Cilium 1.19.6 and later mark an HTTPS-terminate listener and a TLS
passthrough listener on the same port Conflicted whenever their
hostnames intersect, and 1.20 drops both from Envoy. That rejects
*.<apex> HTTPS next to api.<apex> passthrough on 443, which a tenant
Gateway with one address needs. Envoy selects the most specific
server_names match before the transport protocol, so the pair maps every
SNI to exactly one filter chain.
The operator is rebuilt from the upstream tag with a patch that accepts
the pair when the passthrough hostname is strictly narrower than the
HTTPS one, and keeps every other overlap conflicted. The asymmetry is
needed because passthrough chains take their server_names from the
attached TLSRoutes: under a passthrough wildcard a route may claim the
HTTPS listener's exact name, and two chains with one match make Envoy
refuse the whole listener.
The binary replaces the one in the upstream operator-generic image, and
the builder runs the patched packages' tests, so a tag bump that breaks
the patch fails the build. make update re-pins both upstream images by
the digests the vendored chart carries, the builder by upstream's own Go
toolchain, and the source archive by its checksum. The image ref sits
under operator.image.override: committed as the upstream operator the
rebuild starts from, so a tree rendered without a build still pulls an
image that exists, and stamped by make image.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin