@opensoha/contracts 0.1.27 → 0.1.29

package/resource/runtime/network_topology_builder_backends.go

@@ -0,0 +1,195 @@
+package runtime
+
+import (
+	"fmt"
+	cr "github.com/opensoha/soha-contracts/resource"
+	"k8s.io/apimachinery/pkg/labels"
+	"strings"
+)
+
+func (g *topologyGraph) backend(parent, namespace, name, port, protocol string) string {
+	service, ok := g.objects[topologyKey("Service", namespace, name)]
+	if !ok {
+		return g.unknown(parent, "Service", namespace, name, "")
+	}
+	id := g.service(service, port)
+	if port != "" && !servicePortExists(service, port, protocol) {
+		g.properties(id, cr.NetworkTopologyProperty{Name: "Unresolved service port", Value: port})
+	}
+	return id
+}
+func servicePortExists(service topologyObject, port, protocol string) bool {
+	for _, value := range items(at(service.body, "spec", "ports")) {
+		if text(value["name"]) == port || text(value["port"]) == port {
+			expected := "TCP"
+			if protocol == "UDP" {
+				expected = "UDP"
+			}
+			return protocol == "" || firstTopology(text(value["protocol"]), "TCP") == expected
+		}
+	}
+	return false
+}
+
+func (g *topologyGraph) service(service topologyObject, port string) string {
+	id := g.objectNode(service, "service", "kubernetes", "")
+	if g.expanded[id+":"+port] {
+		return id
+	}
+	g.expanded[id+":"+port] = true
+	if text(at(service.body, "spec", "type")) == "ExternalName" {
+		target := g.addNode(cr.NetworkTopologyGraphNode{ID: id + "/external", Type: "external", Label: text(at(service.body, "spec", "externalName")), Provider: "kubernetes", ResolutionState: "external"})
+		g.link(id, target, "resolves", "", port)
+		return id
+	}
+	if port != "" && !servicePortExists(service, port, "") {
+		return id
+	}
+	slices := []topologyObject{}
+	for _, object := range g.ordered {
+		if g.ctx.Err() != nil {
+			break
+		}
+		if object.ref.Kind == "EndpointSlice" && object.ref.Namespace == service.ref.Namespace && text(at(object.body, "metadata", "labels", "kubernetes.io/service-name")) == service.ref.Name {
+			slices = append(slices, object)
+		}
+	}
+	ready := 0
+	for _, slice := range slices {
+		ready += g.endpointSlice(service, slice, id, port)
+	}
+	if g.completeSource("kubernetes.endpointslices", service.ref.Namespace) && ready == 0 {
+		g.state(id, "no_ready_endpoints")
+	} else if ready > 0 {
+		g.state(id, "resolved")
+	}
+	g.serviceSelector(service, id)
+	if len(slices) == 0 && !g.completeSource("kubernetes.endpointslices", service.ref.Namespace) {
+		g.state(id, "unknown")
+	}
+	return id
+}
+
+func (g *topologyGraph) endpointSlice(service, slice topologyObject, serviceID, port string) int {
+	ready := 0
+	if !endpointPortMatches(service, slice, port) {
+		return 0
+	}
+	groupID := g.objectNode(slice, "endpoint-group", "kubernetes", "")
+	edge := g.link(serviceID, groupID, "resolves", "", port)
+	edge.SourceRef = &slice.ref
+	edge.FieldPath = "metadata.labels[kubernetes.io/service-name]"
+	edge.Note = "Explicit service-name protocol label"
+	g.expanded["slice:"+slice.id()] = true
+	for index, endpoint := range items(slice.body["endpoints"]) {
+		conditions := object(endpoint["conditions"])
+		eligible := conditions["ready"] != false
+		if eligible {
+			ready++
+		}
+		podRef := object(endpoint["targetRef"])
+		state := "resolved"
+		if !eligible {
+			state = "no_ready_endpoints"
+		}
+		if text(podRef["kind"]) == "Pod" && (text(podRef["apiVersion"]) == "" || text(podRef["apiVersion"]) == "v1") {
+			g.endpointPod(slice, groupID, podRef, state, index)
+			continue
+		}
+		target := g.addNode(cr.NetworkTopologyGraphNode{ID: fmt.Sprintf("%s/endpoint/%d", slice.id(), index), Type: "external", Label: strings.Join(texts(endpoint["addresses"]), ", "), Provider: "kubernetes", ResolutionState: "external"})
+		edge := g.link(groupID, target, "resolves", "", port)
+		edge.ResolutionState = state
+		edge.Note = fmt.Sprintf("ready=%v, serving=%v, terminating=%v", eligible, conditions["serving"] != false, conditions["terminating"] == true)
+	}
+	if ready == 0 {
+		g.state(groupID, "no_ready_endpoints")
+	}
+	return ready
+}
+func endpointPortMatches(service, slice topologyObject, port string) bool {
+	if port == "" {
+		return true
+	}
+	name := ""
+	protocol := "TCP"
+	for _, servicePort := range items(at(service.body, "spec", "ports")) {
+		if text(servicePort["name"]) == port || text(servicePort["port"]) == port {
+			name = text(servicePort["name"])
+			protocol = firstTopology(text(servicePort["protocol"]), "TCP")
+		}
+	}
+	for _, endpointPort := range items(slice.body["ports"]) {
+		if text(endpointPort["name"]) == name && firstTopology(text(endpointPort["protocol"]), "TCP") == protocol && endpointPort["port"] != nil {
+			return true
+		}
+	}
+	return false
+}
+func (g *topologyGraph) endpointPod(slice topologyObject, group string, ref map[string]any, state string, index int) {
+	namespace := firstTopology(text(ref["namespace"]), slice.ref.Namespace)
+	pod, ok := g.objects[topologyKey("Pod", namespace, text(ref["name"]))]
+	if !ok {
+		g.unresolvedEndpoint(slice, group, ref, namespace, index, g.referenceState("Pod", namespace))
+		return
+	}
+	if uid := text(ref["uid"]); uid == "" || uid != pod.ref.UID {
+		g.unresolvedEndpoint(slice, group, ref, namespace, index, "unresolved")
+		return
+	}
+	id := g.objectNode(pod, "pod", "kubernetes", "")
+	ports := items(slice.body["ports"])
+	if len(ports) == 0 {
+		ports = []map[string]any{{}}
+	}
+	for _, port := range ports {
+		edge := g.link(group, id, "resolves", firstTopology(text(port["protocol"]), "TCP"), text(port["port"]))
+		edge.ResolutionState = state
+		edge.SectionName = text(port["name"])
+		edge.FieldPath = fmt.Sprintf("endpoints[%d].targetRef", index)
+		edge.Note = "EndpointSlice targetRef with matching UID; readiness belongs to this endpoint"
+	}
+}
+func (g *topologyGraph) serviceSelector(service topologyObject, id string) {
+	selector := servicePodSelector(object(at(service.body, "spec", "selector")))
+	if selector == nil {
+		return
+	}
+	for _, pod := range g.ordered {
+		if g.ctx.Err() != nil || g.budgetReached() {
+			return
+		}
+		if pod.ref.Kind != "Pod" || pod.ref.Namespace != service.ref.Namespace {
+			continue
+		}
+		podLabels := labels.Set{}
+		for key, value := range object(at(pod.body, "metadata", "labels")) {
+			if label, ok := value.(string); ok {
+				podLabels[key] = label
+			}
+		}
+		if selector.Matches(podLabels) {
+			target := g.objectNode(pod, "pod", "kubernetes", "")
+			edge := g.link(id, target, "selects", "", "")
+			edge.ResolutionState = "resolved"
+			edge.Note = "Selector match only; does not establish endpoint readiness or traffic"
+			edge.FieldPath = "spec.selector"
+		}
+	}
+}
+
+func (g *topologyGraph) unresolvedEndpoint(slice topologyObject, group string, ref map[string]any, namespace string, index int, state string) {
+	target := g.unknown(fmt.Sprintf("%s/%d", group, index), "Pod", namespace, text(ref["name"]), state)
+	if hidden, ok := g.hiddenRefs[target]; ok {
+		hidden.UID = text(ref["uid"])
+		g.hiddenRefs[target] = hidden
+	}
+	if n, ok := g.nodes[target]; ok && n.Resource != nil {
+		n.Resource.UID = text(ref["uid"])
