Repository: envoyproxy/gateway

Issue:
WASM cache initialization failure causes all routes with EEP to fail
*Description*:

see here https://github.com/envoyproxy/gateway/issues/6124#issuecomment-2901233079 :

> The "Translator" calls buildWasms twice, once in translateEnvoyExtensionPolicyForRoute and once in translateEnvoyExtensionPolicyForGateway both treat a nil as an error

Seems like buildWasms will default all routes with an EEP, regardless of if the EEP even has wasms: 

It's always called when processing EEPs: 
https://github.com/envoyproxy/gateway/blob/c09c42ca34a2eba9d7699e800c218c293f69d5fc/internal/gatewayapi/envoyextensionpolicy.go#L302

It returns an error before checking if wasm cache is really needed:
https://github.com/envoyproxy/gateway/blob/c09c42ca34a2eba9d7699e800c218c293f69d5fc/internal/gatewayapi/envoyextensionpolicy.go#L618

In other words, if wasm cache fails to start - all routes with EEPs are zeroed-out. 

cc @zhaohuabing

*Repro steps*:


*Environment*:
>Include the environment like gateway version, envoy version and so on.

*Logs*:
>Include the access logs and the Envoy logs.


Discussion:

Solution patch:
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 7b27adbf0..079fdced2 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -614,12 +614,16 @@ func (t *Translator) buildWasms(
 	policy *egv1a1.EnvoyExtensionPolicy,
 	resources *resource.Resources,
 ) ([]ir.Wasm, error) {
+	var wasmIRList []ir.Wasm
+
+	if len(policy.Spec.Wasm) == 0 {
+		return wasmIRList, nil
+	}
+
 	if t.WasmCache == nil {
 		return nil, fmt.Errorf("wasm cache is not initialized")
 	}
 
-	var wasmIRList []ir.Wasm
-
 	if policy == nil {
 		return nil, nil
 	}
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 8f4ef39f4..d704edba9 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -15,6 +15,7 @@ new features: |
   Added XDS metadata for clusters and endpoints from xRoutes and referenced backend resources (Backend, Service, ServiceImport).
 
 bug fixes: |
+  Fixed issue where WASM cache init failure caused routes with WASM-less EnvoyExtensionPolicies to have 500 direct responses.
 
 # Enhancements that improve performance.
 performance improvements: |



Test patch:
diff --git a/internal/cmd/egctl/testdata/translate/out/backend-endpoint.all.yaml b/internal/cmd/egctl/testdata/translate/out/backend-endpoint.all.yaml
index e9816d345..1e913ac3d 100644
--- a/internal/cmd/egctl/testdata/translate/out/backend-endpoint.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/backend-endpoint.all.yaml
@@ -77,9 +77,7 @@ envoyExtensionPolicies:
         namespace: envoy-gateway-system
       conditions:
       - lastTransitionTime: null
-        message: |-
-          Wasm: wasm cache is not initialized
-          ExtProc: service envoy-gateway-system/grpc-ext-proc not found.
+        message: 'ExtProc: service envoy-gateway-system/grpc-ext-proc not found.'
         reason: Invalid
         status: "False"
         type: Accepted
diff --git a/test/e2e/tests/weighted_backend.go b/test/e2e/tests/weighted_backend.go
index bea61448f..154c6f5fb 100644
--- a/test/e2e/tests/weighted_backend.go
+++ b/test/e2e/tests/weighted_backend.go
@@ -66,6 +66,9 @@ func runWeightedBackendTest(t *testing.T, suite *suite.ConformanceTestSuite, rou
 		suite.ControllerName,
 		kubernetes.NewGatewayRef(SameNamespaceGateway), weightEqualRoute)
 
+	// Make sure all test resources are ready
+	kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ConformanceInfraNamespace})
+
 	expectedResponse := http.ExpectedResponse{
 		Request: http.Request{
 			Path: path,
diff --git a/test/e2e/tests/zone_aware_routing.go b/test/e2e/tests/zone_aware_routing.go
index 77958dcdb..5ac6edc0f 100644
--- a/test/e2e/tests/zone_aware_routing.go
+++ b/test/e2e/tests/zone_aware_routing.go
@@ -10,7 +10,6 @@ package tests
 import (
 	"testing"
 
-	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
 )
 
@@ -24,9 +23,6 @@ var ZoneAwareRoutingTest = suite.ConformanceTest{
 	Manifests:   []string{"testdata/zone-aware-routing.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		t.Run("only local zone should get requests", func(t *testing.T) {
-			// Let's make sure that all the deployments are ready.
-			kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{"gateway-conformance-infra"})
-
 			// Pods from the backend-local deployment have affinity
 			// for the Envoy Proxy pods so should receive all requests.
 			expected := map[string]int{