fix(xds): deduplicate filter in inbound:passthrough filter chain#16080
Merged
Conversation
Signed-off-by: Lukasz Dziedziak <lukidzi@gmail.com>
Contributor
Reviewer Checklist🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes an issue where duplicate services with the same port on a dataplane were creating duplicate Envoy filter chain matches, causing Envoy configuration to be rejected. The fix implements deduplication by tracking already-seen ports using a map and skipping ports that have already been processed.
Changes:
- Added port deduplication logic in
CreateInboundPassthroughListener()to prevent duplicate filter chains when strict inbound ports are enabled - Added a test case validating the behavior with duplicate ports [8080, 8080]
- Added golden file showing the expected Envoy configuration with deduplication applied
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pkg/xds/generator/transparent_proxy_generator.go |
Adds seenPorts map to track processed ports and skip duplicates in the filter chain loop |
pkg/xds/generator/transparent_proxy_generator_test.go |
Adds test case for duplicate ports scenario with STRICT TLS mode |
pkg/xds/generator/testdata/transparent-proxy/10.envoy.golden.yaml |
Golden file showing expected Envoy config with one filter chain match despite duplicate input ports |
Automaat
approved these changes
Apr 1, 2026
kumahq Bot
pushed a commit
that referenced
this pull request
Apr 1, 2026
) ## Motivation Once a user have 2 services with the same port we were creating duplicate filter chain matches which caused envoy to reject configuration. ## Implementation information * track `seenPorts` map and skip any port already added as a filter chain Signed-off-by: Lukasz Dziedziak <lukidzi@gmail.com>
lukidzi
added a commit
that referenced
this pull request
Apr 1, 2026
…kport of #16080) (#16085) Automatic cherry-pick of #16080 for branch release-2.13 Generated by [action](https://github.com/kumahq/kuma/actions/runs/23849713194) cherry-picked commit d755470 Signed-off-by: Lukasz Dziedziak <lukidzi@gmail.com> Co-authored-by: Lukasz Dziedziak <lukidzi@gmail.com>
bartsmykla
pushed a commit
to bartsmykla/kuma
that referenced
this pull request
Apr 7, 2026
…ahq#16080) ## Motivation Once a user have 2 services with the same port we were creating duplicate filter chain matches which caused envoy to reject configuration. ## Implementation information * track `seenPorts` map and skip any port already added as a filter chain Signed-off-by: Lukasz Dziedziak <lukidzi@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Once a user have 2 services with the same port we were creating duplicate filter chain matches which caused envoy to reject configuration.
Implementation information
seenPortsmap and skip any port already added as a filter chain