Merge branch 'main' into docs/authentication-filter-proposal-functional-tests

Author: shaun-nx

go.mod

@@ -21,7 +21,7 @@ require (
 	go.uber.org/zap v1.27.1
 	golang.org/x/text v0.32.0
 	google.golang.org/grpc v1.77.0
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/evanphx/json-patch.v4 v4.13.0
 	k8s.io/api v0.34.3
 	k8s.io/apiextensions-apiserver v0.34.3

go.sum

@@ -331,8 +331,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
 google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

internal/controller/nginx/config/maps.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	gotemplate "text/template"
 
@@ -185,14 +186,21 @@ func createAddHeadersMap(name string) shared.Map {
 
 // buildInferenceMaps creates maps for InferencePool Backends.
 func buildInferenceMaps(groups []dataplane.BackendGroup) []shared.Map {
-	inferenceMaps := make([]shared.Map, 0, len(groups))
+	uniqueMaps := make(map[string]shared.Map)
 
 	for _, group := range groups {
 		for _, backend := range group.Backends {
 			if backend.EndpointPickerConfig == nil || backend.EndpointPickerConfig.EndpointPickerRef == nil {
 				continue
 			}
 
+			backendVarName := strings.ReplaceAll(backend.UpstreamName, "-", "_")
+			mapKey := backendVarName // Use this as the key to detect duplicates
+
+			// Skip if we've already processed this upstream
+			if _, exists := uniqueMaps[mapKey]; exists {
+				continue
+			}
 			// Decide what the map must return when the picker didn’t set a value.
 			var defaultResult string
 			switch backend.EndpointPickerConfig.EndpointPickerRef.FailureMode {
@@ -230,14 +238,26 @@ func buildInferenceMaps(groups []dataplane.BackendGroup) []shared.Map {
 				Result: defaultResult,
 			})
 
-			backendVarName := strings.ReplaceAll(backend.UpstreamName, "-", "_")
-
-			inferenceMaps = append(inferenceMaps, shared.Map{
+			uniqueMaps[mapKey] = shared.Map{
 				Source:     `$inference_workload_endpoint`,
 				Variable:   fmt.Sprintf("$inference_backend_%s", backendVarName),
 				Parameters: params,
-			})
+			}
 		}
 	}
+
+	// Sort the map keys to ensure deterministic ordering
+	mapKeys := make([]string, 0, len(uniqueMaps))
+	for key := range uniqueMaps {
+		mapKeys = append(mapKeys, key)
+	}
+	sort.Strings(mapKeys)
+
+	// Build the result slice in sorted order
+	inferenceMaps := make([]shared.Map, 0, len(uniqueMaps))
+	for _, key := range mapKeys {
+		inferenceMaps = append(inferenceMaps, uniqueMaps[key])
+	}
+
 	return inferenceMaps
 }

internal/controller/nginx/config/maps_test.go

@@ -397,55 +397,183 @@ func TestCreateStreamMapsWithEmpty(t *testing.T) {
 
 func TestBuildInferenceMaps(t *testing.T) {
 	t.Parallel()
-	g := NewWithT(t)
 
-	group := dataplane.BackendGroup{
-		Backends: []dataplane.Backend{
-			{
-				UpstreamName: "upstream1",
-				EndpointPickerConfig: &dataplane.EndpointPickerConfig{
-					NsName: "default",
-					EndpointPickerRef: &inference.EndpointPickerRef{
-						FailureMode: inference.EndpointPickerFailClose,
+	tests := []struct {
+		expectedConfig map[string]struct {
+			failureMode   inference.EndpointPickerFailureMode
+			defaultResult string
+		}
+		name          string
+		backendGroups []dataplane.BackendGroup
+		expectedMaps  int
+	}{
+		{
+			name: "unique backends with different failure modes, result is ordered by upstream name",
+			backendGroups: []dataplane.BackendGroup{
+				{
+					Backends: []dataplane.Backend{
+						{
+							UpstreamName: "upstream2",
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailOpen,
+								},
+							},
+						},
+						{
+							UpstreamName: "upstream1",
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailClose,
+								},
+							},
+						},
+						{
+							UpstreamName:         "upstream3",
+							EndpointPickerConfig: nil,
+						},
 					},
 				},
 			},
-			{
-				UpstreamName: "upstream2",
-				EndpointPickerConfig: &dataplane.EndpointPickerConfig{
-					NsName: "default",
-					EndpointPickerRef: &inference.EndpointPickerRef{
-						FailureMode: inference.EndpointPickerFailOpen,
+			expectedMaps: 2,
+			expectedConfig: map[string]struct {
+				failureMode   inference.EndpointPickerFailureMode
+				defaultResult string
+			}{
+				"upstream1": {
+					failureMode:   inference.EndpointPickerFailClose,
+					defaultResult: "invalid-backend-ref",
+				},
+				"upstream2": {
+					failureMode:   inference.EndpointPickerFailOpen,
+					defaultResult: "upstream2",
+				},
+			},
+		},
+		{
+			name: "duplicate upstreams should be deduplicated",
+			backendGroups: []dataplane.BackendGroup{
+				{
+					Backends: []dataplane.Backend{
+						{
+							UpstreamName: "upstream1",
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailClose,
+								},
+							},
+						},
+						{
+							UpstreamName: "upstream1", // Duplicate
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailClose,
+								},
+							},
+						},
+					},
+				},
+				{
+					Backends: []dataplane.Backend{
+						{
+							UpstreamName: "upstream1", // Another duplicate
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailClose,
+								},
+							},
+						},
+						{
+							UpstreamName: "upstream2",
+							EndpointPickerConfig: &dataplane.EndpointPickerConfig{
+								NsName: "default",
+								EndpointPickerRef: &inference.EndpointPickerRef{
+									FailureMode: inference.EndpointPickerFailOpen,
+								},
+							},
+						},
 					},
 				},
 			},
-			{
-				UpstreamName:         "upstream3",
-				EndpointPickerConfig: nil,
+			expectedMaps: 2, // Only 2 unique upstreams
+			expectedConfig: map[string]struct {
+				failureMode   inference.EndpointPickerFailureMode
+				defaultResult string
+			}{
+				"upstream1": {
+					failureMode:   inference.EndpointPickerFailClose,
+					defaultResult: "invalid-backend-ref",
+				},
+				"upstream2": {
+					failureMode:   inference.EndpointPickerFailOpen,
+					defaultResult: "upstream2",
+				},
 			},
 		},
+		{
+			name: "no endpoint picker configs",
+			backendGroups: []dataplane.BackendGroup{
+				{
+					Backends: []dataplane.Backend{
+						{
+							UpstreamName:         "upstream1",
+							EndpointPickerConfig: nil,
+						},
+						{
+							UpstreamName:         "upstream2",
+							EndpointPickerConfig: nil,
+						},
+					},
+				},
+			},
+			expectedMaps: 0,
+		},
 	}
 
