apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: wildcard-tls-gateway
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: foo-https
    protocol: HTTPS
    port: 443
    hostname: foo.example.com
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: foo-example-com-cert
  - name: wildcard-https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"

Ben Leggett <******@****.***> 1710179183 -0400

Ben Leggett <******@****.***> 1710179183 -0400

Kuat <******@****.***> 1697560546 -0700

Kuat <******@****.***> 1711363165 -0700

issue:
  - 45415

releaseNotes:
  - |
    **Fixed** a bug where overlapping wildcard hosts in a VirtualService would produce incorrect routing configuration when wildcard services were selected (e.g. in ServiceEntries).

upgradeNotes:
  - title: Overlapping Wildcard Conflicts
    content: |
      This fix changes the behavior of overlapping wildcard hosts in VirtualService. Previously, the oldest VirtualService would take precedence

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: attaches-to-wildcard-example-com-with-hostname-intersection
  namespace: gateway-conformance-infra
spec:
  parentRefs:
    - name: isolation
      namespace: gateway-conformance-infra
      sectionName: wildcard-example-com
  hostnames:
    - "bar.com" # doesn't match wildcard-example-com listener
    - "*.example.com"

	// those with a multi wildcard.
	// We skip this step if the segment is a trailing slash, because single wildcards
	// don't match trailing slashes.
	if seg != "/" {
		if n, m := n.emptyChild.matchPath(rest, append(matches, seg)); n != nil {
			return n, m
		}
	}
	// Lastly, match the pattern (there can be at most one) that has a multi

		return mostSpecificHostWildcardMatch(string(needle[1:]), wildcard)
	}

	// exact match first
	if v, ok := specific[needle]; ok {
		return needle, v, true
	}

	// check wildcard
	return mostSpecificHostWildcardMatch(string(needle), wildcard)
}

func mostSpecificHostWildcardMatch[V any](needle string, wildcard map[host.Name]V) (host.Name, V, bool) {
	found := false
	var matchHost host.Name
	var matchValue V

		{"/{w}x", "at offset 1: bad wildcard segment"},
		{"/x{w}", "at offset 1: bad wildcard segment"},
		{"/{wx", "at offset 1: bad wildcard segment"},
		{"/a/{/}/c", "at offset 3: bad wildcard segment"},
		{"/a/{%61}/c", "at offset 3: bad wildcard name"}, // wildcard names aren't unescaped
		{"/{a$}", "at offset 1: bad wildcard name"},
		{"/{}", "at offset 1: empty wildcard"},