Fix route attachments to gateways

Co-authored-by: Romain <rtribotte@users.noreply.github.com>

integration/k8s_conformance_test.go

@@ -199,19 +199,10 @@ func (s *K8sConformanceSuite) TestK8sGatewayAPIConformance() {
 		RunTest:                    *k8sConformanceRunTest,
 		// Until the feature are all supported, following tests are skipped.
 		SkipTests: []string{
-			tests.GatewayClassObservedGenerationBump.ShortName,
-			tests.GatewayWithAttachedRoutes.ShortName,
-			tests.GatewayModifyListeners.ShortName,
-			tests.GatewayInvalidTLSConfiguration.ShortName,
-			tests.HTTPRouteHostnameIntersection.ShortName,
 			tests.HTTPRouteListenerHostnameMatching.ShortName,
-			tests.HTTPRouteInvalidReferenceGrant.ShortName,
 			tests.HTTPRouteInvalidCrossNamespaceParentRef.ShortName,
-			tests.HTTPRouteInvalidParentRefNotMatchingSectionName.ShortName,
-			tests.HTTPRouteInvalidCrossNamespaceBackendRef.ShortName,
 			tests.HTTPRouteMatchingAcrossRoutes.ShortName,
 			tests.HTTPRoutePartiallyInvalidViaInvalidReferenceGrant.ShortName,
-			tests.HTTPRouteRedirectHostAndStatus.ShortName,
 			tests.HTTPRoutePathMatchOrder.ShortName,
 			tests.HTTPRouteHeaderMatching.ShortName,
 			tests.HTTPRouteReferenceGrant.ShortName,

pkg/provider/kubernetes/gateway/client.go

@@ -32,11 +32,11 @@ type resourceEventHandler struct {
 	ev chan<- interface{}
 }
 
-func (reh *resourceEventHandler) OnAdd(obj interface{}, isInInitialList bool) {
+func (reh *resourceEventHandler) OnAdd(obj interface{}, _ bool) {
 	eventHandlerFunc(reh.ev, obj)
 }
 
-func (reh *resourceEventHandler) OnUpdate(oldObj, newObj interface{}) {
+func (reh *resourceEventHandler) OnUpdate(_, newObj interface{}) {
 	eventHandlerFunc(reh.ev, newObj)
 }
 
@@ -49,19 +49,21 @@ func (reh *resourceEventHandler) OnDelete(obj interface{}) {
 // The stores can then be accessed via the Get* functions.
 type Client interface {
 	WatchAll(namespaces []string, stopCh <-chan struct{}) (<-chan interface{}, error)
-	GetGatewayClasses() ([]*gatev1.GatewayClass, error)
 	UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStatus gatev1.GatewayStatus) error
 	UpdateGatewayClassStatus(gatewayClass *gatev1.GatewayClass, condition metav1.Condition) error
-	UpdateHTTPRouteStatus(ctx context.Context, gateway *gatev1.Gateway, nsName ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error
+	UpdateHTTPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error
-	GetGateways() []*gatev1.Gateway
+	UpdateTCPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TCPRouteStatus) error
-	GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute, error)
+	UpdateTLSRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TLSRouteStatus) error
-	GetTCPRoutes(namespaces []string) ([]*gatev1alpha2.TCPRoute, error)
+	ListGatewayClasses() ([]*gatev1.GatewayClass, error)
-	GetTLSRoutes(namespaces []string) ([]*gatev1alpha2.TLSRoute, error)
+	ListGateways() []*gatev1.Gateway
-	GetReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error)
+	ListHTTPRoutes() ([]*gatev1.HTTPRoute, error)
+	ListTCPRoutes() ([]*gatev1alpha2.TCPRoute, error)
+	ListTLSRoutes() ([]*gatev1alpha2.TLSRoute, error)
+	ListNamespaces(selector labels.Selector) ([]string, error)
+	ListReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error)
 	GetService(namespace, name string) (*corev1.Service, bool, error)
 	GetSecret(namespace, name string) (*corev1.Secret, bool, error)
 	GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error)
-	GetNamespaces(selector labels.Selector) ([]string, error)
 }
 
 type clientWrapper struct {
@@ -280,7 +282,7 @@ func (c *clientWrapper) WatchAll(namespaces []string, stopCh <-chan struct{}) (<
 	return eventCh, nil
 }
 
-func (c *clientWrapper) GetNamespaces(selector labels.Selector) ([]string, error) {
+func (c *clientWrapper) ListNamespaces(selector labels.Selector) ([]string, error) {
 	ns, err := c.factoryNamespace.Core().V1().Namespaces().Lister().List(selector)
 	if err != nil {
 		return nil, err
@@ -297,22 +299,12 @@ func (c *clientWrapper) GetNamespaces(selector labels.Selector) ([]string, error
 	return namespaces, nil
 }
 
-func (c *clientWrapper) GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute, error) {
+func (c *clientWrapper) ListHTTPRoutes() ([]*gatev1.HTTPRoute, error) {
 	var httpRoutes []*gatev1.HTTPRoute
-	for _, namespace := range namespaces {
+	for _, namespace := range c.watchedNamespaces {
-		if !c.isWatchedNamespace(namespace) {
-			log.Warn().Msgf("Failed to get HTTPRoutes: %q is not within watched namespaces", namespace)
-			continue
-		}
-
 		routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(namespace).List(labels.Everything())
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("listing HTTP routes in namespace %s", namespace)
-		}
-
-		if len(routes) == 0 {
-			log.Debug().Msgf("No HTTPRoutes found in namespace %q", namespace)
-			continue
 		}
 
 		httpRoutes = append(httpRoutes, routes...)
@@ -321,53 +313,35 @@ func (c *clientWrapper) GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute,
 	return httpRoutes, nil
 }
 
-func (c *clientWrapper) GetTCPRoutes(namespaces []string) ([]*gatev1alpha2.TCPRoute, error) {
+func (c *clientWrapper) ListTCPRoutes() ([]*gatev1alpha2.TCPRoute, error) {
 	var tcpRoutes []*gatev1alpha2.TCPRoute
-	for _, namespace := range namespaces {
+	for _, namespace := range c.watchedNamespaces {
-		if !c.isWatchedNamespace(namespace) {
-			log.Warn().Msgf("Failed to get TCPRoutes: %q is not within watched namespaces", namespace)
-			continue
-		}
-
 		routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1alpha2().TCPRoutes().Lister().TCPRoutes(namespace).List(labels.Everything())
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("listing TCP routes in namespace %s", namespace)
-		}
-
-		if len(routes) == 0 {
-			log.Debug().Msgf("No TCPRoutes found in namespace %q", namespace)
-			continue
 		}
 
 		tcpRoutes = append(tcpRoutes, routes...)
 	}
+
 	return tcpRoutes, nil
 }
 
-func (c *clientWrapper) GetTLSRoutes(namespaces []string) ([]*gatev1alpha2.TLSRoute, error) {
+func (c *clientWrapper) ListTLSRoutes() ([]*gatev1alpha2.TLSRoute, error) {
 	var tlsRoutes []*gatev1alpha2.TLSRoute
-	for _, namespace := range namespaces {
+	for _, namespace := range c.watchedNamespaces {
-		if !c.isWatchedNamespace(namespace) {
-			log.Warn().Msgf("Failed to get TLSRoutes: %q is not within watched namespaces", namespace)
-			continue
-		}
-
 		routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1alpha2().TLSRoutes().Lister().TLSRoutes(namespace).List(labels.Everything())
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("listing TLS routes in namespace %s", namespace)
-		}
-
-		if len(routes) == 0 {
-			log.Debug().Msgf("No TLSRoutes found in namespace %q", namespace)
-			continue
 		}
 
 		tlsRoutes = append(tlsRoutes, routes...)
 	}
+
 	return tlsRoutes, nil
 }
 
-func (c *clientWrapper) GetReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error) {
+func (c *clientWrapper) ListReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error) {
 	if !c.isWatchedNamespace(namespace) {
 		log.Warn().Msgf("Failed to get ReferenceGrants: %q is not within watched namespaces", namespace)
 
@@ -382,7 +356,7 @@ func (c *clientWrapper) GetReferenceGrants(namespace string) ([]*gatev1beta1.Ref
 	return referenceGrants, nil
 }
 