-	maps := buildInferenceMaps([]dataplane.BackendGroup{group})
-	g.Expect(maps).To(HaveLen(2))
-	g.Expect(maps[0].Source).To(Equal("$inference_workload_endpoint"))
-	g.Expect(maps[0].Variable).To(Equal("$inference_backend_upstream1"))
-	g.Expect(maps[0].Parameters).To(HaveLen(3))
-	g.Expect(maps[0].Parameters[0].Value).To(Equal("\"\""))
-	g.Expect(maps[0].Parameters[0].Result).To(Equal("upstream1"))
-	g.Expect(maps[0].Parameters[1].Value).To(Equal("~.+"))
-	g.Expect(maps[0].Parameters[1].Result).To(Equal("$inference_workload_endpoint"))
-	g.Expect(maps[0].Parameters[2].Value).To(Equal("default"))
-	g.Expect(maps[0].Parameters[2].Result).To(Equal("invalid-backend-ref"))
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			maps := buildInferenceMaps(tc.backendGroups)
+			g.Expect(maps).To(HaveLen(tc.expectedMaps))
 
-	// Check the second map
-	g.Expect(maps[1].Source).To(Equal("$inference_workload_endpoint"))
-	g.Expect(maps[1].Variable).To(Equal("$inference_backend_upstream2"))
-	g.Expect(maps[1].Parameters).To(HaveLen(3))
-	g.Expect(maps[1].Parameters[0].Value).To(Equal("\"\""))
-	g.Expect(maps[1].Parameters[0].Result).To(Equal("upstream2"))
-	g.Expect(maps[1].Parameters[1].Value).To(Equal("~.+"))
-	g.Expect(maps[1].Parameters[1].Result).To(Equal("$inference_workload_endpoint"))
-	g.Expect(maps[1].Parameters[2].Value).To(Equal("default"))
-	g.Expect(maps[1].Parameters[2].Result).To(Equal("upstream2"))
+			// Verify each map has the correct structure
+			seenUpstreams := make(map[string]bool)
+			for _, m := range maps {
+				g.Expect(m.Source).To(Equal("$inference_workload_endpoint"))
+				g.Expect(m.Parameters).To(HaveLen(3))
+
+				// Extract upstream name from variable name
+				varName := strings.TrimPrefix(m.Variable, "$inference_backend_")
+				upstreamName := strings.ReplaceAll(varName, "_", "-")
+
+				// Verify we haven't seen this upstream before (no duplicates)
+				g.Expect(seenUpstreams[upstreamName]).To(BeFalse(), "Duplicate upstream found: %s", upstreamName)
+				seenUpstreams[upstreamName] = true
+
+				// Verify parameter structure
+				g.Expect(m.Parameters[0].Value).To(Equal("\"\""))
+				g.Expect(m.Parameters[0].Result).To(Equal(upstreamName))
+				g.Expect(m.Parameters[1].Value).To(Equal("~.+"))
+				g.Expect(m.Parameters[1].Result).To(Equal("$inference_workload_endpoint"))
+				g.Expect(m.Parameters[2].Value).To(Equal("default"))
+
+				// Verify the default result matches expected failure mode
+				if expectedConfig, exists := tc.expectedConfig[upstreamName]; exists {
+					g.Expect(m.Parameters[2].Result).To(Equal(expectedConfig.defaultResult))
+				}
+			}
+
+			// Verify all expected upstreams are present
+			for expectedUpstream := range tc.expectedConfig {
+				g.Expect(seenUpstreams[expectedUpstream]).To(BeTrue(), "Expected upstream not found: %s", expectedUpstream)
+			}
+		})
+	}
 }