Confirm post-GWAPI 0.8 status of wildcard hostname HTTP(S) Listeners

[rainest]

GWAPI 0.8.0 introduces CEL validation of various resource fields. Listeners now have a CRD-level rule that ensures that no pair of Listeners has identical Port, Hostname, and Protocol values.

This rule has an apparent bug handling Hostname-aware Listeners where one Listener has a set Hostname and one does not. The spec allows a single Listener with an unset Hostname on a given Port+Protocol. This Listener matches any Hostname if no more specific Hostname matches.

The CEL rule apparently requires an actual Hostname value to check if they are equal. Including both a nil Hostname and set Hostname in a Gateway fails:

10:54:33-0700 esenin $ cat /tmp/gw.yaml
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: prod-web
spec:
  gatewayClassName: acme-lb
  listeners:
  - protocol: HTTP
    port: 80
    name: http
  - protocol: HTTP
    port: 80
    name: httphostname
    hostname: http.example
10:54:35-0700 esenin $ kubectl create -f /tmp/gw.yaml
The Gateway "prod-web" is invalid: spec.listeners: Invalid value: "array": Combination of port, protocol and hostname must be unique for each listener

Our existing GWAPI integration tests include one such Gateway. We need to confirm with upstream if blocking these is indeed intended. Based on my understanding of the spec, they should not be blocked: kubernetes-sigs/gateway-api#2369

[pmalek]

This seems to have been already addressed upstream and pending a release: kubernetes-sigs/gateway-api#2370 ?

[rainest]

Indeed, upstream has confirmed that CEL shouldn't do this and we should un-comment the blocks once 0.8.1 is out.