-func (c *clientWrapper) GetGateways() []*gatev1.Gateway {
+func (c *clientWrapper) ListGateways() []*gatev1.Gateway {
 	var result []*gatev1.Gateway
 
 	for ns, factory := range c.factoriesGateway {
@@ -397,7 +371,7 @@ func (c *clientWrapper) GetGateways() []*gatev1.Gateway {
 	return result
 }
 
-func (c *clientWrapper) GetGatewayClasses() ([]*gatev1.GatewayClass, error) {
+func (c *clientWrapper) ListGatewayClasses() ([]*gatev1.GatewayClass, error) {
 	return c.factoryGatewayClass.Gateway().V1().GatewayClasses().Lister().List(labels.Everything())
 }
 
@@ -437,7 +411,7 @@ func (c *clientWrapper) UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStat
 		return fmt.Errorf("cannot update Gateway status %s/%s: namespace is not within watched namespaces", gateway.Namespace, gateway.Name)
 	}
 
-	if statusEquals(gateway.Status, gatewayStatus) {
+	if gatewayStatusEquals(gateway.Status, gatewayStatus) {
 		return nil
 	}
 
@@ -455,89 +429,106 @@ func (c *clientWrapper) UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStat
 	return nil
 }
 
-func (c *clientWrapper) UpdateHTTPRouteStatus(ctx context.Context, gateway *gatev1.Gateway, nsName ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error {
+func (c *clientWrapper) UpdateHTTPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error {
-	if !c.isWatchedNamespace(nsName.Namespace) {
+	if !c.isWatchedNamespace(route.Namespace) {
-		return fmt.Errorf("updating HTTPRoute status %s/%s: namespace is not within watched namespaces", nsName.Namespace, nsName.Name)
+		return fmt.Errorf("updating HTTPRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
 	}
 
-	route, err := c.factoriesGateway[c.lookupNamespace(nsName.Namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(nsName.Namespace).Get(nsName.Name)
+	currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(route.Namespace).Get(route.Name)
 	if err != nil {
-		return fmt.Errorf("getting HTTPRoute %s/%s: %w", nsName.Namespace, nsName.Name, err)
+		return fmt.Errorf("getting HTTPRoute %s/%s: %w", route.Namespace, route.Name, err)
 	}
 
-	var statuses []gatev1.RouteParentStatus
+	// TODO: keep statuses for gateways managed by other Traefik instances.
-	for _, status := range route.Status.Parents {
+	var parentStatuses []gatev1.RouteParentStatus
-		if status.ControllerName != controllerName {
+	for _, currentParentStatus := range currentRoute.Status.Parents {
-			statuses = append(statuses, status)
+		if currentParentStatus.ControllerName != controllerName {
-			continue
+			parentStatuses = append(parentStatuses, currentParentStatus)
-		}
-		if status.ParentRef.Namespace != nil && string(*status.ParentRef.Namespace) != gateway.Namespace {
-			statuses = append(statuses, status)
-			continue
-		}
-		if string(status.ParentRef.Name) != gateway.Name {
-			statuses = append(statuses, status)
 			continue
 		}
 	}
-	statuses = append(statuses, status.Parents...)
 
-	route = route.DeepCopy()
+	parentStatuses = append(parentStatuses, status.Parents...)
-	route.Status = gatev1.HTTPRouteStatus{
+
+	currentRoute = currentRoute.DeepCopy()
+	currentRoute.Status = gatev1.HTTPRouteStatus{
 		RouteStatus: gatev1.RouteStatus{
-			Parents: statuses,
+			Parents: parentStatuses,
 		},
 	}
 
-	if _, err := c.csGateway.GatewayV1().HTTPRoutes(nsName.Namespace).UpdateStatus(ctx, route, metav1.UpdateOptions{}); err != nil {
+	if _, err := c.csGateway.GatewayV1().HTTPRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
-		return fmt.Errorf("updating HTTPRoute %s/%s status: %w", nsName.Namespace, nsName.Name, err)
+		return fmt.Errorf("updating HTTPRoute %s/%s status: %w", route.Namespace, route.Name, err)
 	}
 	return nil
 }
 
-func statusEquals(oldStatus, newStatus gatev1.GatewayStatus) bool {
+func (c *clientWrapper) UpdateTCPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TCPRouteStatus) error {
-	if len(oldStatus.Listeners) != len(newStatus.Listeners) {
+	if !c.isWatchedNamespace(route.Namespace) {
-		return false
+		return fmt.Errorf("updating TCPRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
 	}
 
-	if !conditionsEquals(oldStatus.Conditions, newStatus.Conditions) {
+	currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1alpha2().TCPRoutes().Lister().TCPRoutes(route.Namespace).Get(route.Name)
-		return false
+	if err != nil {
+		return fmt.Errorf("getting TCPRoute %s/%s: %w", route.Namespace, route.Name, err)
 	}
 
-	listenerMatches := 0
+	// TODO: keep statuses for gateways managed by other Traefik instances.
-	for _, newListener := range newStatus.Listeners {
+	var parentStatuses []gatev1alpha2.RouteParentStatus
-		for _, oldListener := range oldStatus.Listeners {
+	for _, currentParentStatus := range currentRoute.Status.Parents {
-			if newListener.Name == oldListener.Name {
+		if currentParentStatus.ControllerName != controllerName {
-				if !conditionsEquals(newListener.Conditions, oldListener.Conditions) {
+			parentStatuses = append(parentStatuses, currentParentStatus)
-					return false
+			continue
-				}
-
-				listenerMatches++
-			}
 		}
 	}
 
-	return listenerMatches == len(oldStatus.Listeners)
+	parentStatuses = append(parentStatuses, status.Parents...)
+
+	currentRoute = currentRoute.DeepCopy()
+	currentRoute.Status = gatev1alpha2.TCPRouteStatus{
+		RouteStatus: gatev1.RouteStatus{
+			Parents: parentStatuses,
+		},
+	}
+
+	if _, err := c.csGateway.GatewayV1alpha2().TCPRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
+		return fmt.Errorf("updating TCPRoute %s/%s status: %w", route.Namespace, route.Name, err)
+	}
+	return nil
 }
 
-func conditionsEquals(conditionsA, conditionsB []metav1.Condition) bool {
+func (c *clientWrapper) UpdateTLSRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TLSRouteStatus) error {
-	if len(conditionsA) != len(conditionsB) {
+	if !c.isWatchedNamespace(route.Namespace) {
-		return false
+		return fmt.Errorf("updating TLSRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
 	}
 
-	conditionMatches := 0
+	currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1alpha2().TLSRoutes().Lister().TLSRoutes(route.Namespace).Get(route.Name)
-	for _, conditionA := range conditionsA {
+	if err != nil {
-		for _, conditionB := range conditionsB {
+		return fmt.Errorf("getting TLSRoute %s/%s: %w", route.Namespace, route.Name, err)
-			if conditionA.Type == conditionB.Type {
+	}
-				if conditionA.Reason != conditionB.Reason || conditionA.Status != conditionB.Status || conditionA.Message != conditionB.Message || conditionA.ObservedGeneration != conditionB.ObservedGeneration {
+
-					return false
+	// TODO: keep statuses for gateways managed by other Traefik instances.
-				}
+	var parentStatuses []gatev1alpha2.RouteParentStatus
-				conditionMatches++
+	for _, currentParentStatus := range currentRoute.Status.Parents {
-			}
+		if currentParentStatus.ControllerName != controllerName {
+			parentStatuses = append(parentStatuses, currentParentStatus)
+			continue
 		}
 	}
 
-	return conditionMatches == len(conditionsA)
+	parentStatuses = append(parentStatuses, status.Parents...)
+
+	currentRoute = currentRoute.DeepCopy()
+	currentRoute.Status = gatev1alpha2.TLSRouteStatus{
+		RouteStatus: gatev1.RouteStatus{
+			Parents: parentStatuses,
+		},
+	}
+
+	if _, err := c.csGateway.GatewayV1alpha2().TLSRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
+		return fmt.Errorf("updating TLSRoute %s/%s status: %w", route.Namespace, route.Name, err)
+	}
+	return nil
 }
 
 // GetService returns the named service from the given namespace.
@@ -582,11 +573,21 @@ func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, bool,
 // The distinction is necessary because we index all informers on the special
 // identifier iff all-namespaces are requested but receive specific namespace
 // identifiers from the Kubernetes API, so we have to bridge this gap.
-func (c *clientWrapper) lookupNamespace(ns string) string {
+func (c *clientWrapper) lookupNamespace(namespace string) string {
 	if c.isNamespaceAll {
 		return metav1.NamespaceAll
 	}
-	return ns
+	return namespace
+}
+
+// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+// it to ensure we don't panic by requesting an out-of-watch object.
+func (c *clientWrapper) isWatchedNamespace(namespace string) bool {
+	if c.isNamespaceAll {
+		return true
+	}
+
+	return slices.Contains(c.watchedNamespaces, namespace)
 }
 
 // eventHandlerFunc will pass the obj on to the events channel or drop it.
@@ -608,12 +609,51 @@ func translateNotFoundError(err error) (bool, error) {
 	return err == nil, err
 }
 
-// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+func gatewayStatusEquals(statusA, statusB gatev1.GatewayStatus) bool {
-// it to ensure we don't panic by requesting an out-of-watch object.
+	if len(statusA.Listeners) != len(statusB.Listeners) {
-func (c *clientWrapper) isWatchedNamespace(ns string) bool {
+		return false
-	if c.isNamespaceAll {
-		return true
 	}
 
-	return slices.Contains(c.watchedNamespaces, ns)
+	if !conditionsEquals(statusA.Conditions, statusB.Conditions) {
+		return false
+	}
+
+	listenerMatches := 0
+	for _, newListener := range statusB.Listeners {
+		for _, oldListener := range statusA.Listeners {
+			if newListener.Name == oldListener.Name {
+				if !conditionsEquals(newListener.Conditions, oldListener.Conditions) {
+					return false
+				}
+
+				if newListener.AttachedRoutes != oldListener.AttachedRoutes {
+					return false
+				}
+
+				listenerMatches++
+			}
+		}
+	}
+
+	return listenerMatches == len(statusA.Listeners)
+}
+
+func conditionsEquals(conditionsA, conditionsB []metav1.Condition) bool {
+	if len(conditionsA) != len(conditionsB) {
+		return false
+	}
+
+	conditionMatches := 0
+	for _, conditionA := range conditionsA {
+		for _, conditionB := range conditionsB {
+			if conditionA.Type == conditionB.Type {
+				if conditionA.Reason != conditionB.Reason || conditionA.Status != conditionB.Status || conditionA.Message != conditionB.Message || conditionA.ObservedGeneration != conditionB.ObservedGeneration {
+					return false
+				}
+				conditionMatches++
+			}
+		}
+	}
+
+	return conditionMatches == len(conditionsA)
 }

pkg/provider/kubernetes/gateway/client_test.go

@@ -8,7 +8,7 @@ import (
 	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
-func TestStatusEquals(t *testing.T) {
+func Test_gatewayStatusEquals(t *testing.T) {
 	testCases := []struct {
 		desc     string
 		statusA  gatev1.GatewayStatus
@@ -230,13 +230,45 @@ func TestStatusEquals(t *testing.T) {
 			},
 			expected: false,
 		},
+		{
+			desc: "Gateway listeners with same conditions but different number of attached routes",
+			statusA: gatev1.GatewayStatus{
+				Listeners: []gatev1.ListenerStatus{
+					{
+						Name:           "foo",
+						AttachedRoutes: 1,
+						Conditions: []metav1.Condition{
+							{
+								Type:   "foobar",
+								Reason: "foobar",
+							},
+						},
+					},
+				},
+			},
+			statusB: gatev1.GatewayStatus{
+				Listeners: []gatev1.ListenerStatus{
+					{
+						Name:           "foo",
+						AttachedRoutes: 2,
+						Conditions: []metav1.Condition{
+							{
+								Type:   "foobar",
+								Reason: "foobar",
+							},
+						},
+					},
+				},
+			},
+			expected: false,
+		},
 	}
 
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
-			result := statusEquals(test.statusA, test.statusB)
+			result := gatewayStatusEquals(test.statusA, test.statusB)
 
 			assert.Equal(t, test.expected, result)
 		})

pkg/provider/kubernetes/gateway/fixtures/httproute/simple_with_bad_rule.yml

@@ -1,46 +0,0 @@
----
-kind: GatewayClass
-apiVersion: gateway.networking.k8s.io/v1
-metadata:
-  name: my-gateway-class
-spec:
-  controllerName: traefik.io/gateway-controller
-
----
-kind: Gateway
-apiVersion: gateway.networking.k8s.io/v1
-metadata:
-  name: my-gateway
-  namespace: default
-spec:
-  gatewayClassName: my-gateway-class
-  listeners: # Use GatewayClass defaults for listener definition.
-    - name: http
-      protocol: HTTP
-      port: 80
-      allowedRoutes:
-        namespaces:
-          from: Same
-
----
-kind: HTTPRoute
-apiVersion: gateway.networking.k8s.io/v1
-metadata:
-  name: http-app-1
-  namespace: default
-spec:
-  parentRefs:
-    - name: my-gateway
-      kind: Gateway
-      group: gateway.networking.k8s.io
-  hostnames:
-    - "foo.com"
-  rules:
-    - matches:
-        - path:
-            type: Unsupported
-            value: /bar
-      backendRefs:
-        - name: whoami
-          port: 80
-          weight: 1

pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_invalid_SNI_matching.yml

@@ -1,49 +0,0 @@
----
-kind: GatewayClass
-apiVersion: gateway.networking.k8s.io/v1
-metadata:
-  name: my-gateway-class
-spec:
-  controllerName: traefik.io/gateway-controller
-
----
-kind: Gateway
-apiVersion: gateway.networking.k8s.io/v1
-metadata:
-  name: my-gateway
-  namespace: default
-spec:
-  gatewayClassName: my-gateway-class
-  listeners: # Use GatewayClass defaults for listener definition.
-    - name: tls
-      protocol: TLS
-      port: 9001
-      tls:
-        mode: Passthrough
-      allowedRoutes:
-        kinds:
-          - kind: TLSRoute
-            group: gateway.networking.k8s.io
-        namespaces:
-          from: Same
-
----
-kind: TLSRoute
-apiVersion: gateway.networking.k8s.io/v1alpha2
-metadata:
-  name: tls-app-1
-  namespace: default
-spec:
-  parentRefs:
-    - name: my-gateway
-      kind: Gateway
-      group: gateway.networking.k8s.io
-  hostnames:
-    - "*.foo.*.bar"
-  rules:
-    - backendRefs:
-        - name: whoamitcp
-          port: 9000
-          weight: 1
-          kind: Service
-          group: ""

