linkerd / linkerd2

Ultralight, security-first service mesh for Kubernetes. Main repo for Linkerd 2.x.
https://linkerd.io
Apache License 2.0
10.49k stars 1.27k forks source link

Fix issue where initial outbound policy did not contain producer routes #12619

Closed adleong closed 1 month ago

adleong commented 1 month ago

An HTTPRoute whose parentRef is a Service in the same namespace is called a producer route. Producer routes should be used in outbound policy by all clients calling that Service, even if the client is in a different namespace. The policy controller has a bug where when a outbound policy watch is started, the initial outbound policy returned will not include any producer routes which already exist.

We correct this bug and add tests.