[1.17] fix: Reject a hybridGateway with no delegatedHttpGateways when…

… no VS exist (#9659)

* fix: Reject a hybridGateway with no delegatedHttpGateways when no VS exist (#9647)

* fix: Reject a hybridGateway with no delegatedHttpGateways

* add tests

* Modify check

* rename tests

* Update changelog/v1.18.0-beta1/fix-aggregate-gateway-error.yaml

Co-authored-by: Nathan Fudenberg <[email protected]>

* fix changelog

* Adding changelog file to new location

* Deleting changelog file from old location

---------

Co-authored-by: Nathan Fudenberg <[email protected]>
Co-authored-by: soloio-bulldozer[bot] <48420018+soloio-bulldozer[bot]@users.noreply.github.com>
Co-authored-by: changelog-bot <changelog-bot>

* move changelog

---------

Co-authored-by: Nathan Fudenberg <[email protected]>
Co-authored-by: soloio-bulldozer[bot] <48420018+soloio-bulldozer[bot]@users.noreply.github.com>

changelog/v1.17.0-rc6/fix-aggregate-gateway-error.yaml

@@ -0,0 +1,6 @@
+changelog:
+- type: FIX
+  issueLink: https://github.com/solo-io/gloo/issues/8834
+  resolvesIssue: false
+  description: >-
+    Fix a bug where a hybrid gateway with non existing delegatedHttpGateways is accepted if no virtual services exist. This would only occur when the flag for isolating virtualservices by ssl configs is enabled. 

projects/gateway/pkg/translator/aggregate_translator.go

@@ -49,9 +49,10 @@ func (a *AggregateTranslator) ComputeListener(params Params, proxyName string, g
 	case *v1.Gateway_HybridGateway:
 		hybrid := gw.HybridGateway
 
-		// warn early if there are no virtual services and no tcp configurations
-		if len(snap.VirtualServices) == 0 {
-			hasTCP := hybrid.GetDelegatedTcpGateways() != nil
+		// warn early if there are no virtual services, no tcp configurations and no delegated gateways
+		var hasDelegatedGateways = hybrid.GetDelegatedTcpGateways() != nil || hybrid.GetDelegatedHttpGateways() != nil
+		if len(snap.VirtualServices) == 0 && !hasDelegatedGateways {
+			var hasTCP = false
 			if !hasTCP && hybrid.GetMatchedGateways() != nil {
 				for _, matched := range hybrid.GetMatchedGateways() {
 					if matched.GetTcpGateway() != nil {

projects/gateway/pkg/translator/aggregate_translator_test.go

@@ -7,6 +7,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"github.com/solo-io/gloo/pkg/utils/settingsutil"
+	"github.com/solo-io/gloo/projects/gloo/pkg/api/v1/core/selectors"
 	"github.com/solo-io/gloo/projects/gloo/pkg/api/v1/ssl"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -197,4 +198,29 @@ var _ = Describe("Aggregate translator", func() {
 			Expect(reports.ValidateStrict()).NotTo(HaveOccurred())
 		})
 	})
+
+	When("The delegated gateways do not exist", func() {
+		JustBeforeEach(func() {
+			snap.VirtualServices = []*v1.VirtualService{}
+		})
+
+		It("throws an error", func() {
+			aggregateTranslator := &AggregateTranslator{VirtualServiceTranslator: &VirtualServiceTranslator{}}
+			genProxyWithIsolatedVirtualHosts()
+			proxyName := proxy.Metadata.Name
+			gw := snap.Gateways[2]
+			gw.GetHybridGateway().MatchedGateways = nil
+			gw.GetHybridGateway().DelegatedHttpGateways = &v1.DelegatedHttpGateway{
+				SelectionType: &v1.DelegatedHttpGateway_Selector{
+					Selector: &selectors.Selector{
+						Labels: map[string]string{"non-existing": "gateway"},
+					},
+				},
+			}
+			snap.Gateways = v1.GatewayList{gw}
+			l := aggregateTranslator.ComputeListener(NewTranslatorParams(ctx, snap, reports), proxyName, gw)
+			Expect(l).To(BeNil())
+			Expect(reports.ValidateStrict().Error()).To(ContainSubstring(EmptyHybridGatewayMessage))
+		})
+	})
 })

projects/gateway/pkg/translator/http_translator.go

@@ -30,7 +30,6 @@ func (t *HttpTranslator) ComputeListener(params Params, proxyName string, gatewa
 			contextutils.LoggerFrom(params.ctx).Debugf("but continuing since translateEmptyGateways is set", snapHash)
 		} else {
 			return nil
-
 		}
 	}