pkg/provider/kubernetes/gateway/httproute.go

@@ -0,0 +1,575 @@
+package gateway
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/provider"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ktypes "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func (p *Provider) loadHTTPRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
+	routes, err := client.ListHTTPRoutes()
+	if err != nil {
+		log.Ctx(ctx).Error().Err(err).Msg("Unable to list HTTPRoutes")
+		return
+	}
+
+	for _, route := range routes {
+		logger := log.Ctx(ctx).With().
+			Str("http_route", route.Name).
+			Str("namespace", route.Namespace).
+			Logger()
+
+		var parentStatuses []gatev1.RouteParentStatus
+		for _, parentRef := range route.Spec.ParentRefs {
+			parentStatus := &gatev1.RouteParentStatus{
+				ParentRef:      parentRef,
+				ControllerName: controllerName,
+				Conditions: []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionTrue,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonAccepted),
+					},
+				},
+			}
+
+			var attachedListeners bool
+			notAcceptedReason := gatev1.RouteReasonNoMatchingParent
+			for _, listener := range gatewayListeners {
+				if !matchListener(listener, route.Namespace, parentRef) {
+					continue
+				}
+
+				if !allowRoute(listener, route.Namespace, kindHTTPRoute) {
+					notAcceptedReason = gatev1.RouteReasonNotAllowedByListeners
+					continue
+				}
+
+				hostnames, ok := findMatchingHostnames(listener.Hostname, route.Spec.Hostnames)
+				if !ok {
+					notAcceptedReason = gatev1.RouteReasonNoMatchingListenerHostname
+					continue
+				}
+
+				listener.Status.AttachedRoutes++
+
+				// TODO should we build the conf if the listener is not attached
+				// only consider the route attached if the listener is in an "attached" state.
+				if listener.Attached {
+					attachedListeners = true
+				}
+				resolveConditions := p.loadHTTPRoute(logger.WithContext(ctx), client, listener, route, hostnames, conf)
+
+				// TODO: handle more accurately route conditions (in case of multiple listener matching).
+				for _, condition := range resolveConditions {
+					parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
+				}
+			}
+
+			if !attachedListeners {
+				parentStatus.Conditions = []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(notAcceptedReason),
+					},
+					{
+						Type:               string(gatev1.RouteConditionResolvedRefs),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonRefNotPermitted),
+					},
+				}
+			}
+
+			parentStatuses = append(parentStatuses, *parentStatus)
+		}
+
+		status := gatev1.HTTPRouteStatus{
+			RouteStatus: gatev1.RouteStatus{
+				Parents: parentStatuses,
+			},
+		}
+		if err := client.UpdateHTTPRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, status); err != nil {
+			logger.Error().
+				Err(err).
+				Msg("Unable to update HTTPRoute status")
+		}
+	}
+}
+
+func (p *Provider) loadHTTPRoute(ctx context.Context, client Client, listener gatewayListener, route *gatev1.HTTPRoute, hostnames []gatev1.Hostname, conf *dynamic.Configuration) []metav1.Condition {
+	routeConditions := []metav1.Condition{
+		{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionTrue,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteConditionResolvedRefs),
+		},
+	}
+
+	hostRule := hostRule(hostnames)
+
+	for _, routeRule := range route.Spec.Rules {
+		router := dynamic.Router{
+			RuleSyntax:  "v3",
+			Rule:        routerRule(routeRule, hostRule),
+			EntryPoints: []string{listener.EPName},
+		}
+		if listener.Protocol == gatev1.HTTPSProtocolType {
+			router.TLS = &dynamic.RouterTLSConfig{}
+		}
+
+		// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
+		routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
+		routerKey := makeRouterKey(router.Rule, makeID(route.Namespace, routerName))
+
+		var wrr dynamic.WeightedRoundRobin
+		wrrName := provider.Normalize(routerKey + "-wrr")
+
+		middlewares, err := p.loadMiddlewares(listener.Protocol, route.Namespace, routerKey, routeRule.Filters)
+		if err != nil {
+			log.Ctx(ctx).Error().
+				Err(err).
+				Msg("Unable to load HTTPRoute filters")
+
+			wrr.Services = append(wrr.Services, dynamic.WRRService{
+				Name:   "invalid-httproute-filter",
+				Status: ptr.To(500),
+				Weight: ptr.To(1),
+			})
+
+			conf.HTTP.Services[wrrName] = &dynamic.Service{Weighted: &wrr}
+			router.Service = wrrName
+		} else {
+			for name, middleware := range middlewares {
+				// If the middleware config is nil in the return of the loadMiddlewares function,
+				// it means that we just need a reference to that middleware.
+				if middleware != nil {
+					conf.HTTP.Middlewares[name] = middleware
+				}
+
+				router.Middlewares = append(router.Middlewares, name)
+			}
+
+			// Traefik internal service can be used only if there is only one BackendRef service reference.
+			if len(routeRule.BackendRefs) == 1 && isInternalService(routeRule.BackendRefs[0].BackendRef) {
+				router.Service = string(routeRule.BackendRefs[0].Name)
+			} else {
+				for _, backendRef := range routeRule.BackendRefs {
+					name, svc, errCondition := p.loadHTTPService(client, route, backendRef)
+					weight := ptr.To(int(ptr.Deref(backendRef.Weight, 1)))
+					if errCondition != nil {
+						routeConditions = appendCondition(routeConditions, *errCondition)
+						wrr.Services = append(wrr.Services, dynamic.WRRService{
+							Name:   name,
+							Status: ptr.To(500),
+							Weight: weight,
+						})
+						continue
+					}
+
+					if svc != nil {
+						conf.HTTP.Services[name] = svc
+					}
+
+					wrr.Services = append(wrr.Services, dynamic.WRRService{
+						Name:   name,
+						Weight: weight,
+					})
+				}
+
+				conf.HTTP.Services[wrrName] = &dynamic.Service{Weighted: &wrr}
+				router.Service = wrrName
+			}
+		}
+
+		rt := &router
+		p.applyRouterTransform(ctx, rt, route)
+
+		routerKey = provider.Normalize(routerKey)
+		conf.HTTP.Routers[routerKey] = rt
+	}
+
+	return routeConditions
+}
+
+// loadHTTPService returns a dynamic.Service config corresponding to the given gatev1.HTTPBackendRef.
+// Note that the returned dynamic.Service config can be nil (for cross-provider, internal services, and backendFunc).
+func (p *Provider) loadHTTPService(client Client, route *gatev1.HTTPRoute, backendRef gatev1.HTTPBackendRef) (string, *dynamic.Service, *metav1.Condition) {
+	group := groupCore
+	if backendRef.Group != nil && *backendRef.Group != "" {
+		group = string(*backendRef.Group)
+	}
+
+	kind := ptr.Deref(backendRef.Kind, "Service")
+	namespace := ptr.Deref(backendRef.Namespace, gatev1.Namespace(route.Namespace))
+	namespaceStr := string(namespace)
+	serviceName := provider.Normalize(makeID(namespaceStr, string(backendRef.Name)))
+
+	// TODO support cross namespace through ReferenceGrant.
+	if namespaceStr != route.Namespace {
+		return serviceName, nil, &metav1.Condition{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionFalse,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteReasonRefNotPermitted),
+			Message:            fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s namespace not allowed", group, kind, namespace, backendRef.Name),
+		}
+	}
+
+	if group != groupCore || kind != "Service" {
+		name, service, err := p.loadHTTPBackendRef(namespaceStr, backendRef)
+		if err != nil {
+			return serviceName, nil, &metav1.Condition{
+				Type:               string(gatev1.RouteConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: route.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.RouteReasonInvalidKind),
+				Message:            fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s: %s", group, kind, namespace, backendRef.Name, err),
+			}
+		}
+
+		return name, service, nil
+	}
+
+	port := ptr.Deref(backendRef.Port, gatev1.PortNumber(0))
+	if port == 0 {
+		return serviceName, nil, &metav1.Condition{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionFalse,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteReasonUnsupportedProtocol),
+			Message:            fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s port is required", group, kind, namespace, backendRef.Name),
+		}
+	}
+
+	portStr := strconv.FormatInt(int64(port), 10)
+	serviceName = provider.Normalize(serviceName + "-" + portStr)
+
+	lb, err := loadHTTPServers(client, namespaceStr, backendRef)
+	if err != nil {
+		return serviceName, nil, &metav1.Condition{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionFalse,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteReasonBackendNotFound),
+			Message:            fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s: %s", group, kind, namespace, backendRef.Name, err),
+		}
+	}
+
+	return serviceName, &dynamic.Service{LoadBalancer: lb}, nil
+}
+
+func (p *Provider) loadHTTPBackendRef(namespace string, backendRef gatev1.HTTPBackendRef) (string, *dynamic.Service, error) {
+	// Support for cross-provider references (e.g: api@internal).
+	// This provides the same behavior as for IngressRoutes.
+	if *backendRef.Kind == "TraefikService" && strings.Contains(string(backendRef.Name), "@") {