+		g.nodes[target] = n
+	}
+	edge := g.link(group, target, "resolves", "", "")
+	edge.ResolutionState = state
+	edge.SourceRef = &slice.ref
+	edge.FieldPath = fmt.Sprintf("endpoints[%d].targetRef", index)
+	edge.Note = "Declared targetRef not confirmed by matching Pod UID"
+}

package/resource/runtime/network_topology_builder_gateway_l4_test.go

@@ -0,0 +1,86 @@
+package runtime
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestGatewayL4TopologyKeepsListenerPortsWeightsAndTLSMatches(t *testing.T) {
+	for _, protocol := range []string{"TCP", "TLS", "UDP"} {
+		t.Run(protocol, func(t *testing.T) {
+			kind := protocol + "Route"
+			source := "gateway." + strings.ToLower(protocol) + "routes"
+			tls := ""
+			if protocol == "TLS" {
+				tls = `,"tls":{"mode":"Passthrough"},"hostname":"*.example.test"`
+			}
+			view := fixtureView(
+				topologyFixture("gateway.gateways", "team", "gw", fmt.Sprintf(`{"spec":{"listeners":[{"name":"l4","port":9000,"protocol":%q%s},{"name":"other","port":80,"protocol":"HTTP"}]}}`, protocol, tls)),
+				topologyFixture(source, "team", "route", `{"spec":{"hostnames":["app.example.test"],"parentRefs":[{"name":"gw"}],"rules":[{"backendRefs":[{"name":"web","port":9000,"weight":0},{"name":"web","port":9000,"weight":3}]}]}}`),
+				topologyFixture("kubernetes.services", "team", "web", fmt.Sprintf(`{"spec":{"ports":[{"port":9000,"protocol":%q}]}}`, map[bool]string{true: "UDP", false: "TCP"}[protocol == "UDP"])),
+			)
+			parent, zero, total, ruleFound := false, false, false, false
+			for _, node := range view.Nodes {
+				if node.Resource != nil && node.Resource.Kind == kind && node.Rule != nil {
+					ruleFound = node.Protocol == protocol
+					if protocol == "TLS" && (node.Rule.TLSMode != "Passthrough" || len(node.Rule.MatchGroups) != 1 || node.Rule.MatchGroups[0][0].Value != "app.example.test") {
+						t.Fatalf("TLS evidence lost: %+v", node.Rule)
+					}
+				}
+			}
+			for _, edge := range view.Edges {
+				if edge.Relation == "matches" && edge.Port == "9000" && edge.Protocol == protocol && edge.ResolutionState == "resolved" {
+					parent = true
+				}
+				if edge.Relation == "weights" && edge.Protocol == protocol && edge.Port == "9000" {
+					zero = zero || edge.Weight != nil && *edge.Weight == 0
+					total = total || edge.TotalWeight != nil && *edge.TotalWeight == 3
+				}
+			}
+			if !parent || !zero || !total || !ruleFound {
+				t.Fatalf("lost L4 evidence: %+v", view)
+			}
+		})
+	}
+}
+
+func TestGatewayL4TopologyRejectsWrongListenerSNIAndServiceProtocol(t *testing.T) {
+	for _, test := range []struct{ name, kind, listener, backendProtocol string }{
+		{"tcp-vs-udp", "TCP", `{"name":"entry","protocol":"UDP","port":9000}`, "TCP"},
+		{"tls-termination", "TLS", `{"name":"entry","protocol":"TLS","port":9000,"tls":{"mode":"Terminate"}}`, "TCP"},
+		{"wrong-sni", "TLS", `{"name":"entry","protocol":"TLS","port":9000,"hostname":"other.test","tls":{"mode":"Passthrough"}}`, "TCP"},
+		{"wrong-service-protocol", "UDP", `{"name":"entry","protocol":"UDP","port":9000}`, "TCP"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			view := fixtureView(topologyFixture("gateway.gateways", "team", "gw", `{"spec":{"listeners":[`+test.listener+`]}}`), topologyFixture("gateway."+strings.ToLower(test.kind)+"routes", "team", "route", `{"spec":{"hostnames":["app.test"],"parentRefs":[{"name":"gw","sectionName":"entry"}],"rules":[{"backendRefs":[{"name":"web","port":9000}]}]}}`), topologyFixture("kubernetes.services", "team", "web", fmt.Sprintf(`{"spec":{"ports":[{"port":9000,"protocol":%q}]}}`, test.backendProtocol)))
