Implement round-trip KRM fuzzer for NetworkServicesHTTPRoute

.gemini/skills/create-fuzzer/journal/NetworkServicesHTTPRoute.md

@@ -0,0 +1,20 @@
+# Journal: KRM Fuzzer for NetworkServicesHTTPRoute
+
+## Observations
+
+1. **Boolean zero-value mapping loss in `oneof`**:
+   The generated mapper uses `direct.LazyPtr(in.GetPresentMatch())` for mapping `MatchType` inside `HttprouteQueryParameters` and `HttprouteHeaders`. Since `PresentMatch` is a boolean, and `direct.LazyPtr(false)` returns `nil`, any `PresentMatch: false` (which was explicitly randomized in the fuzz tests) became `nil` after the round-trip conversion.
+   - **Fix**: We hand-coded custom mappers `HttprouteQueryParameters_FromProto`/`ToProto` and `HttprouteHeaders_FromProto`/`ToProto` to directly inspect the proto `oneof` variant (e.g., checking `in.MatchType.(type)`), preserving both `true` and `false` correctly without losing data.
+
+2. **Unimplemented fields**:
+   Several nested fields in the `HttpRoute` proto were identified during randomized fuzz testing as having no KRM equivalent, such as:
+   - `rules[].action.direct_response`
+   - `rules[].action.idle_timeout`
+   - `rules[].action.stateful_session_affinity`
+   - `rules[].action.destinations[].request_header_modifier`
+   - `rules[].action.destinations[].response_header_modifier`
+   - `rules[].action.request_mirror_policy.destination.request_header_modifier`
+   - `rules[].action.request_mirror_policy.destination.response_header_modifier`
+   - `rules[].action.request_mirror_policy.mirror_percent`
+
+   These were safely marked as `Unimplemented_NotYetTriaged` in the fuzzer to bypass round-trip comparisons on those fields.

pkg/controller/direct/networkservices/networkserviceshttproute_fuzzer.go

@@ -0,0 +1,73 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +tool:fuzz-gen
+// proto.message: google.cloud.networkservices.v1.HttpRoute
+// api.group: networkservices.cnrm.cloud.google.com
+
+package networkservices
+
+import (
+	pb "cloud.google.com/go/networkservices/apiv1/networkservicespb"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/fuzztesting"
+)
+
+func init() {
+	fuzztesting.RegisterKRMFuzzer(networkServicesHTTPRouteFuzzer())
+}
+
+func networkServicesHTTPRouteFuzzer() fuzztesting.KRMFuzzer {
+	f := fuzztesting.NewKRMTypedFuzzer(&pb.HttpRoute{},
+		NetworkServicesHTTPRouteSpec_FromProto, NetworkServicesHTTPRouteSpec_ToProto,
+		NetworkServicesHTTPRouteStatus_FromProto, NetworkServicesHTTPRouteStatus_ToProto,
+	)
+
+	// Field comparison between KRM NetworkServicesHTTPRouteSpec and Proto HttpRoute:
+	// - Description           <=> .description
+	// - Hostnames             <=> .hostnames
+	// - Gateways              <=> .gateways
+	// - Meshes                <=> .meshes
+	// - Rules                 <=> .rules
+	//
+	// Fields ignored because they are not part of KRM Spec:
+	// - .name                 (Identity)
+	// - .self_link            (Status)
+	// - .create_time          (Status)
+	// - .update_time          (Status)
+	// - .labels               (handled by KCC metadata labels)
+
+	f.SpecField(".description")
+	f.SpecField(".hostnames")
+	f.SpecField(".gateways")
+	f.SpecField(".meshes")
+	f.SpecField(".rules")
+
+	f.StatusField(".self_link")
+	f.StatusField(".create_time")
+	f.StatusField(".update_time")
+
+	f.Unimplemented_Identity(".name")
+	f.Unimplemented_LabelsAnnotations(".labels")
+
+	f.Unimplemented_NotYetTriaged(".rules[].action.direct_response")
+	f.Unimplemented_NotYetTriaged(".rules[].action.idle_timeout")
+	f.Unimplemented_NotYetTriaged(".rules[].action.stateful_session_affinity")
+	f.Unimplemented_NotYetTriaged(".rules[].action.destinations[].request_header_modifier")
+	f.Unimplemented_NotYetTriaged(".rules[].action.destinations[].response_header_modifier")
+	f.Unimplemented_NotYetTriaged(".rules[].action.request_mirror_policy.destination.request_header_modifier")
+	f.Unimplemented_NotYetTriaged(".rules[].action.request_mirror_policy.destination.response_header_modifier")
+	f.Unimplemented_NotYetTriaged(".rules[].action.request_mirror_policy.mirror_percent")
+
+	return f
+}

pkg/controller/direct/networkservices/networkserviceshttproute_mapper.go

@@ -256,3 +256,92 @@ func HttprouteRetryPolicy_ToProto(mapCtx *direct.MapContext, in *krm.HttprouteRe
 	out.PerTryTimeout = direct.StringDuration_ToProto(mapCtx, in.PerTryTimeout)
 	return out
 }
+
+func HttprouteQueryParameters_FromProto(mapCtx *direct.MapContext, in *pb.HttpRoute_QueryParameterMatch) *krm.HttprouteQueryParameters {
+	if in == nil {
+		return nil
+	}
+	out := &krm.HttprouteQueryParameters{}
+	out.QueryParameter = direct.LazyPtr(in.GetQueryParameter())
+
+	switch m := in.MatchType.(type) {
+	case *pb.HttpRoute_QueryParameterMatch_ExactMatch:
+		out.ExactMatch = &m.ExactMatch
+	case *pb.HttpRoute_QueryParameterMatch_RegexMatch:
+		out.RegexMatch = &m.RegexMatch
+	case *pb.HttpRoute_QueryParameterMatch_PresentMatch:
+		out.PresentMatch = &m.PresentMatch
+	}
+	return out
+}
+
+func HttprouteQueryParameters_ToProto(mapCtx *direct.MapContext, in *krm.HttprouteQueryParameters) *pb.HttpRoute_QueryParameterMatch {
+	if in == nil {
+		return nil
+	}
+	out := &pb.HttpRoute_QueryParameterMatch{}
+	if in.ExactMatch != nil {
+		out.MatchType = &pb.HttpRoute_QueryParameterMatch_ExactMatch{ExactMatch: *in.ExactMatch}
+	}
+	if in.RegexMatch != nil {
+		out.MatchType = &pb.HttpRoute_QueryParameterMatch_RegexMatch{RegexMatch: *in.RegexMatch}
+	}
+	if in.PresentMatch != nil {
+		out.MatchType = &pb.HttpRoute_QueryParameterMatch_PresentMatch{PresentMatch: *in.PresentMatch}
+	}
+	out.QueryParameter = direct.ValueOf(in.QueryParameter)
+	return out
+}
+
+func HttprouteHeaders_FromProto(mapCtx *direct.MapContext, in *pb.HttpRoute_HeaderMatch) *krm.HttprouteHeaders {
+	if in == nil {
+		return nil
+	}
+	out := &krm.HttprouteHeaders{}
+	out.Header = direct.LazyPtr(in.GetHeader())
+	out.InvertMatch = direct.LazyPtr(in.GetInvertMatch())
+
+	switch m := in.MatchType.(type) {
+	case *pb.HttpRoute_HeaderMatch_ExactMatch:
+		out.ExactMatch = &m.ExactMatch
+	case *pb.HttpRoute_HeaderMatch_RegexMatch:
+		out.RegexMatch = &m.RegexMatch
+	case *pb.HttpRoute_HeaderMatch_PrefixMatch:
+		out.PrefixMatch = &m.PrefixMatch
+	case *pb.HttpRoute_HeaderMatch_PresentMatch:
+		out.PresentMatch = &m.PresentMatch
+	case *pb.HttpRoute_HeaderMatch_SuffixMatch:
+		out.SuffixMatch = &m.SuffixMatch
+	case *pb.HttpRoute_HeaderMatch_RangeMatch:
+		out.RangeMatch = HttprouteRangeMatch_FromProto(mapCtx, m.RangeMatch)
+	}
+	return out
+}
+
+func HttprouteHeaders_ToProto(mapCtx *direct.MapContext, in *krm.HttprouteHeaders) *pb.HttpRoute_HeaderMatch {
+	if in == nil {
+		return nil
+	}
+	out := &pb.HttpRoute_HeaderMatch{}
+	if in.ExactMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_ExactMatch{ExactMatch: *in.ExactMatch}
+	}
+	if in.RegexMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_RegexMatch{RegexMatch: *in.RegexMatch}
+	}
+	if in.PrefixMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_PrefixMatch{PrefixMatch: *in.PrefixMatch}
+	}
+	if in.PresentMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_PresentMatch{PresentMatch: *in.PresentMatch}
+	}
+	if in.SuffixMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_SuffixMatch{SuffixMatch: *in.SuffixMatch}
+	}
+	if in.RangeMatch != nil {
+		out.MatchType = &pb.HttpRoute_HeaderMatch_RangeMatch{RangeMatch: HttprouteRangeMatch_ToProto(mapCtx, in.RangeMatch)}
+	}
+	out.Header = direct.ValueOf(in.Header)
+	out.InvertMatch = direct.ValueOf(in.InvertMatch)
+	return out
+}