+		return string(backendRef.Name), nil, nil
+	}
+
+	backendFunc, ok := p.groupKindBackendFuncs[string(*backendRef.Group)][string(*backendRef.Kind)]
+	if !ok {
+		return "", nil, fmt.Errorf("unsupported HTTPBackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
+	}
+	if backendFunc == nil {
+		return "", nil, fmt.Errorf("undefined backendFunc for HTTPBackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
+	}
+
+	return backendFunc(string(backendRef.Name), namespace)
+}
+
+func (p *Provider) loadMiddlewares(listenerProtocol gatev1.ProtocolType, namespace, prefix string, filters []gatev1.HTTPRouteFilter) (map[string]*dynamic.Middleware, error) {
+	middlewares := make(map[string]*dynamic.Middleware)
+
+	for i, filter := range filters {
+		switch filter.Type {
+		case gatev1.HTTPRouteFilterRequestRedirect:
+			middlewareName := provider.Normalize(fmt.Sprintf("%s-%s-%d", prefix, strings.ToLower(string(filter.Type)), i))
+			middlewares[middlewareName] = createRedirectRegexMiddleware(listenerProtocol, filter.RequestRedirect)
+
+		case gatev1.HTTPRouteFilterRequestHeaderModifier:
+			middlewareName := provider.Normalize(fmt.Sprintf("%s-%s-%d", prefix, strings.ToLower(string(filter.Type)), i))
+			middlewares[middlewareName] = createRequestHeaderModifier(filter.RequestHeaderModifier)
+
+		case gatev1.HTTPRouteFilterExtensionRef:
+			name, middleware, err := p.loadHTTPRouteFilterExtensionRef(namespace, filter.ExtensionRef)
+			if err != nil {
+				return nil, fmt.Errorf("loading ExtensionRef filter %s: %w", filter.Type, err)
+			}
+
+			middlewares[name] = middleware
+
+		default:
+			// As per the spec: https://gateway-api.sigs.k8s.io/api-types/httproute/#filters-optional
+			// In all cases where incompatible or unsupported filters are
+			// specified, implementations MUST add a warning condition to
+			// status.
+			return nil, fmt.Errorf("unsupported filter %s", filter.Type)
+		}
+	}
+
+	return middlewares, nil
+}
+
+func (p *Provider) loadHTTPRouteFilterExtensionRef(namespace string, extensionRef *gatev1.LocalObjectReference) (string, *dynamic.Middleware, error) {
+	if extensionRef == nil {
+		return "", nil, errors.New("filter extension ref undefined")
+	}
+
+	filterFunc, ok := p.groupKindFilterFuncs[string(extensionRef.Group)][string(extensionRef.Kind)]
+	if !ok {
+		return "", nil, fmt.Errorf("unsupported filter extension ref %s/%s/%s", extensionRef.Group, extensionRef.Kind, extensionRef.Name)
+	}
+	if filterFunc == nil {
+		return "", nil, fmt.Errorf("undefined filterFunc for filter extension ref %s/%s/%s", extensionRef.Group, extensionRef.Kind, extensionRef.Name)
+	}
+
+	return filterFunc(string(extensionRef.Name), namespace)
+}
+
+// TODO support cross namespace through ReferencePolicy.
+func loadHTTPServers(client Client, namespace string, backendRef gatev1.HTTPBackendRef) (*dynamic.ServersLoadBalancer, error) {
+	service, exists, err := client.GetService(namespace, string(backendRef.Name))
+	if err != nil {
+		return nil, fmt.Errorf("getting service: %w", err)
+	}
+	if !exists {
+		return nil, errors.New("service not found")
+	}
+
+	var portSpec corev1.ServicePort
+	var match bool
+
+	for _, p := range service.Spec.Ports {
+		if backendRef.Port == nil || p.Port == int32(*backendRef.Port) {
+			portSpec = p
+			match = true
+			break
+		}
+	}
+	if !match {
+		return nil, errors.New("service port not found")
+	}
+
+	endpoints, endpointsExists, err := client.GetEndpoints(namespace, string(backendRef.Name))
+	if err != nil {
+		return nil, fmt.Errorf("getting endpoints: %w", err)
+	}
+	if !endpointsExists {
+		return nil, errors.New("endpoints not found")
+	}
+
+	if len(endpoints.Subsets) == 0 {
+		return nil, errors.New("subset not found")
+	}
+
+	lb := &dynamic.ServersLoadBalancer{}
+	lb.SetDefaults()
+
+	var port int32
+	var portStr string
+	for _, subset := range endpoints.Subsets {
+		for _, p := range subset.Ports {
+			if portSpec.Name == p.Name {
+				port = p.Port
+				break
+			}
+		}
+
+		if port == 0 {
+			return nil, errors.New("cannot define a port")
+		}
+
+		protocol := getProtocol(portSpec)
+
+		portStr = strconv.FormatInt(int64(port), 10)
+		for _, addr := range subset.Addresses {
+			lb.Servers = append(lb.Servers, dynamic.Server{
+				URL: fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(addr.IP, portStr)),
+			})
+		}
+	}
+
+	return lb, nil
+}
+
+func hostRule(hostnames []gatev1.Hostname) string {
+	var rules []string
+
+	for _, hostname := range hostnames {
+		host := string(hostname)
+
+		wildcard := strings.Count(host, "*")
+		if wildcard == 0 {
+			rules = append(rules, fmt.Sprintf("Host(`%s`)", host))
+			continue
+		}
+
+		host = strings.Replace(regexp.QuoteMeta(host), `\*\.`, `[a-z0-9-\.]+\.`, 1)
+		rules = append(rules, fmt.Sprintf("HostRegexp(`^%s$`)", host))
+	}
+
+	switch len(rules) {
+	case 0:
+		return ""
+	case 1:
+		return rules[0]
+	default:
+		return fmt.Sprintf("(%s)", strings.Join(rules, " || "))
+	}
+}
+
+func routerRule(routeRule gatev1.HTTPRouteRule, hostRule string) string {
+	var rule string
+	var matchesRules []string
+
+	for _, match := range routeRule.Matches {
+		path := ptr.Deref(match.Path, gatev1.HTTPPathMatch{
+			Type:  ptr.To(gatev1.PathMatchPathPrefix),
+			Value: ptr.To("/"),
+		})
+		pathType := ptr.Deref(path.Type, gatev1.PathMatchPathPrefix)
+		pathValue := ptr.Deref(path.Value, "/")
+
+		var matchRules []string
+		switch pathType {
+		case gatev1.PathMatchExact:
+			matchRules = append(matchRules, fmt.Sprintf("Path(`%s`)", pathValue))
+		case gatev1.PathMatchPathPrefix:
+			matchRules = append(matchRules, buildPathMatchPathPrefixRule(pathValue))
+		case gatev1.PathMatchRegularExpression:
+			matchRules = append(matchRules, fmt.Sprintf("PathRegexp(`%s`)", pathValue))
+		}
+
+		matchRules = append(matchRules, headerRules(match.Headers)...)
+		matchesRules = append(matchesRules, strings.Join(matchRules, " && "))
+	}
+
+	// If no matches are specified, the default is a prefix
+	// path match on "/", which has the effect of matching every
+	// HTTP request.
+	if len(routeRule.Matches) == 0 {
+		matchesRules = append(matchesRules, "PathPrefix(`/`)")
+	}
+
+	if hostRule != "" {
+		if len(matchesRules) == 0 {
+			return hostRule
+		}
+		rule += hostRule + " && "
+	}
+
+	if len(matchesRules) == 1 {
+		return rule + matchesRules[0]
+	}
+
+	if len(rule) == 0 {
+		return strings.Join(matchesRules, " || ")
+	}
+
+	return rule + "(" + strings.Join(matchesRules, " || ") + ")"
+}
+
+func headerRules(headers []gatev1.HTTPHeaderMatch) []string {
+	var headerRules []string
+	for _, header := range headers {
+		typ := ptr.Deref(header.Type, gatev1.HeaderMatchExact)
+		switch typ {
+		case gatev1.HeaderMatchExact:
+			headerRules = append(headerRules, fmt.Sprintf("Header(`%s`,`%s`)", header.Name, header.Value))
+		case gatev1.HeaderMatchRegularExpression:
+			headerRules = append(headerRules, fmt.Sprintf("HeaderRegexp(`%s`,`%s`)", header.Name, header.Value))
+		}
+	}
+	return headerRules
+}
+
+func buildPathMatchPathPrefixRule(path string) string {
+	if path == "/" {
+		return "PathPrefix(`/`)"
+	}
+
+	path = strings.TrimSuffix(path, "/")
+	return fmt.Sprintf("(Path(`%[1]s`) || PathPrefix(`%[1]s/`))", path)
+}
+
+// createRequestHeaderModifier does not enforce/check the configuration,
+// as the spec indicates that either the webhook or CEL (since v1.0 GA Release) should enforce that.
+func createRequestHeaderModifier(filter *gatev1.HTTPHeaderFilter) *dynamic.Middleware {
+	sets := map[string]string{}
+	for _, header := range filter.Set {
+		sets[string(header.Name)] = header.Value
+	}
+
+	adds := map[string]string{}
+	for _, header := range filter.Add {
+		adds[string(header.Name)] = header.Value
+	}
+
+	return &dynamic.Middleware{
+		RequestHeaderModifier: &dynamic.RequestHeaderModifier{
+			Set:    sets,
+			Add:    adds,
+			Remove: filter.Remove,
+		},
+	}
+}
+
+func createRedirectRegexMiddleware(listenerProtocol gatev1.ProtocolType, filter *gatev1.HTTPRequestRedirectFilter) *dynamic.Middleware {
+	// The spec allows for an empty string in which case we should use the
+	// scheme of the request which in this case is the listener scheme.
+	filterScheme := ptr.Deref(filter.Scheme, strings.ToLower(string(listenerProtocol)))
+	statusCode := ptr.Deref(filter.StatusCode, http.StatusFound)
+
+	port := "${port}"
+	if filter.Port != nil {
+		port = fmt.Sprintf(":%d", *filter.Port)
+	}
+
+	hostname := "${hostname}"
+	if filter.Hostname != nil && *filter.Hostname != "" {
+		hostname = string(*filter.Hostname)
+	}
+
+	return &dynamic.Middleware{
+		RedirectRegex: &dynamic.RedirectRegex{
+			Regex:       `^[a-z]+:\/\/(?P<userInfo>.+@)?(?P<hostname>\[[\w:\.]+\]|[\w\._-]+)(?P<port>:\d+)?\/(?P<path>.*)`,
+			Replacement: fmt.Sprintf("%s://${userinfo}%s%s/${path}", filterScheme, hostname, port),
+			Permanent:   statusCode == http.StatusMovedPermanently,
+		},
+	}
+}
+
+func getProtocol(portSpec corev1.ServicePort) string {
+	protocol := "http"
+	if portSpec.Port == 443 || strings.HasPrefix(portSpec.Name, "https") {
+		protocol = "https"
+	}
+
+	return protocol
+}