+			found := false
+			for _, edge := range view.Edges {
+				if test.name == "wrong-service-protocol" {
+					found = found || edge.Relation == "weights" && edge.ResolutionState == "unresolved"
+				} else {
+					found = found || edge.Relation == "matches" && edge.Port == "" && edge.ResolutionState != "resolved"
+				}
+			}
+			if !found {
+				t.Fatalf("invalid L4 relationship accepted: %+v", view.Edges)
+			}
+		})
+	}
+}
+
+func TestGatewayL4CrossNamespaceBackendRequiresMatchingReferenceGrant(t *testing.T) {
+	route := topologyFixture("gateway.tcproutes", "team", "route", `{"spec":{"rules":[{"backendRefs":[{"name":"private-backend","namespace":"other","port":9000}]}]}}`)
+	service := topologyFixture("kubernetes.services", "other", "private-backend", `{"spec":{"ports":[{"port":9000}]}}`)
+	for _, kind := range []string{"HTTPRoute", "TCPRoute"} {
+		grant := topologyFixture("gateway.referencegrants", "other", "grant", fmt.Sprintf(`{"spec":{"from":[{"group":"gateway.networking.k8s.io","kind":%q,"namespace":"team"}],"to":[{"group":"","kind":"Service","name":"private-backend"}]}}`, kind))
+		view := fixtureView(route, service, grant)
+		linked := false
+		for _, edge := range view.Edges {
+			linked = linked || edge.Relation == "weights" && strings.Contains(edge.Target, "|Service|other|private-backend|")
+		}
+		if linked != (kind == "TCPRoute") {
+			t.Fatalf("ReferenceGrant kind boundary lost for %s: %+v", kind, view.Edges)
+		}
+	}
+}

package/resource/runtime/network_topology_builder_ingress.go

@@ -0,0 +1,302 @@
+package runtime
+
+import (
+	"fmt"
+	cr "github.com/opensoha/soha-contracts/resource"
+	"strings"
+)
+
+func (g *topologyGraph) ingress(o topologyObject) {
+	provider := g.classProvider("IngressClass", text(at(o.body, "spec", "ingressClassName")), "kubernetes")
+	entry := g.objectNode(o, "entry", provider, "HTTP")
+	if len(items(at(o.body, "spec", "tls"))) > 0 {
+		g.properties(entry, cr.NetworkTopologyProperty{Name: "TLS", Value: "Configured; certificate and controller execution unverified"})
+	}
+	index := 0
+	active := func() bool { return g.ctx.Err() == nil && !g.budgetReached() }
+	forEachIngressBackendDeclaration(o.body, active, func(ref ingressBackendDeclaration) {
+		matches := [][]cr.NetworkTopologyMatch{{{Type: "host", Value: ref.host}, {Type: "path", Operator: text(ref.path["pathType"]), Value: text(ref.path["path"])}}}
+		rule := g.rule(o, provider, "HTTP", index, "", matches)
+		index++
+		g.link(entry, rule, "matches", "HTTP", "")
+		if !ref.serviceDeclared {
+			g.state(rule, "unsupported_fragment")
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Backend", Value: "Custom resource backend requires its provider resolver"})
+			return
+		}
+		target := g.backend(rule, o.ref.Namespace, ref.serviceName, ref.port, "HTTP")
+		edge := g.link(rule, target, "forwards", "HTTP", ref.port)
+		edge.FieldPath = ref.fieldPath
+		edge.SourceRef = &o.ref
+	})
+	for _, tls := range items(at(o.body, "spec", "tls")) {
+		g.properties(entry, cr.NetworkTopologyProperty{Name: "TLS hosts", Value: strings.Join(texts(tls["hosts"]), ", ")})
+	}
+}
+
+func (g *topologyGraph) classProvider(kind, name, fallback string) string {
+	class, ok := g.objects[topologyKey(kind, "", name)]
+	if !ok {
+		return fallback
+	}
+	controller := text(at(class.body, "spec", "controller"))
+	if kind == "GatewayClass" {
+		controller = text(at(class.body, "spec", "controllerName"))
+	}
+	switch controller {
+	case "traefik.io/ingress-controller", "traefik.io/gateway-controller":
+		return "traefik"
+	case "apisix.apache.org/ingress-controller", "apisix.apache.org/apisix-ingress-controller":
+		return "apisix"
+	}
+	return fallback
+}
+
+func (g *topologyGraph) gatewayRoute(o topologyObject) {
+	protocol := gatewayRouteProtocol(o.ref.Kind)
+	entry := g.objectNode(o, "entry", "gateway", protocol)
+	g.properties(entry, cr.NetworkTopologyProperty{Name: "Hostnames", Value: strings.Join(texts(at(o.body, "spec", "hostnames")), ", ")})
+	for _, parent := range items(at(o.body, "spec", "parentRefs")) {
+		g.gatewayParent(o, entry, parent, protocol)
+	}
+	for index, raw := range items(at(o.body, "spec", "rules")) {
+		groups := gatewayMatchGroups(raw)
+		if o.ref.Kind == "TLSRoute" {
+			for _, host := range texts(at(o.body, "spec", "hostnames")) {
+				groups = append(groups, []cr.NetworkTopologyMatch{{Type: "sni", Value: host}})
+			}
+		}
+		rule := g.rule(o, "gateway", protocol, index, text(raw["name"]), groups)
+		if o.ref.Kind == "TLSRoute" && rule != "" {
+			node := g.nodes[rule]
+			node.Rule.TLSMode = "Passthrough"
+			g.nodes[rule] = node
+		}
+		g.link(entry, rule, "matches", protocol, "")
+		total := int64(0)
+		for _, backend := range items(raw["backendRefs"]) {
+			total += integer(backend["weight"], 1)
+		}
+		for backendIndex, backend := range items(raw["backendRefs"]) {
+			edge := g.gatewayBackend(o, rule, backend, "weights", protocol)
+			edge.FieldPath = fmt.Sprintf("spec.rules[%d].backendRefs[%d]", index, backendIndex)
+			edge.SourceRef = &o.ref
+			if total >= 0 {
+				edge.TotalWeight = &total
+			}
+		}
+		for filterIndex, filter := range items(raw["filters"]) {
+			g.gatewayFilter(o, rule, filter, protocol, fmt.Sprintf("spec.rules[%d].filters[%d]", index, filterIndex))
+		}
+	}
+	g.gatewayConditions(o, entry)
+}
+
+func gatewayRouteProtocol(kind string) string {
+	switch kind {
+	case "GRPCRoute":
+		return "GRPC"
+	case "TCPRoute":
+		return "TCP"
+	case "TLSRoute":
+		return "TLS"
+	case "UDPRoute":
+		return "UDP"
+	default:
+		return "HTTP"
+	}
+}
+
+func gatewayMatchGroups(rule map[string]any) [][]cr.NetworkTopologyMatch {
+	result := [][]cr.NetworkTopologyMatch{}
+	for _, match := range items(rule["matches"]) {
+		group := []cr.NetworkTopologyMatch{}
+		if path := object(match["path"]); len(path) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: "path", Operator: text(path["type"]), Value: text(path["value"])})
+		}
+		if method, ok := match["method"].(string); ok {
+			group = append(group, cr.NetworkTopologyMatch{Type: "method", Value: method})
+		} else if method := object(match["method"]); len(method) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: "grpc-method", Operator: text(method["type"]), Name: text(method["service"]), Value: text(method["method"])})
+		}
+		for _, kind := range []string{"headers", "queryParams"} {
+			for _, value := range items(match[kind]) {
+				group = append(group, cr.NetworkTopologyMatch{Type: kind, Name: text(value["name"]), Operator: text(value["type"]), Value: "[redacted]"})
+			}
+		}
+		result = append(result, group)
+	}
+	return result
+}
+
+func (g *topologyGraph) gatewayBackend(o topologyObject, rule string, backend map[string]any, relation, protocol string) *cr.NetworkTopologyGraphEdge {
+	ns := firstTopology(text(backend["namespace"]), o.ref.Namespace)
+	kind := firstTopology(text(backend["kind"]), "Service")
+	name := text(backend["name"])
+	port := text(backend["port"])
+	if kind != "Service" || text(backend["group"]) != "" {
+		return g.link(rule, g.unknown(rule, kind, ns, name, "unsupported_fragment"), relation, protocol, port)
+	}
+	target := ""
+	if ns != o.ref.Namespace && !g.grantsBackend(o, ns, name) {
+		state := "unknown"
+		if g.completeSource("gateway.referencegrants", ns) {
+			state = "unresolved"
+		}
+		target = g.unknown(rule, kind, ns, name, state)
+	} else {
+		target = g.backend(rule, ns, name, port, protocol)
+	}
+	edge := g.link(rule, target, relation, protocol, port)
+	if service, ok := g.objects[topologyKey("Service", ns, name)]; ok && target == service.id() && port != "" && !servicePortExists(service, port, protocol) {
+		edge.ResolutionState = "unresolved"
+		edge.Note = "Service port/protocol does not match the route backend"
+	}
+	weight := integer(backend["weight"], 1)
+	if weight >= 0 {
+		edge.Weight = &weight
+	} else {
+		edge.ResolutionState = "unsupported_fragment"
+	}
+	return edge
+}
+
+func (g *topologyGraph) grantsBackend(o topologyObject, namespace, name string) bool {
+	return g.referenceAuthorized(o, "", "Service", namespace, name)
+}
+
+func (g *topologyGraph) completeSource(source, namespace string) bool {
+	for _, coverage := range g.view.Coverage {
+		if coverage.Name == "" && coverage.SourceID == source && (coverage.Namespace == "" || coverage.Namespace == namespace) && coverage.State == "available" && !coverage.Truncated {
+			return true
+		}
+	}
+	return false
+}
+
+func (g *topologyGraph) gatewayParent(o topologyObject, entry string, parent map[string]any, protocol string) {
+	ns := firstTopology(text(parent["namespace"]), o.ref.Namespace)
+	name := text(parent["name"])
+	if (text(parent["kind"]) != "" && text(parent["kind"]) != "Gateway") || (text(parent["group"]) != "" && text(parent["group"]) != "gateway.networking.k8s.io") {
+		g.state(entry, "unsupported_fragment")
+		return
+	}
+	gateway, ok := g.objects[topologyKey("Gateway", ns, name)]
+	if !ok {
+		edge := g.link(g.unknown(entry, "Gateway", ns, name, ""), entry, "matches", protocol, text(parent["port"]))
+		edge.SourceRef = &o.ref
+		edge.FieldPath = "spec.parentRefs"
+		edge.SectionName = text(parent["sectionName"])
+		edge.ResolutionState = g.referenceState("Gateway", ns)
+		return
+	}
+	parentID := g.objectNode(gateway, "entry", g.classProvider("GatewayClass", text(at(gateway.body, "spec", "gatewayClassName")), "gateway"), "")
+	if !g.expanded["listeners:"+parentID] {
+		g.expanded["listeners:"+parentID] = true
+		for _, listener := range items(at(gateway.body, "spec", "listeners")) {
+			g.properties(parentID, cr.NetworkTopologyProperty{Name: "Listener " + text(listener["name"]), Value: strings.Join([]string{text(listener["protocol"]), text(listener["port"]), text(listener["hostname"]), text(at(listener, "tls", "mode"))}, " · ")})
+		}
+	}
+	section := text(parent["sectionName"])
+	port := text(parent["port"])
+	state := "unresolved"
+	ports := []string{}
+	for _, listener := range items(at(gateway.body, "spec", "listeners")) {
+		if (section == "" || text(listener["name"]) == section) && (port == "" || text(listener["port"]) == port) {
+			if g.listenerAllows(o, ns, listener) && gatewayListenerProtocolAllows(o, listener) {
+				state = "resolved"
+				ports = append(ports, text(listener["port"]))
+			} else if state != "resolved" {
+				state = "unknown"
+			}
+		}
+	}
+	edge := g.link(parentID, entry, "matches", protocol, firstTopology(port, strings.Join(ports, ",")))
+	edge.ResolutionState = state
+	edge.SourceRef = &o.ref
+	edge.SectionName = section
+	edge.FieldPath = "spec.parentRefs"
+	edge.Note = "Listener " + section + "; attachment must also be accepted by the controller"
+}
+
