apiVersion: release-notes/v2
kind: bug-fix
area: networking
issues:
- 25350
releaseNotes:
- |

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: wildcard-tls-gateway
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: foo-https
    protocol: HTTPS
    port: 443
    hostname: foo.example.com
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: foo-example-com-cert
  - name: wildcard-https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"

Ben Leggett <******@****.***> 1710179183 -0400

Ben Leggett <******@****.***> 1710179183 -0400

Kuat <******@****.***> 1697560546 -0700

Yangmin Zhu <******@****.***> 1617305101 -0700

Kuat <******@****.***> 1711363165 -0700

	if hWildcard {
		if oWildcard {
			// both n and o are wildcards
			if len(n) < len(o) {
				return false
			}
			return strings.HasSuffix(string(n[1:]), string(o[1:]))
		}
		// only n is wildcard
		return false
	}

	if oWildcard {
		// only o is wildcard
		return strings.HasSuffix(string(n), string(o[1:]))
	}

	// both are non-wildcards, so do normal string comparison
	return n == o
}

issue:
  - 45415

releaseNotes:
  - |
    **Fixed** a bug where overlapping wildcard hosts in a VirtualService would produce incorrect routing configuration when wildcard services were selected (e.g. in ServiceEntries).

upgradeNotes:
  - title: Overlapping Wildcard Conflicts
    content: |
      This fix changes the behavior of overlapping wildcard hosts in VirtualService. Previously, the oldest VirtualService would take precedence

		{"wildcard matches anything", "*", "*", true},
		{"wildcard matches anything", "", "*", true},

		{"wildcarded domain matches wildcarded subdomain", "*.foo.com", "*.com", true},
		{"wildcarded sub-domain does not match domain", "*.foo.com", "foo.com", false},

		{"long wildcard does not match short host", "*.foo.bar.baz", "baz", false},
		{"long name matches short wildcard", "foo.bar.baz", "*.baz", true},
	}