pkg/provider/kubernetes/gateway/httproute_test.go

@@ -0,0 +1,281 @@
+package gateway
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/utils/ptr"
+	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func Test_hostRule(t *testing.T) {
+	testCases := []struct {
+		desc         string
+		hostnames    []gatev1.Hostname
+		expectedRule string
+		expectErr    bool
+	}{
+		{
+			desc:         "Empty rule and matches",
+			expectedRule: "",
+		},
+		{
+			desc: "One Host",
+			hostnames: []gatev1.Hostname{
+				"Foo",
+			},
+			expectedRule: "Host(`Foo`)",
+		},
+		{
+			desc: "Multiple Hosts",
+			hostnames: []gatev1.Hostname{
+				"Foo",
+				"Bar",
+				"Bir",
+			},
+			expectedRule: "(Host(`Foo`) || Host(`Bar`) || Host(`Bir`))",
+		},
+		{
+			desc: "Several Host and wildcard",
+			hostnames: []gatev1.Hostname{
+				"*.bar.foo",
+				"bar.foo",
+				"foo.foo",
+			},
+			expectedRule: "(HostRegexp(`^[a-z0-9-\\.]+\\.bar\\.foo$`) || Host(`bar.foo`) || Host(`foo.foo`))",
+		},
+		{
+			desc: "Host with wildcard",
+			hostnames: []gatev1.Hostname{
+				"*.bar.foo",
+			},
+			expectedRule: "HostRegexp(`^[a-z0-9-\\.]+\\.bar\\.foo$`)",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rule := hostRule(test.hostnames)
+			assert.Equal(t, test.expectedRule, rule)
+		})
+	}
+}
+
+func Test_routerRule(t *testing.T) {
+	testCases := []struct {
+		desc          string
+		routeRule     gatev1.HTTPRouteRule
+		hostRule      string
+		expectedRule  string
+		expectedError bool
+	}{
+		{
+			desc:         "Empty rule and matches",
+			expectedRule: "PathPrefix(`/`)",
+		},
+		{
+			desc:         "One Host rule without matches",
+			hostRule:     "Host(`foo.com`)",
+			expectedRule: "Host(`foo.com`) && PathPrefix(`/`)",
+		},
+		{
+			desc: "One HTTPRouteMatch with nil HTTPHeaderMatch",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: ptr.To(gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchPathPrefix),
+							Value: ptr.To("/"),
+						}),
+						Headers: nil,
+					},
+				},
+			},
+			expectedRule: "PathPrefix(`/`)",
+		},
+		{
+			desc: "One HTTPRouteMatch with nil HTTPHeaderMatch Type",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: ptr.To(gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchPathPrefix),
+							Value: ptr.To("/"),
+						}),
+						Headers: []gatev1.HTTPHeaderMatch{
+							{Name: "foo", Value: "bar"},
+						},
+					},
+				},
+			},
+			expectedRule: "PathPrefix(`/`) && Header(`foo`,`bar`)",
+		},
+		{
+			desc: "One HTTPRouteMatch with nil HTTPPathMatch",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{Path: nil},
+				},
+			},
+			expectedRule: "PathPrefix(`/`)",
+		},
+		{
+			desc: "One HTTPRouteMatch with nil HTTPPathMatch Type",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  nil,
+							Value: ptr.To("/foo/"),
+						},
+					},
+				},
+			},
+			expectedRule: "(Path(`/foo`) || PathPrefix(`/foo/`))",
+		},
+		{
+			desc: "One HTTPRouteMatch with nil HTTPPathMatch Values",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: nil,
+						},
+					},
+				},
+			},
+			expectedRule: "Path(`/`)",
+		},
+		{
+			desc: "One Path in matches",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+					},
+				},
+			},
+			expectedRule: "Path(`/foo/`)",
+		},
+		{
+			desc: "One Path in matches and another empty",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+					},
+					{},
+				},
+			},
+			expectedRule: "Path(`/foo/`) || PathPrefix(`/`)",
+		},
+		{
+			desc: "Path OR Header rules",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+					},
+					{
+						Headers: []gatev1.HTTPHeaderMatch{
+							{
+								Type:  ptr.To(gatev1.HeaderMatchExact),
+								Name:  "my-header",
+								Value: "foo",
+							},
+						},
+					},
+				},
+			},
+			expectedRule: "Path(`/foo/`) || PathPrefix(`/`) && Header(`my-header`,`foo`)",
+		},
+		{
+			desc: "Path && Header rules",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+						Headers: []gatev1.HTTPHeaderMatch{
+							{
+								Type:  ptr.To(gatev1.HeaderMatchExact),
+								Name:  "my-header",
+								Value: "foo",
+							},
+						},
+					},
+				},
+			},
+			expectedRule: "Path(`/foo/`) && Header(`my-header`,`foo`)",
+		},
+		{
+			desc:     "Host && Path && Header rules",
+			hostRule: "Host(`foo.com`)",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+						Headers: []gatev1.HTTPHeaderMatch{
+							{
+								Type:  ptr.To(gatev1.HeaderMatchExact),
+								Name:  "my-header",
+								Value: "foo",
+							},
+						},
+					},
+				},
+			},
+			expectedRule: "Host(`foo.com`) && Path(`/foo/`) && Header(`my-header`,`foo`)",
+		},
+		{
+			desc:     "Host && (Path || Header) rules",
+			hostRule: "Host(`foo.com`)",
+			routeRule: gatev1.HTTPRouteRule{
+				Matches: []gatev1.HTTPRouteMatch{
+					{
+						Path: &gatev1.HTTPPathMatch{
+							Type:  ptr.To(gatev1.PathMatchExact),
+							Value: ptr.To("/foo/"),
+						},
+					},
+					{
+						Headers: []gatev1.HTTPHeaderMatch{
+							{
+								Type:  ptr.To(gatev1.HeaderMatchExact),
+								Name:  "my-header",
+								Value: "foo",
+							},
+						},
+					},
+				},
+			},
+			expectedRule: "Host(`foo.com`) && (Path(`/foo/`) || PathPrefix(`/`) && Header(`my-header`,`foo`))",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rule := routerRule(test.routeRule, test.hostRule)
+			assert.Equal(t, test.expectedRule, rule)
+		})
+	}
+}

