fix container publish args duplicates - container fails to deploy

[loehde]

Bug: duplicate --publish=443/tcp when Gateway has multiple HTTPS listeners on the same port

Problem

When a Gateway defines multiple HTTPS listeners on the same port (443) with different hostnames, cloud-provider-kind attempts to create the gateway container with duplicate Docker publish arguments:

--publish=443/tcp --publish=443/tcp

Docker then fails to create the container with exit status 125.

This occurs when the Gateway includes both:

protocol: HTTPS
port: 443
hostname: "*.birdyleaf.test"

and:

protocol: HTTPS
port: 443
hostname: birdyleaf.test

Since both listeners use the same protocol and port, the generated Docker container should only publish port 443/tcp once.

Expected behavior

The gateway container should be created successfully.

For multiple listeners using the same protocol and port, the Docker publish argument should be deduplicated, for example:

--publish=443/tcp

Actual behavior

Container creation fails because Docker receives duplicate publish arguments:

--publish=443/tcp --publish=443/tcp

The controller reports:

Error syncing Gateway default/birdyleaf-gateway: failed to ensure gateway container kindccm-gw-15a36518b9b6: failed to create containers kindccm-gw-15a36518b9b6 [...] --publish=443/tcp --publish=443/tcp --publish-all docker.io/envoyproxy/envoy:v1.33.2 [...] exit status 125

Error log

I0520 12:10:19.336014 50788 controller.go:666] Error syncing Gateway default/birdyleaf-gateway: failed to ensure gateway container kindccm-gw-15a36518b9b6: failed to create containers kindccm-gw-15a36518b9b6 [--detach --tty --user=0 --label io.x-k8s.cloud-provider-kind.cluster=kind --label io.x-k8s.cloud-provider-kind.gateway.name=kind/default/birdyleaf-gateway --net kind --dns 10.96.0.10 --init=false --hostname kindccm-gw-15a36518b9b6 --privileged --restart=on-failure --sysctl=net.ipv4.ip_forward=1 --sysctl=net.ipv4.conf.all.rp_filter=0 --sysctl=net.ipv4.ip_unprivileged_port_start=1 --sysctl=net.ipv6.conf.all.disable_ipv6=0 --sysctl=net.ipv6.conf.all.forwarding=1 --publish=443/tcp --publish=443/tcp --publish-all docker.io/envoyproxy/envoy:v1.33.2 bash -c echo -en 'node: cluster: kind/default/birdyleaf-gateway id: kindccm-gw-15a36518b9b6 dynamic_resources: ads_config: api_type: GRPC grpc_services: - envoy_grpc: cluster_name: xds_cluster cds_config: ads: {} lds_config: ads: {} static_resources: clusters: - type: STRICT_DNS typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions explicit_http_config: http2_protocol_options: {} name: xds_cluster load_assignment: cluster_name: xds_cluster endpoints: - lb_endpoints: - endpoint: address: socket_address: address: 172.17.0.1 port_value: 34393 - endpoint: address: socket_address: address: host.docker.internal port_value: 34393 - endpoint: address: socket_address: address: host.lima.internal port_value: 34393 admin: access_log_path: /dev/stdout address: socket_address: address: 0.0.0.0 port_value: 10000 ' > /home/envoy/envoy.yaml && while true; do envoy -c /home/envoy/envoy.yaml && break; sleep 1; done]: exit status 125

Reproduction

Apply a Gateway with two HTTPS listeners on port 443, one for a wildcard hostname and one for the root hostname.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: birdyleaf-gateway
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: birdyleaf-local-issuer
spec:
  gatewayClassName: cloud-provider-kind
  addresses:
    - type: IPAddress
      value: 172.18.0.10
  listeners:
    - name: https-wildcard
      protocol: HTTPS
      port: 443
      hostname: "*.birdyleaf.test"
      tls:
        mode: Terminate
        certificateRefs:
          - name: birdyleaf-wildcard-cert
      allowedRoutes:
        namespaces:
          from: All

    - name: https-root
      protocol: HTTPS
      port: 443
      hostname: birdyleaf.test
      tls:
        mode: Terminate
        certificateRefs:
          - name: birdyleaf-root-cert
      allowedRoutes:
        namespaces:
          from: All

Suggested fix

Deduplicate published container ports when generating the Docker container arguments for Gateway listeners.

The publish list should likely be keyed by protocol and port, rather than by listener, so multiple listeners on the same port only produce one Docker publish argument.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: loehde / name: Kasper Løhde (b858b90)

[k8s-ci-robot]

Welcome @loehde!

It looks like this is your first PR to kubernetes-sigs/cloud-provider-kind 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cloud-provider-kind has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @loehde. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[aojea]

You need to sign the CLA

Can you also add a regression tests in https://github.com/kubernetes-sigs/cloud-provider-kind/blob/main/tests/tests.bats

[aojea]

/ok-to-test

[loehde]

Hi @aojea, I’ve added a regression test and signed the CLA. :)

[stmcginnis]

Some trivial things that aren't too important, but looks good.

/lgtm

[stmcginnis]

nit: Looks like it's actually port 80?

[stmcginnis]

nit: File is named "https" but looks like we just use http.

[stmcginnis]

Thanks!

/lgtm

[loehde]

Thank you — happy to help. It’s an awesome project.

I have one question, since this is my first time contributing: is there anything further I need to do to get it merged?

[aojea]

/lgtm
/approve

Thanks

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea, loehde

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [aojea]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment