Skip to content

Fail task startup when a referenced gateway cannot be resolved - #2

Open
fkautz wants to merge 2 commits into
mainfrom
fix/350-missing-gateway
Open

fkautz wants to merge 2 commits into
mainfrom
fix/350-missing-gateway

Conversation

@fkautz

@fkautz fkautz commented Sep 21, 2026

Copy link
Copy Markdown
Owner

Upstream PR creation is restricted, so this review PR is hosted in the fork. Its base matches google/ax main.

A missing gateway currently turns into an allow-all policy. Record a failed Ready/GatewayReady condition and stop startup on lookup errors. Suspension remains available: it runs before policy application, so a missing gateway cannot prevent stopping an actor or cause a wildcard policy during suspension.

Fixes google#350.

TDD and validation

This branch starts independently from origin/main (d8ed0fe) and has two commits:

  1. 41e0e71 adds the regression and fails on the original behavior.
  2. fa56783 implements the fix; the regression and complete suite pass.

Reproduce the red/green transition by checking out either commit and running:

go test ./internal/controller -run '^TestReviewMissingGatewayDoesNotGrantWildcardEgress$' -count=1 -v

Validated: go test ./... -count=1, targeted -race tests, go mod tidy with unchanged module files, make build, and git diff --check. Controller tests use an in-process Substrate fake; no deployed cluster was used.

Review

Codex review: addressed the suspension regression identified in the first pass; second pass found no actionable regressions. Some reviewer test runs were blocked by its listener sandbox; the validation above was run separately with local listener access.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing referenced gateway grants wildcard egress and starts the task

1 participant