pkg/provider/kubernetes/gateway/tcproute.go

@@ -0,0 +1,296 @@
+package gateway
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/provider"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ktypes "k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
+	gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+func (p *Provider) loadTCPRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
+	logger := log.Ctx(ctx)
+	routes, err := client.ListTCPRoutes()
+	if err != nil {
+		logger.Error().Err(err).Msgf("Get TCPRoutes: %s", err)
+	}
+
+	for _, route := range routes {
+		logger := log.Ctx(ctx).With().Str("tcproute", route.Name).Str("namespace", route.Namespace).Logger()
+
+		var parentStatuses []gatev1alpha2.RouteParentStatus
+		for _, parentRef := range route.Spec.ParentRefs {
+			parentStatus := &gatev1alpha2.RouteParentStatus{
+				ParentRef:      parentRef,
+				ControllerName: controllerName,
+				Conditions: []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionTrue,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonAccepted),
+					},
+				},
+			}
+
+			var attachedListeners bool
+			for _, listener := range gatewayListeners {
+				if !matchListener(listener, route.Namespace, parentRef) {
+					continue
+				}
+
+				if !allowRoute(listener, route.Namespace, kindTCPRoute) {
+					continue
+				}
+
+				listener.Status.AttachedRoutes++
+				attachedListeners = true
+
+				resolveConditions := p.loadTCPRoute(client, listener, route, conf)
+
+				// TODO: handle more accurately route conditions (in case of multiple listener matching).
+				for _, condition := range resolveConditions {
+					parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
+				}
+			}
+
+			if !attachedListeners {
+				parentStatus.Conditions = []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonNoMatchingParent),
+					},
+				}
+			}
+
+			parentStatuses = append(parentStatuses, *parentStatus)
+		}
+
+		routeStatus := gatev1alpha2.TCPRouteStatus{
+			RouteStatus: gatev1alpha2.RouteStatus{
+				Parents: parentStatuses,
+			},
+		}
+		if err := client.UpdateTCPRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, routeStatus); err != nil {
+			logger.Error().
+				Err(err).
+				Msg("Unable to update TCPRoute status")
+		}
+	}
+}
+
+func (p *Provider) loadTCPRoute(client Client, listener gatewayListener, route *gatev1alpha2.TCPRoute, conf *dynamic.Configuration) []metav1.Condition {
+	routeConditions := []metav1.Condition{
+		{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionTrue,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteConditionResolvedRefs),
+		},
+	}
+
+	router := dynamic.TCPRouter{
+		Rule:        "HostSNI(`*`)",
+		EntryPoints: []string{listener.EPName},
+		RuleSyntax:  "v3",
+	}
+
+	if listener.Protocol == gatev1.TLSProtocolType && listener.TLS != nil {
+		// TODO support let's encrypt
+		router.TLS = &dynamic.RouterTCPTLSConfig{
+			Passthrough: listener.TLS.Mode != nil && *listener.TLS.Mode == gatev1.TLSModePassthrough,
+		}
+	}
+
+	// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
+	routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
+	routerKey := provider.Normalize(makeRouterKey("", makeID(route.Namespace, routerName)))
+
+	var ruleServiceNames []string
+	for i, rule := range route.Spec.Rules {
+		if rule.BackendRefs == nil {
+			// Should not happen due to validation.
+			// https://github.com/kubernetes-sigs/gateway-api/blob/v0.4.0/apis/v1alpha2/tcproute_types.go#L76
+			continue
+		}
+
+		wrrService, subServices, err := loadTCPServices(client, route.Namespace, rule.BackendRefs)
+		if err != nil {
+			routeConditions = appendCondition(routeConditions, metav1.Condition{
+				Type:               string(gatev1.RouteConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: route.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.RouteReasonBackendNotFound),
+				Message:            fmt.Sprintf("Cannot load TCPRoute service %s/%s: %v", route.Namespace, route.Name, err),
+			})
+			return routeConditions
+		}
+
+		for svcName, svc := range subServices {
+			conf.TCP.Services[svcName] = svc
+		}
+
+		serviceName := fmt.Sprintf("%s-wrr-%d", routerKey, i)
+		conf.TCP.Services[serviceName] = wrrService
+
+		ruleServiceNames = append(ruleServiceNames, serviceName)
+	}
+
+	if len(ruleServiceNames) == 1 {
+		router.Service = ruleServiceNames[0]
+		conf.TCP.Routers[routerKey] = &router
+		return routeConditions
+	}
+
+	routeServiceKey := routerKey + "-wrr"
+	routeService := &dynamic.TCPService{Weighted: &dynamic.TCPWeightedRoundRobin{}}
+
+	for _, name := range ruleServiceNames {
+		service := dynamic.TCPWRRService{Name: name}
+		service.SetDefaults()
+
+		routeService.Weighted.Services = append(routeService.Weighted.Services, service)
+	}
+
+	conf.TCP.Services[routeServiceKey] = routeService
+
+	router.Service = routeServiceKey
+	conf.TCP.Routers[routerKey] = &router
+
+	return routeConditions
+}
+
+// loadTCPServices is generating a WRR service, even when there is only one target.
+func loadTCPServices(client Client, namespace string, backendRefs []gatev1.BackendRef) (*dynamic.TCPService, map[string]*dynamic.TCPService, error) {
+	services := map[string]*dynamic.TCPService{}
+
+	wrrSvc := &dynamic.TCPService{
+		Weighted: &dynamic.TCPWeightedRoundRobin{
+			Services: []dynamic.TCPWRRService{},
+		},
+	}
+
+	for _, backendRef := range backendRefs {
+		if backendRef.Group == nil || backendRef.Kind == nil {
+			// Should not happen as this is validated by kubernetes
+			continue
+		}
+
+		if isInternalService(backendRef) {
+			return nil, nil, fmt.Errorf("traefik internal service %s is not allowed in a WRR loadbalancer", backendRef.Name)
+		}
+
+		weight := int(ptr.Deref(backendRef.Weight, 1))
+
+		if isTraefikService(backendRef) {
+			wrrSvc.Weighted.Services = append(wrrSvc.Weighted.Services, dynamic.TCPWRRService{Name: string(backendRef.Name), Weight: &weight})
+			continue
+		}
+
+		if *backendRef.Group != "" && *backendRef.Group != groupCore && *backendRef.Kind != "Service" {
+			return nil, nil, fmt.Errorf("unsupported BackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
+		}
+
+		svc := dynamic.TCPService{
+			LoadBalancer: &dynamic.TCPServersLoadBalancer{},
+		}
+
+		service, exists, err := client.GetService(namespace, string(backendRef.Name))
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if !exists {
+			return nil, nil, errors.New("service not found")
+		}
+
+		if len(service.Spec.Ports) > 1 && backendRef.Port == nil {
+			// If the port is unspecified and the backend is a Service
+			// object consisting of multiple port definitions, the route
+			// must be dropped from the Gateway. The controller should
+			// raise the "ResolvedRefs" condition on the Gateway with the
+			// "DroppedRoutes" reason. The gateway status for this route
+			// should be updated with a condition that describes the error
+			// more specifically.
+			log.Error().Msg("A multiple ports Kubernetes Service cannot be used if unspecified backendRef.Port")
+			continue
+		}
+
+		var portSpec corev1.ServicePort
+		var match bool
+
+		for _, p := range service.Spec.Ports {
+			if backendRef.Port == nil || p.Port == int32(*backendRef.Port) {
+				portSpec = p
+				match = true
+				break
+			}
+		}
+
+		if !match {
+			return nil, nil, errors.New("service port not found")
+		}
+
+		endpoints, endpointsExists, endpointsErr := client.GetEndpoints(namespace, string(backendRef.Name))
+		if endpointsErr != nil {
+			return nil, nil, endpointsErr
+		}
+
+		if !endpointsExists {
+			return nil, nil, errors.New("endpoints not found")
+		}
+
+		if len(endpoints.Subsets) == 0 {
+			return nil, nil, errors.New("subset not found")
+		}
+
+		var port int32
+		var portStr string
+		for _, subset := range endpoints.Subsets {
+			for _, p := range subset.Ports {
+				if portSpec.Name == p.Name {
+					port = p.Port
+					break
+				}
+			}
+
+			if port == 0 {
+				return nil, nil, errors.New("cannot define a port")
+			}
+
+			portStr = strconv.FormatInt(int64(port), 10)
+			for _, addr := range subset.Addresses {
+				svc.LoadBalancer.Servers = append(svc.LoadBalancer.Servers, dynamic.TCPServer{
+					Address: net.JoinHostPort(addr.IP, portStr),
+				})
+			}
+		}
+
+		serviceName := provider.Normalize(makeID(service.Namespace, service.Name) + "-" + portStr)
+		services[serviceName] = &svc
+
+		wrrSvc.Weighted.Services = append(wrrSvc.Weighted.Services, dynamic.TCPWRRService{Name: serviceName, Weight: &weight})
+	}
+
+	if len(wrrSvc.Weighted.Services) == 0 {
+		return nil, nil, errors.New("no service has been created")
+	}
+
+	return wrrSvc, services, nil
+}

pkg/provider/kubernetes/gateway/tlsroute.go

@@ -0,0 +1,210 @@
+package gateway
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/provider"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ktypes "k8s.io/apimachinery/pkg/types"
+	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
+	gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+func (p *Provider) loadTLSRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
+	logger := log.Ctx(ctx)
+	routes, err := client.ListTLSRoutes()
+	if err != nil {
+		logger.Error().Err(err).Msgf("Get TLSRoutes: %s", err)
+	}
+
+	for _, route := range routes {
+		logger := log.Ctx(ctx).With().Str("tlsroute", route.Name).Str("namespace", route.Namespace).Logger()
+
+		var parentStatuses []gatev1alpha2.RouteParentStatus
+		for _, parentRef := range route.Spec.ParentRefs {
+			parentStatus := &gatev1alpha2.RouteParentStatus{
+				ParentRef:      parentRef,
+				ControllerName: controllerName,
+				Conditions: []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionTrue,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonAccepted),
+					},
+				},
+			}
+
+			var attachedListeners bool
+			for _, listener := range gatewayListeners {
+				if !matchListener(listener, route.Namespace, parentRef) {
+					continue
+				}
+
+				if !allowRoute(listener, route.Namespace, kindTLSRoute) {
+					continue
+				}
+
+				hostnames, ok := findMatchingHostnames(listener.Hostname, route.Spec.Hostnames)
+				if !ok {
+					continue
+				}
+
+				listener.Status.AttachedRoutes++
+				attachedListeners = true
+
+				resolveConditions := p.loadTLSRoute(client, listener, route, hostnames, conf)
+
+				// TODO: handle more accurately route conditions (in case of multiple listener matching).
+				for _, condition := range resolveConditions {
+					parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
+				}
+			}
+
+			if !attachedListeners {
+				parentStatus.Conditions = []metav1.Condition{
+					{
+						Type:               string(gatev1.RouteConditionAccepted),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: route.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.RouteReasonNoMatchingParent),
+					},
+				}
+			}
+
+			parentStatuses = append(parentStatuses, *parentStatus)
+		}
+
+		routeStatus := gatev1alpha2.TLSRouteStatus{
+			RouteStatus: gatev1alpha2.RouteStatus{
+				Parents: parentStatuses,
+			},
+		}
+		if err := client.UpdateTLSRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, routeStatus); err != nil {
+			logger.Error().
+				Err(err).
+				Msg("Unable to update TLSRoute status")
+		}
+	}
+}
+
+func (p *Provider) loadTLSRoute(client Client, listener gatewayListener, route *gatev1alpha2.TLSRoute, hostnames []gatev1.Hostname, conf *dynamic.Configuration) []metav1.Condition {
+	routeConditions := []metav1.Condition{
+		{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionTrue,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteConditionResolvedRefs),
+		},
+	}
+
+	router := dynamic.TCPRouter{
+		RuleSyntax:  "v3",
+		Rule:        hostSNIRule(hostnames),
+		EntryPoints: []string{listener.EPName},
+		TLS: &dynamic.RouterTCPTLSConfig{
+			Passthrough: listener.TLS.Mode != nil && *listener.TLS.Mode == gatev1.TLSModePassthrough,
+		},
+	}
+
+	// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
+	routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
+	routerKey := provider.Normalize(makeRouterKey(router.Rule, makeID(route.Namespace, routerName)))
+
+	var ruleServiceNames []string
+	for i, routeRule := range route.Spec.Rules {
+		if len(routeRule.BackendRefs) == 0 {
+			// Should not happen due to validation.
+			// https://github.com/kubernetes-sigs/gateway-api/blob/v0.4.0/apis/v1alpha2/tlsroute_types.go#L120
+			continue
+		}
+
+		wrrService, subServices, err := loadTCPServices(client, route.Namespace, routeRule.BackendRefs)
+		if err != nil {
+			// update "ResolvedRefs" status true with "InvalidBackendRefs" reason
+			routeConditions = appendCondition(routeConditions, metav1.Condition{
+				Type:               string(gatev1.RouteConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: route.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.RouteReasonBackendNotFound),
+				Message:            fmt.Sprintf("Cannot load TLSRoute service %s/%s: %v", route.Namespace, route.Name, err),
+			})
+			continue
+		}
+
+		for svcName, svc := range subServices {
+			conf.TCP.Services[svcName] = svc
+		}
+
+		serviceName := fmt.Sprintf("%s-wrr-%d", routerKey, i)
+		conf.TCP.Services[serviceName] = wrrService
+
+		ruleServiceNames = append(ruleServiceNames, serviceName)
+	}
+
+	if len(ruleServiceNames) == 1 {
+		router.Service = ruleServiceNames[0]
+		conf.TCP.Routers[routerKey] = &router
+
+		return routeConditions
+	}
+
+	routeServiceKey := routerKey + "-wrr"
+	routeService := &dynamic.TCPService{Weighted: &dynamic.TCPWeightedRoundRobin{}}
+
+	for _, name := range ruleServiceNames {
+		service := dynamic.TCPWRRService{Name: name}
+		service.SetDefaults()
+
+		routeService.Weighted.Services = append(routeService.Weighted.Services, service)
+	}
+
+	conf.TCP.Services[routeServiceKey] = routeService
+
+	router.Service = routeServiceKey
+	conf.TCP.Routers[routerKey] = &router
+
+	return routeConditions
+}
+
+func hostSNIRule(hostnames []gatev1.Hostname) string {
+	rules := make([]string, 0, len(hostnames))
+	uniqHostnames := map[gatev1.Hostname]struct{}{}
+
+	for _, hostname := range hostnames {
+		if len(hostname) == 0 {
+			continue
+		}
+
+		if _, exists := uniqHostnames[hostname]; exists {
+			continue
+		}
+
+		host := string(hostname)
+		uniqHostnames[hostname] = struct{}{}
+
+		wildcard := strings.Count(host, "*")
+		if wildcard == 0 {
+			rules = append(rules, fmt.Sprintf("HostSNI(`%s`)", host))
+			continue
+		}
+
+		host = strings.Replace(regexp.QuoteMeta(host), `\*\.`, `[a-z0-9-\.]+\.`, 1)
+		rules = append(rules, fmt.Sprintf("HostSNIRegexp(`^%s$`)", host))
+	}
+
+	if len(hostnames) == 0 || len(rules) == 0 {
+		return "HostSNI(`*`)"
+	}
+
+	return strings.Join(rules, " || ")
+}

pkg/provider/kubernetes/gateway/tlsroute_test.go

@@ -0,0 +1,66 @@
+package gateway
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func Test_hostSNIRule(t *testing.T) {
+	testCases := []struct {
+		desc         string
+		hostnames    []gatev1.Hostname
+		expectedRule string
+		expectError  bool
+	}{
+		{
+			desc:         "Empty",
+			expectedRule: "HostSNI(`*`)",
+		},
+		{
+			desc:         "Empty hostname",
+			hostnames:    []gatev1.Hostname{""},
+			expectedRule: "HostSNI(`*`)",
+		},
+		{
+			desc:         "Supported wildcard",
+			hostnames:    []gatev1.Hostname{"*.foo"},
+			expectedRule: "HostSNIRegexp(`^[a-z0-9-\\.]+\\.foo$`)",
+		},
+		{
+			desc:         "Some empty hostnames",
+			hostnames:    []gatev1.Hostname{"foo", "", "bar"},
+			expectedRule: "HostSNI(`foo`) || HostSNI(`bar`)",
+		},
+		{
+			desc:         "Valid hostname",
+			hostnames:    []gatev1.Hostname{"foo"},
+			expectedRule: "HostSNI(`foo`)",
+		},
+		{
+			desc:         "Multiple valid hostnames",
+			hostnames:    []gatev1.Hostname{"foo", "bar"},
+			expectedRule: "HostSNI(`foo`) || HostSNI(`bar`)",
+		},
+		{
+			desc:         "Multiple valid hostnames with wildcard",
+			hostnames:    []gatev1.Hostname{"bar.foo", "foo.foo", "*.foo"},
+			expectedRule: "HostSNI(`bar.foo`) || HostSNI(`foo.foo`) || HostSNIRegexp(`^[a-z0-9-\\.]+\\.foo$`)",
+		},
+		{
+			desc:         "Multiple overlapping hostnames",
+			hostnames:    []gatev1.Hostname{"foo", "bar", "foo", "baz"},
+			expectedRule: "HostSNI(`foo`) || HostSNI(`bar`) || HostSNI(`baz`)",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rule := hostSNIRule(test.hostnames)
+			assert.Equal(t, test.expectedRule, rule)
+		})
+	}
+}