Repository: envoyproxy/gateway (go)

Issue:
Dont set backendRequestTimeout to Request Timeout when Retries are set
*Description*:
>What issue is being seen? Describe what should be happening instead of
the bug, for example: The expected value isn't returned, etc.

https://github.com/envoyproxy/gateway/blob/1376cae998ad5cea54bae765914908ee08a6121e/internal/gatewayapi/route.go#L328 should only be set when Retries are unset
https://github.com/envoyproxy/gateway/blob/1376cae998ad5cea54bae765914908ee08a6121e/internal/gatewayapi/route.go#L358

*Repro steps*:
> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

>**Note**: If there are privacy concerns, sanitize the data prior to
sharing.

*Environment*:
>Include the environment like gateway version, envoy version and so on.

*Logs*:
>Include the access logs and the Envoy logs.


Pull request description:
fix: Do not set backendRequestTimeout when Retries are set
Fixes #6414 

Patch:
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 379e812de..f523cce7c 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -325,9 +325,10 @@ func processRouteTimeout(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
 			irRoute.Timeout = ptr.To(metav1.Duration{Duration: d})
 		}
 
-		// Also set the IR Route Timeout to the backend request timeout
-		// until we introduce retries, then set it to per try timeout
-		if rule.Timeouts.BackendRequest != nil {
+		// Only set the IR Route Timeout to the backend request timeout
+		// when retries are not configured. When retries are configured,
+		// the backend request timeout should set for per-retry timeout.
+		if rule.Timeouts.BackendRequest != nil && rule.Retry == nil {
 			d, err := time.ParseDuration(string(*rule.Timeouts.BackendRequest))
 			if err != nil {
 				d, _ = time.ParseDuration(HTTPRequestTimeout)


Test patch:
diff --git a/internal/gatewayapi/testdata/httproute-retry.out.yaml b/internal/gatewayapi/testdata/httproute-retry.out.yaml
index 8913d1f2c..5497d156b 100644
--- a/internal/gatewayapi/testdata/httproute-retry.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-retry.out.yaml
@@ -323,7 +323,6 @@ xdsIR:
           retryOn:
             httpStatusCodes:
             - 500
-        timeout: 3s
         traffic:
           retry:
             numAttemptsPerPriority: 1
diff --git a/test/e2e/tests/httproute_with_custom_security_context_userid.go b/test/e2e/tests/httproute_with_custom_security_context_userid.go
index 2cd9c06ee..8abe27342 100644
--- a/test/e2e/tests/httproute_with_custom_security_context_userid.go
+++ b/test/e2e/tests/httproute_with_custom_security_context_userid.go
@@ -80,21 +80,31 @@ var EnvoyGatewayCustomSecurityContextUseridTest = suite.ConformanceTest{
 
 func setEGSecurityContextUserID(t *testing.T, suite *suite.ConformanceTestSuite, uid int64) {
 	// update envoy-gateway deployment with custom security context user id
-	egDeployment := &appsv1.Deployment{}
-	err := suite.Client.Get(
-		context.Background(),
-		types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
-		egDeployment)
-	require.NoError(t, err)
-	egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To(uid)
-	egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup = ptr.To(uid)
-	err = suite.Client.Update(context.Background(), egDeployment)
+	retries := 5
+	var err error
+	for i := 0; i < retries; i++ { // retry a few times to avoid update conflicts
+		egDeployment := &appsv1.Deployment{}
+		err = suite.Client.Get(
+			context.Background(),
+			types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
+			egDeployment,
+		)
+		require.NoError(t, err)
+
+		egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To(uid)
+		egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup = ptr.To(uid)
+
+		if err = suite.Client.Update(context.Background(), egDeployment); err == nil {
+			break
+		}
+	}
 	require.NoError(t, err)
+
 	// test that envoy-gateway pod is running with custom security context user id
 	WaitForPods(t, suite.Client, "envoy-gateway-system", map[string]string{"control-plane": "envoy-gateway"}, corev1.PodRunning, PodReady)
 
 	// test that envoy-gateway deployment is updated with custom security context user id
-	egDeployment = &appsv1.Deployment{}
+	egDeployment := &appsv1.Deployment{}
 	err = suite.Client.Get(
 		context.Background(),
 		types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},