ir: Fix Service updates not propagating through translation

This change fixes an issue where patching Kubernetes Services (e.g.
changing appProtocol or ports) did not dynamically propagate to
the xDS config, and required restarting the kgw container.

The root cause was HttpRouteIR.rulesEqual() not comparing
BackendObject fields when checking backend equality. It was only
comparing ClusterName and Weight, missing changes to the underlying
Service configuration like appProtocol.

Implements an Equals() method for the HttpBackendOrDelegate type to
fix this edge case and cleanup the overall implementation to be
consistent with the rest of the codebase and avoid harcoding the
conditional checks related to Equals-based collection checking.

Fixes #12576.

Signed-off-by: timflannagan <[email protected]>

Author: timflannagan

internal/kgateway/extensions2/plugins/backendtlspolicy/plugin.go

@@ -70,7 +70,7 @@ func (d *backendTlsPolicy) Equals(in any) bool {
 }
 
 func registerTypes() {
-	kubeclient.Register[*gwv1.BackendTLSPolicy](
+	kubeclient.Register(
 		backendTlsPolicyGvr,
 		backendTlsPolicyGroupKind,
 		func(c kubeclient.ClientGetter, namespace string, o metav1.ListOptions) (runtime.Object, error) {

internal/kgateway/extensions2/plugins/inferenceextension/endpointpicker/backends.go

@@ -36,7 +36,7 @@ func processPoolBackendObjIR(
 	// If the pool has errors, create an empty LoadAssignment to return a 503
 	if irPool.hasErrors() {
 		logger.Debug("skipping endpoints due to InferencePool errors",
-			"pool", in.ResourceName(),
+			"pool", in.ResourceName,
 			"errors", irPool.errors,
 		)
 		out.LoadAssignment = &envoyendpointv3.ClusterLoadAssignment{

internal/kgateway/extensions2/plugins/inferenceextension/endpointpicker/collections.go

@@ -142,7 +142,7 @@ func initInferencePoolCollections(
 
 	// Index pools by NamespacedName for status management & policy wiring
 	poolIdx := krtpkg.UnnamedIndex(backendsCtl, func(be ir.BackendObjectIR) []string {
-		return []string{be.ResourceName()}
+		return []string{be.ResourceName}
 	})
 
 	// Build a PolicyWrapper collection for the per-route metadata filter

internal/kgateway/krtcollections/policy.go

@@ -273,7 +273,7 @@ func (i *BackendIndex) getBackendFromAlias(kctx krt.HandlerContext, gk schema.Gr
 		} else if res.Obj.GetCreationTimestamp().Time.Before(out.Obj.GetCreationTimestamp().Time) {
 			out = &res // newer
 		} else if res.Obj.GetCreationTimestamp().Time.Equal(out.Obj.GetCreationTimestamp().Time) &&
-			res.ResourceName() < out.ResourceName() {
+			res.ResourceName < out.ResourceName {
 			out = &res // use name for tiebreaker
 		}
 	}

pkg/pluginsdk/ir/backend.go

@@ -136,8 +136,8 @@ type BackendObjectIR struct {
 	// Not added to Equals() as it is derived from the inner ObjIr, which is already evaluated
 	Errors []error
 
-	// Name is the pre-calculated resource name. used as the krt resource name.
-	resourceName string
+	// ResourceName is the pre-calculated resource name. used as the krt resource name.
+	ResourceName string
 
 	// TrafficDistribution is the desired traffic distribution for the backend.
 	// Default is any (no priority).
@@ -153,14 +153,10 @@ func NewBackendObjectIR(objSource ObjectSource, port int32, extraKey string) Bac
 		ObjectSource: objSource,
 		Port:         port,
 		ExtraKey:     extraKey,
-		resourceName: BackendResourceName(objSource, port, extraKey),
+		ResourceName: BackendResourceName(objSource, port, extraKey),
 	}
 }
 
