fix: cap condition message to Kubernetes 32768-byte limit by AlinsRan · Pull Request #443 · api7/api7-ingress-controller

AlinsRan · 2026-07-22T00:41:14Z

Type of change:

Bugfix

What this PR does / why we need it:

Sync from apache/apisix-ingress-controller#2816 (part of apache/apisix-ingress-controller#2783).

Kubernetes rejects a status update whose condition Message exceeds 32768 bytes. When a many-path ApisixRoute fails to sync, handleStatusUpdate aggregates every sub-error into one condition message, which overflows the limit; the update is rejected and only logged, so the resource status is silently never written.

Adds a shared, rune-safe TruncateConditionMessage helper (caps at 32768 bytes, backs off to a UTF-8 rune boundary, appends a ... (truncated) marker) and routes every condition-message constructor through it: NewConditionTypeAccepted, NewCondition, NewPolicyCondition, NewPolicyConflictCondition.

Pre-submission checklist:

Test cases added
Backward compatible

Summary by CodeRabbit

Bug Fixes
- Prevented overly long status messages from exceeding Kubernetes limits.
- Preserved UTF-8 characters correctly when shortening messages.
- Added a clear truncation indicator to shortened status messages.
Tests
- Added coverage for message length limits, truncation behavior, and multibyte characters.

Kubernetes rejects status updates whose condition Message exceeds 32768 bytes. When a many-path ApisixRoute sync fails, the aggregated sub-errors overflow this limit and the status update is silently dropped. Add a shared, rune-safe TruncateConditionMessage helper and route every condition constructor Message through it (NewConditionTypeAccepted, NewCondition, NewPolicyCondition, NewPolicyConflictCondition). Sync from apache/apisix-ingress-controller#2816 (part of #2783)

coderabbitai · 2026-07-22T00:41:30Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0edbf472-0b8e-4ada-8901-20d04eb51056

📥 Commits

Reviewing files that changed from the base of the PR and between 5f84a00 and 50ccfe0.

📒 Files selected for processing (3)

internal/controller/status.go
internal/controller/utils/utils.go
internal/controller/utils/utils_test.go

📝 Walkthrough

Walkthrough

Condition messages are now truncated to Kubernetes’ 32,768-byte limit using UTF-8-safe logic. General, policy, conflict, and accepted condition builders use the helper, with tests covering limits, markers, and multibyte characters.

Changes

Condition Message Truncation

Layer / File(s)	Summary
Truncation helper and validation `internal/controller/utils/utils.go`, `internal/controller/utils/utils_test.go`	Adds rune-safe message truncation with a truncation marker and tests byte limits, UTF-8 validity, and accepted-condition output.
Condition builder integration `internal/controller/status.go`, `internal/controller/utils/utils.go`	Applies message truncation in general, policy, conflict, and accepted condition constructors.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	Only unit tests were added; no e2e or integration coverage exercises the ApisixRoute status-update overflow path in handleStatusUpdate.	Add an e2e test that drives a real ApisixRoute sync failure large enough to exceed 32KB and asserts the status update succeeds with a truncated message.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: capping Kubernetes condition messages to the 32768-byte limit.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	Touched files only truncate condition messages; no logs, auth, DB, TLS, or secret-handling changes were introduced.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ee-2783-status-truncate

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-22T00:54:28Z

conformance test report - apisix-standalone mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-22T00:54:25Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    result: success
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests succeeded.
- core:
    result: partial
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 0
      Passed: 32
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests partially succeeded with 1 test skips. Extended tests partially
    succeeded with 1 test skips.
- core:
    result: partial
    skippedTests:
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 10
      Skipped: 1
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 1 test skips.

github-actions · 2026-07-22T00:54:49Z

conformance test report - apisix mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-22T00:54:46Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    result: success
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests succeeded.
- core:
    failedTests:
    - HTTPRouteInvalidBackendRefUnknownKind
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 1
      Passed: 31
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests failed with 1 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    result: partial
    skippedTests:
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 10
      Skipped: 1
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 1 test skips.

github-actions · 2026-07-22T01:12:44Z

conformance test report

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-22T01:12:41Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - GatewayModifyListeners
    result: failure
    statistics:
      Failed: 1
      Passed: 11
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests failed with 1 test failures.
- core:
    failedTests:
    - GatewayModifyListeners
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 1
      Passed: 31
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests failed with 1 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    failedTests:
    - GatewayModifyListeners
    - TLSRouteSimpleSameNamespace
    result: failure
    statistics:
      Failed: 2
      Passed: 9
      Skipped: 0
  name: GATEWAY-TLS
  summary: Core tests failed with 2 test failures.

AlinsRan self-assigned this Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: cap condition message to Kubernetes 32768-byte limit#443

fix: cap condition message to Kubernetes 32768-byte limit#443
AlinsRan wants to merge 1 commit into
masterfrom
ee-2783-status-truncate

AlinsRan commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

AlinsRan commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change:

What this PR does / why we need it:

Pre-submission checklist:

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 22, 2026

conformance test report - apisix-standalone mode

Uh oh!

github-actions Bot commented Jul 22, 2026

conformance test report - apisix mode

Uh oh!

github-actions Bot commented Jul 22, 2026

conformance test report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AlinsRan commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading