe…

fe7e331

…f group v1beta1 to v1

fix GatewayPolicy targetRef group rewrite in enforceGatewayAPIVersion…

9c14818

… for gatewayapi snapshot path

binilvrgs requested review from a team as code owners August 22, 2026 15:07

binilvrgs added 2 commits August 22, 2026 20:38

add changelog for PR 5604

88d31ca

Merge branch 'main' into feature/binilvrgs/generate_manifest_job_upgr…

0b84ed4

…ading_gateway_policy

binilvrgs added backport/1.8.x Backport to release/1.8.x branch backport/1.9.x Backport to release/1.9.x branch backport/2.0.x Backport to release/2.0.x branch labels Aug 22, 2026

vdinesh4738 requested changes Aug 25, 2026

View reviewed changes

add GatewayPolicy to generate-manifests and rewrite targetRef group f…

1ca3f80

…rom v1beta1 to v1

vdinesh4738 removed the backport/1.9.x Backport to release/1.9.x branch label Aug 25, 2026

Merge branch 'main' into feature/binilvrgs/generate_manifest_job_upgr…

ab07f43

…ading_gateway_policy

vdinesh4738 requested changes Aug 26, 2026

View reviewed changes

remove redundant apiVersion set in convertToConsulGatewayPolicy and u…

a13c724

…pdate changelog

binilvrgs force-pushed the feature/binilvrgs/generate_manifest_job_upgrading_gateway_policy branch from 901cecc to a13c724 Compare August 27, 2026 07:11

fix: use consul.hashicorp.com/v1alpha1 as targetRef group in convertT…

aa711d9

…oConsulGatewayPolicy for consistency with group/version convention

binilvrgs force-pushed the feature/binilvrgs/generate_manifest_job_upgrading_gateway_policy branch from 15d9fe8 to aa711d9 Compare August 27, 2026 13:59

binilvrgs changed the title ~~Add GatewayPolicy to generate-manifests snapshot and rewrite targetRef group v1beta1 to v1~~ Add GatewayPolicy to generate-manifests and rewrite targetRef group v1beta1 to v1 Aug 27, 2026

binilvrgs added 4 commits August 31, 2026 12:37

fix: set targetRef group to consul.hashicorp.com/v1beta1 in convertTo…

2ad945d

…ConsulGatewayPolicy to match converted Gateway apiVersion

Merge branch 'main' into feature/binilvrgs/generate_manifest_job_upgr…

b73612a

…ading_gateway_policy

test: improve GatewayPolicy coverage — add guard tests and enforce sw…

f2eb7c6

…itch cases

test: cover GatewayPolicy extractItems loop and dump error-log branch

b6eb17a

vdinesh4738 requested changes Aug 31, 2026

View reviewed changes

test: fix GatewayPolicy case in TestEnforceGatewayAPIVersion — use co…

66dd573

…nsul apiVersion and assert targetRef group rewrite

vdinesh4738 requested changes Aug 31, 2026

View reviewed changes

test: add spec.targetRef only for GatewayPolicy kind in TestEnforceGa…

bde7dfd

…tewayAPIVersion

		@@ -0,0 +1,3 @@
		```release-note:bug
		control-plane: add GatewayPolicy to generate-manifests snapshot and rewrite targetRef group from gateway.networking.k8s.io/v1beta1 to v1

Uh oh!

Conversation

binilvrgs commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes proposed in this PR

How I've tested this PR

How I expect reviewers to test this PR

Checklist

PCI review checklist

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Go Test Coverage: 61.5%

Uh oh!

codecov-commenter commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

binilvrgs commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

codecov-commenter commented Aug 22, 2026 •

edited

Loading