-func (c BackendObjectIR) ResourceName() string {
-	return c.resourceName
-}
-
 func BackendResourceName(objSource ObjectSource, port int32, extraKey string) string {
 	var sb strings.Builder
 	sb.WriteString(objSource.ResourceName())
@@ -177,7 +173,7 @@ func (c BackendObjectIR) Equals(in BackendObjectIR) bool {
 	objEq := c.ObjectSource.Equals(in.ObjectSource)
 	objVersionEq := versionEquals(c.Obj, in.Obj)
 	polEq := c.AttachedPolicies.Equals(in.AttachedPolicies)
-	nameEq := c.resourceName == in.resourceName
+	nameEq := c.ResourceName == in.ResourceName
 	disableIstioAutoMTLSEq := c.DisableIstioAutoMTLS == in.DisableIstioAutoMTLS
 
 	// objIr may currently be nil in the case of k8s Services
@@ -188,7 +184,7 @@ func (c BackendObjectIR) Equals(in BackendObjectIR) bool {
 		objIrEq = c.ObjIr.Equals(in.ObjIr)
 	}
 
-	return objEq && objVersionEq && objIrEq && polEq && nameEq && disableIstioAutoMTLSEq
+	return objEq && objVersionEq && objIrEq && polEq && nameEq && disableIstioAutoMTLSEq && c.AppProtocol == in.AppProtocol
 }
 
 func (c BackendObjectIR) ClusterName() string {

pkg/pluginsdk/ir/gw.go

@@ -265,12 +265,6 @@ type BackendRefIR struct {
 	Err error
 }
 
-type HttpBackendOrDelegate struct {
-	Backend          *BackendRefIR
-	Delegate         *ObjectSource
-	AttachedPolicies AttachedPolicies
-}
-
 type HttpRouteRuleIR struct {
 	ExtensionRefs    AttachedPolicies
 	AttachedPolicies AttachedPolicies
@@ -282,3 +276,28 @@ type HttpRouteRuleIR struct {
 	// that should be propagated through to translation to any derived ir.HttpRouteRuleMatchIRs
 	Err error
 }
+
+type HttpBackendOrDelegate struct {
+	Backend          *BackendRefIR
+	Delegate         *ObjectSource
+	AttachedPolicies AttachedPolicies
+}
+
+func (h HttpBackendOrDelegate) Equals(other HttpBackendOrDelegate) bool {
+	if !h.AttachedPolicies.Equals(other.AttachedPolicies) {
+		return false
+	}
+	if h.Backend != nil && other.Backend != nil {
+		return h.Backend.Equals(*other.Backend)
+	}
+	if h.Backend == nil && other.Backend == nil {
+		if h.Delegate == nil && other.Delegate == nil {
+			return true
+		}
+		if h.Delegate != nil && other.Delegate != nil {
+			return h.Delegate.Equals(*other.Delegate)
+		}
+		return false
+	}
+	return false
+}

pkg/pluginsdk/ir/model.go

@@ -139,7 +139,7 @@ func NewEndpointsForBackend(us BackendObjectIR) *EndpointsForBackend {
 		BackendLabels:        labels,
 		LbEps:                make(map[PodLocality][]EndpointWithMd),
 		ClusterName:          us.ClusterName(),
-		UpstreamResourceName: us.ResourceName(),
+		UpstreamResourceName: us.ResourceName,
 		Port:                 uint32(us.Port), //nolint:gosec // G115: upstream port is always valid port range
 		Hostname:             us.CanonicalHostname,
 		LbEpsEqualityHash:    upstreamHash,

pkg/pluginsdk/ir/routes.go

@@ -19,6 +19,8 @@ type Route interface {
 	GetSourceObject() metav1.Object
 }
 
+var _ Route = &HttpRouteIR{}
+
 // this is 1:1 with httproute, and is a krt type
 // maybe move this to krtcollections package?
 type HttpRouteIR struct {
@@ -51,7 +53,6 @@ func (c HttpRouteIR) ResourceName() string {
 	return c.ObjectSource.ResourceName()
 }
 
-// get hostnames
 func (c *HttpRouteIR) GetHostnames() []string {
 	if c == nil {
 		return nil
@@ -96,21 +97,7 @@ func (c HttpRouteIR) rulesEqual(in HttpRouteIR) bool {
 			return false
 		}
 		for j, backend := range backendsa {
-			otherbackend := backendsb[j]
-			if backend.Backend == nil && otherbackend.Backend == nil {
-				continue
-			}
-			if backend.Backend != nil && otherbackend.Backend != nil {
-				if backend.Backend.ClusterName != otherbackend.Backend.ClusterName {
-					return false
-				}
-				if backend.Backend.Weight != otherbackend.Backend.Weight {
-					return false
-				}
-				if !backend.AttachedPolicies.Equals(otherbackend.AttachedPolicies) {
-					return false
-				}
-			} else {
+			if !backend.Equals(backendsb[j]) {
 				return false
 			}
 		}

pkg/pluginsdk/ir/routes_test.go

@@ -235,6 +235,18 @@ func TestHTTPRouteIREquals(t *testing.T) {
 		}
 	}
 
+	// Helper to create backend with specific BackendObject (for testing AppProtocol)
+	makeHttpBackendWithBackendObject := func(cluster string, weight uint32, backendObj *BackendObjectIR) HttpBackendOrDelegate {
+		return HttpBackendOrDelegate{
+			Backend: &BackendRefIR{
+				ClusterName:   cluster,
+				Weight:        weight,
+				BackendObject: backendObj,
+			},
+			AttachedPolicies: AttachedPolicies{},
+		}
+	}
+
 	// Test data
 	base := makeHTTPRoute("route1", "test-ns", "1", 1, types.UID("uid1"))
 	differentName := makeHTTPRoute("route2", "test-ns", "1", 1, types.UID("uid1"))
@@ -293,6 +305,36 @@ func TestHTTPRouteIREquals(t *testing.T) {
 		Name:             "ruleA",
 	}}
 
+	// Test data for testing backing destination object comparison
+	httpBackendObj := BackendObjectIR{
+		ObjectSource:     ObjectSource{Group: "", Kind: "Service", Namespace: "ns", Name: "svc"},
+		Port:             80,
+		Obj:              base,
+		ResourceName:     "/Service/ns/svc:80",
+		AppProtocol:      DefaultAppProtocol,
+		AttachedPolicies: AttachedPolicies{},
+	}
+	wsBackendObj := BackendObjectIR{
+		ObjectSource:     ObjectSource{Group: "", Kind: "Service", Namespace: "ns", Name: "svc"},
+		Port:             80,
+		Obj:              base,
+		ResourceName:     "/Service/ns/svc:80",
+		AppProtocol:      WebSocketAppProtocol,
+		AttachedPolicies: AttachedPolicies{},
+	}
+	ruleWithHttpBackend := []HttpRouteRuleIR{{
+		ExtensionRefs:    emptyPolicies,
+		AttachedPolicies: emptyPolicies,
+		Backends:         []HttpBackendOrDelegate{makeHttpBackendWithBackendObject("clusterA", 5, &httpBackendObj)},
+		Name:             "ruleA",
+	}}
+	ruleWithWsBackend := []HttpRouteRuleIR{{
+		ExtensionRefs:    emptyPolicies,
+		AttachedPolicies: emptyPolicies,
+		Backends:         []HttpBackendOrDelegate{makeHttpBackendWithBackendObject("clusterA", 5, &wsBackendObj)},
+		Name:             "ruleA",
+	}}
+
 	tests := []struct {
 		name string
 		a, b HttpRouteIR
@@ -678,6 +720,26 @@ func TestHTTPRouteIREquals(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "diff_rules_backend_object_app_protocol",
+			a: HttpRouteIR{
+				ObjectSource:                   ObjectSource{Namespace: "test-ns", Name: "route1"},
+				SourceObject:                   base,
+				AttachedPolicies:               emptyPolicies,
+				Rules:                          ruleWithHttpBackend,
+				PrecedenceWeight:               0,
+				DelegationInheritParentMatcher: false,
+			},
+			b: HttpRouteIR{
+				ObjectSource:                   ObjectSource{Namespace: "test-ns", Name: "route1"},
+				SourceObject:                   base,
+				AttachedPolicies:               emptyPolicies,
+				Rules:                          ruleWithWsBackend,
+				PrecedenceWeight:               0,
+				DelegationInheritParentMatcher: false,
+			},
+			want: false,
+		},
 	}
 
 	for _, tt := range tests {