+func gatewayListenerProtocolAllows(o topologyObject, listener map[string]any) bool {
+	protocol := text(listener["protocol"])
+	switch o.ref.Kind {
+	case "TCPRoute":
+		return protocol == "TCP"
+	case "UDPRoute":
+		return protocol == "UDP"
+	case "TLSRoute":
+		if protocol != "TLS" || text(at(listener, "tls", "mode")) != "Passthrough" {
+			return false
+		}
+		listenerHost := text(listener["hostname"])
+		for _, host := range texts(at(o.body, "spec", "hostnames")) {
+			if listenerHost == "" || gatewayHostMatches(host, listenerHost) || gatewayHostMatches(listenerHost, host) {
+				return true
+			}
+		}
+		return false
+	default:
+		return protocol == "HTTP" || protocol == "HTTPS"
+	}
+}
+
+func gatewayHostMatches(host, pattern string) bool {
+	return host == pattern || (strings.HasPrefix(pattern, "*.") && strings.HasSuffix(host, pattern[1:]) && len(host) > len(pattern)-1)
+}
+func (g *topologyGraph) listenerAllows(o topologyObject, namespace string, listener map[string]any) bool {
+	from := text(at(listener, "allowedRoutes", "namespaces", "from"))
+	if from == "Selector" {
+		ns, ok := g.objects[topologyKey("Namespace", "", o.ref.Namespace)]
+		if !ok || !g.completeSource("kubernetes.namespaces", "") || !topologySelectorMatches(object(at(listener, "allowedRoutes", "namespaces", "selector")), object(at(ns.body, "metadata", "labels"))) {
+			return false
+		}
+	}
+	if o.ref.Namespace != namespace && from != "All" && from != "Selector" {
+		return false
+	}
+	kinds := items(at(listener, "allowedRoutes", "kinds"))
+	if len(kinds) == 0 {
+		return true
+	}
+	for _, kind := range kinds {
+		if text(kind["kind"]) == o.ref.Kind && (text(kind["group"]) == "" || text(kind["group"]) == "gateway.networking.k8s.io") {
+			return true
+		}
+	}
+	return false
+}
+func (g *topologyGraph) gatewayFilter(o topologyObject, rule string, filter map[string]any, protocol, path string) {
+	kind := text(filter["type"])
+	if kind == "RequestMirror" {
+		mirror := object(filter["requestMirror"])
+		edge := g.gatewayBackend(o, rule, object(mirror["backendRef"]), "mirrors", protocol)
+		edge.FieldPath = path + ".requestMirror.backendRef"
+		edge.SourceRef = &o.ref
+		if value, ok := mirror["percent"].(float64); ok && value >= 0 && value <= 100 {
+			edge.MirrorPercent = &value
+		}
+		return
+	}
+	g.properties(rule, cr.NetworkTopologyProperty{Name: "Configured filter", Value: kind + " (execution order not inferred)"})
+	if kind != "RequestHeaderModifier" && kind != "ResponseHeaderModifier" {
+		g.state(rule, "unsupported_fragment")
+	}
+}
+func (g *topologyGraph) gatewayConditions(o topologyObject, id string) {
+	node := g.nodes[id]
+	for _, parent := range items(at(o.body, "status", "parents")) {
+		for _, condition := range items(parent["conditions"]) {
+			generation := integer(condition["observedGeneration"], 0)
+			node.Conditions = append(node.Conditions, cr.NetworkTopologyCondition{Type: text(condition["type"]), Status: text(condition["status"]), Reason: text(condition["reason"]), ObservedGeneration: &generation, LastTransitionTime: text(condition["lastTransitionTime"])})
+			if generation != o.generation || text(condition["status"]) != "True" {
+				node.ResolutionState = "unresolved"
+			}
+		}
+	}
+	if len(node.Conditions) == 0 {
+		node.ResolutionState = "unknown"
+	}
+	g.nodes[id] = node
+}

package/resource/runtime/network_topology_builder_legacy.go

@@ -0,0 +1,66 @@
+package runtime
+
+import cr "github.com/opensoha/soha-contracts/resource"
+
+// Legacy traces are a bounded projection of the graph, never a separately inferred topology.
+func (g *topologyGraph) projectLegacy() {
+	outgoing := map[string][]cr.NetworkTopologyGraphEdge{}
+	for _, edge := range g.view.Edges {
+		outgoing[edge.Source] = append(outgoing[edge.Source], edge)
+	}
+	for _, node := range g.view.Nodes {
+		if node.Type != "rule" {
+			continue
+		}
+		entry := node
+		for _, edge := range g.view.Edges {
+			if edge.Target == node.ID && g.nodes[edge.Source].Type == "entry" {
+				entry = g.nodes[edge.Source]
+				break
+			}
+		}
+		g.walkLegacy(entry, node, node.ID, outgoing, map[string]bool{}, 0)
+	}
+}
+func (g *topologyGraph) walkLegacy(entry, rule cr.NetworkTopologyGraphNode, id string, outgoing map[string][]cr.NetworkTopologyGraphEdge, seen map[string]bool, depth int) {
+	g.legacyWalks++
+	if g.legacyWalks > 2000 {
+		g.view.Truncated = true
+		return
+	}
+	if depth > 12 || seen[id] || len(g.view.Traces) >= cr.NetworkTopologyDefaultEdges {
+		return
+	}
+	next := cloneTopologySeen(seen)
+	next[id] = true
+	node := g.nodes[id]
+	if node.Type == "service" || len(outgoing[id]) == 0 {
+		state := "pending"
+		if node.ResolutionState == "resolved" {
+			state = "live"
+		}
+		sourceType := "ingress"
+		if rule.Resource != nil && (rule.Resource.Kind == "HTTPRoute" || rule.Resource.Kind == "GRPCRoute") {
+			sourceType = "httproute"
+		}
+		service := legacyTopologyNode(node, "service")
+		g.view.Traces = append(g.view.Traces, cr.NetworkTopologyTraceView{ID: rule.ID + ">" + id, SourceType: sourceType, State: state, Entry: legacyTopologyNode(entry, "entry"), Route: legacyTopologyNode(rule, "ingress-route"), Service: &service, Note: "Projected from rule topology; consult graph evidence for ports, weights and resolution state."})
+		return
+	}
+	for _, edge := range outgoing[id] {
+		if edge.Relation != "mirrors" {
+			g.walkLegacy(entry, rule, edge.Target, outgoing, next, depth+1)
+		}
+	}
+}
+func legacyTopologyNode(node cr.NetworkTopologyGraphNode, kind string) cr.NetworkTopologyNodeView {
+	result := cr.NetworkTopologyNodeView{ID: node.ID, Name: node.Label, Kind: kind, State: "pending", Badge: node.Provider, Subtitle: node.ResolutionState}
+	if node.ResolutionState == "resolved" {
+		result.State = "live"
+	}
+	if node.Resource != nil {
+		result.Namespace = node.Resource.Namespace
+		result.ResourceName = node.Resource.Name
+	}
+	return result
+}