ingress-gateways: don't log error when registering gateway (#15001)

* ingress-gateways: don't log error when registering gateway

Previously, when an ingress gateway was registered without a
corresponding ingress gateway config entry, an error was logged
because the watch on the config entry returned a nil result.
This is expected so don't log an error.

.changelog/15001.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+ingress-gateways: Don't log error when gateway is registered without a config entry
+```
+

agent/proxycfg/ingress_gateway.go

@@ -91,6 +91,9 @@ func (s *handlerIngressGateway) handleUpdate(ctx context.Context, u UpdateEvent,
 		if !ok {
 			return fmt.Errorf("invalid type for response: %T", u.Result)
 		}
+		if resp.Entry == nil {
+			return nil
+		}
 		gatewayConf, ok := resp.Entry.(*structs.IngressGatewayConfigEntry)
 		if !ok {
 			return fmt.Errorf("invalid type for config entry: %T", resp.Entry)

agent/proxycfg/testing_ingress_gateway.go

@@ -102,6 +102,47 @@ func TestConfigSnapshotIngressGateway(
 	}, nsFn, nil, testSpliceEvents(baseEvents, extraUpdates))
 }
 
+// TestConfigSnapshotIngressGateway_NilConfigEntry is used to test when
+// the update event for the config entry returns nil
+// since this always happens on the first watch if it doesn't exist.
+func TestConfigSnapshotIngressGateway_NilConfigEntry(
+	t testing.T,
+) *ConfigSnapshot {
+	roots, placeholderLeaf := TestCerts(t)
+
+	baseEvents := []UpdateEvent{
+		{
+			CorrelationID: rootsWatchID,
+			Result:        roots,
+		},
+		{
+			CorrelationID: gatewayConfigWatchID,
+			Result: &structs.ConfigEntryResponse{
+				Entry: nil, // The first watch on a config entry will return nil if the config entry doesn't exist.
+			},
+		},
+		{
+			CorrelationID: leafWatchID,
+			Result:        placeholderLeaf,
+		},
+		{
+			CorrelationID: gatewayServicesWatchID,
+			Result: &structs.IndexedGatewayServices{
+				Services: nil,
+			},
+		},
+	}
+
+	return testConfigSnapshotFixture(t, &structs.NodeService{
+		Kind:            structs.ServiceKindIngressGateway,
+		Service:         "ingress-gateway",
+		Port:            9999,
+		Address:         "1.2.3.4",
+		Meta:            nil,
+		TaggedAddresses: nil,
+	}, nil, nil, testSpliceEvents(baseEvents, nil))
+}
+
 func TestConfigSnapshotIngressGatewaySDS_GatewayLevel_MixedTLS(t testing.T) *ConfigSnapshot {
 	secureUID := UpstreamIDFromString("secure")
 	secureChain := discoverychain.TestCompileConfigEntries(

agent/xds/clusters_test.go

@@ -430,6 +430,12 @@ func TestClustersFromSnapshot(t *testing.T) {
 					"default", nil, nil, nil)
 			},
 		},
+		{
+			name: "ingress-gateway-nil-config-entry",
+			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
+				return proxycfg.TestConfigSnapshotIngressGateway_NilConfigEntry(t)
+			},
+		},
 		{
 			name: "ingress-gateway-with-tls-outgoing-min-version",
 			create: func(t testinf.T) *proxycfg.ConfigSnapshot {

agent/xds/endpoints_test.go

@@ -368,6 +368,12 @@ func TestEndpointsFromSnapshot(t *testing.T) {
 					"default", nil, nil, nil)
 			},
 		},
+		{
+			name: "ingress-gateway-nil-config-entry",
+			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
+				return proxycfg.TestConfigSnapshotIngressGateway_NilConfigEntry(t)
+			},
+		},
 		{
 			name: "ingress-gateway-no-services",
 			create: func(t testinf.T) *proxycfg.ConfigSnapshot {

agent/xds/listeners_test.go

@@ -532,6 +532,12 @@ func TestListenersFromSnapshot(t *testing.T) {
 				return proxycfg.TestConfigSnapshotIngressGateway(t, true, "tcp", "default", nil, nil, nil)
 			},
 		},
+		{
+			name: "ingress-gateway-nil-config-entry",
+			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
+				return proxycfg.TestConfigSnapshotIngressGateway_NilConfigEntry(t)
+			},
+		},
 		{
 			name: "ingress-gateway-bind-addrs",
 			create: func(t testinf.T) *proxycfg.ConfigSnapshot {

agent/xds/routes_test.go

@@ -82,6 +82,12 @@ func TestRoutesFromSnapshot(t *testing.T) {
 		},
 		// TODO(rb): test match stanza skipped for grpc
 		// Start ingress gateway test cases
+		{
+			name: "ingress-config-entry-nil",
+			create: func(t testinf.T) *proxycfg.ConfigSnapshot {
+				return proxycfg.TestConfigSnapshotIngressGateway_NilConfigEntry(t)
+			},
+		},
 		{
 			name: "ingress-defaults-no-chain",
 			create: func(t testinf.T) *proxycfg.ConfigSnapshot {

agent/xds/testdata/clusters/ingress-gateway-nil-config-entry.latest.golden

@@ -0,0 +1,5 @@
+{
+  "versionInfo": "00000001",
+  "typeUrl": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
+  "nonce": "00000001"
+}

agent/xds/testdata/endpoints/ingress-gateway-nil-config-entry.latest.golden

@@ -0,0 +1,5 @@
+{
+  "versionInfo": "00000001",
+  "typeUrl": "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment",
+  "nonce": "00000001"
+}

agent/xds/testdata/listeners/ingress-gateway-nil-config-entry.latest.golden

@@ -0,0 +1,5 @@
+{
+  "versionInfo": "00000001",
+  "typeUrl": "type.googleapis.com/envoy.config.listener.v3.Listener",
+  "nonce": "00000001"
+}

agent/xds/testdata/routes/ingress-config-entry-nil.latest.golden

@@ -0,0 +1,5 @@
+{
+  "versionInfo": "00000001",
+  "typeUrl": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+  "nonce": "00000001"
+}