fix(status): support GET in authzHandler to return authz offload status by devGPP23 · Pull Request #1832 · kmesh-net/kmesh

devGPP23 · 2026-07-30T20:48:16Z

Problem

I was going through the authz CLI code and saw that fetchAuthzStatus() in ctl/authz/authz.go sends a GET to /authz to check the current state. But when I looked at the server side, authzHandler only accepts POST and rejects everything else with 405. So kmeshctl authz status was never actually working — it always gets a 405 back.
due to these lines of code in authzHandler,whenever someone tried GET endpoint , it return method not allowed

if r.Method != http.MethodPost {
		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
		return
	}

Solution

I added GET support to authzHandler the same way loggersHandler already handles it — GET goes to a read function, POST goes to the write function.

The new getAuthzStatus() reads from BpfLoader.GetAuthzOffload() and returns the state as JSON. The POST logic is unchanged, just moved it to setAuthzStatus() to keep things clean.

There were no tests for this handler before so I added a couple — one to check the default state and one to verify it updates after enabling authz.

Below is the terminal output from testing the /authz endpoint locally against the Kmesh status server:

$ curl -s -v http://localhost:15020/authz
* Host localhost:15020 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:15020...
* Established connection to localhost (::1 port 15020) from ::1 port 34348 
* using HTTP/1.x
> GET /authz HTTP/1.1
> Host: localhost:15020
> User-Agent: curl/8.18.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< Content-Type: application/json
< Date: Sat, 08 Aug 2026 05:21:38 GMT
< Content-Length: 24
< 
{
    "enabled": false
* Connection #0 to host localhost:15020 left intact
}

We got status 200 with Json telling if authz is enabled or not

gemini-code-assist · 2026-07-30T20:48:19Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

pkg/status/status_server_test.go:736

This assertion relies on substring matching the JSON response body. To make the test resilient to formatting changes and consistent with other JSON-response tests in this file, unmarshal the body and assert the Enabled field.

		assert.Equal(t, http.StatusOK, w.Code)
		assert.Contains(t, w.Body.String(), `"enabled": true`)

		authzOffload := l.GetAuthzOffload()
		assert.Equal(t, constants.ENABLED, authzOffload)
	})

pkg/status/status_server_test.go:699

The test is validating the GET /authz response by substring matching the raw body. This is brittle (whitespace/formatting changes) and less consistent with other tests in this file that unmarshal JSON before asserting fields (e.g., TestServer_getLoggerLevel). Consider unmarshalling the response JSON and asserting the Enabled field instead.

This issue also appears on line 731 of the same file.

		assert.Equal(t, http.StatusOK, w.Code)
		assert.Contains(t, w.Body.String(), `"enabled": false`)
	})

codecov · 2026-08-01T19:27:04Z

Codecov Report

❌ Patch coverage is 83.33333% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.84%. Comparing base (09e96d3) to head (53f57aa).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/status/status_server.go	83.33%	2 Missing and 1 partial ⚠️

Files with missing lines	Coverage Δ
pkg/status/status_server.go	`42.07% <83.33%> (+6.25%)`	⬆️

... and 1 file with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 60881fc...53f57aa. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The authzHandler currently rejects GET requests with 405, but the CLI fetchAuthzStatus() already sends GET to query the current state. Add a getAuthzStatus handler that reads from BpfLoader.GetAuthzOffload() and returns the status as JSON, following the existing loggersHandler pattern. Also adds test coverage for the authz handler which previously had none. Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

devGPP23 · 2026-08-01T21:11:37Z

/retest

kmesh-bot · 2026-08-01T21:12:00Z

@devGPP23: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

pkg/status/status_server_test.go:732

This assertion is coupled to JSON formatting/indentation. Parsing the response and asserting on the decoded enabled field is more robust and makes the test intent clearer.

		assert.Equal(t, http.StatusOK, w.Code)
		assert.Contains(t, w.Body.String(), `"enabled": true`)

pkg/status/status_server_test.go:698

This assertion is coupled to JSON formatting/indentation. Parsing the response and asserting on the decoded enabled field is more robust and makes the test intent clearer.

This issue also appears on line 731 of the same file.

		assert.Equal(t, http.StatusOK, w.Code)
		assert.Contains(t, w.Body.String(), `"enabled": false`)

pkg/status/status_server.go:345

GetAuthzOffload() logs and returns the zero value on map read failures. With this GET endpoint, that means an internal read error will be reported to clients as enabled=false (200 OK) instead of an error response, which can mask operational problems.

func (s *Server) getAuthzStatus(w http.ResponseWriter) {
	authzOffload := s.loader.GetAuthzOffload()
	enabled := authzOffload == constants.ENABLED

devGPP23 · 2026-08-02T19:42:00Z

@yashisrani @LiZhenCheng9527 @hzxuzhonghu

The failing E2E Test(istio 1.26) is unrelated to my changes
this PR only modifies the admin status server (pkg/status/status_server.go) and its unit test.
The failing test (TestMixNsAndServiceWaypoint) tests waypoint proxy data-plane routing, which my code doesn't touch at all. The same test passed on Istio 1.27 and 1.28 in this same CI run.

Could you please /retest when they get a chance?

Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pkg/status/status_server.go:355

getAuthzStatus uses json.MarshalIndent, which inserts newlines/spaces into the response body. kmeshctl authz status currently prints the raw response into a tabwriter table, so multi-line JSON will break the table formatting. Return compact, single-line JSON here (no trailing newline) to keep CLI output stable.

	data, err := json.MarshalIndent(&struct {
		Enabled bool `json:"enabled"`
	}{Enabled: enabled}, "", "    ")
	if err != nil {

devGPP23 · 2026-08-07T20:24:50Z

cc/ @yashisrani

yashisrani · 2026-08-10T13:18:50Z

/lgtm

LiZhenCheng9527 · 2026-09-17T11:43:35Z

+		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
+	w.WriteHeader(http.StatusOK)


Content-Type: application/json is not set.

kmesh-bot · 2026-09-17T18:17:42Z

New changes are detected. LGTM label has been removed.

kmesh-bot · 2026-09-17T18:17:44Z

Adding label do-not-merge/contains-merge-commits because PR contains merge commits, which are not allowed in this repository.
Use git rebase to reapply your commits on top of the target branch. Detailed instructions for doing so can be found here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copilot

🟡 Changes recommended

Set the response Content-Type to application/json and assert it in tests.

Get a fresh assessment by requesting another Copilot review.

Review details

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Lite

Copilot

🔵 Needs a closer look

The tests do not verify the default GET status before changing the authz setting.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

pkg/status/status_server_test.go:686

This test does not cover the default-state behavior described by the PR: it first POSTs enable=false and only then exercises GET. Please issue a GET before the POST and assert the initial response, so regressions in reading the default offload value are actually detected.

Files reviewed: 2/2 changed files
Comments generated: 0 new
Review effort level: Lite

…onse Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

kmesh-bot · 2026-09-17T21:52:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hzxuzhonghu for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

pkg/controller/OWNERS
pkg/status/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

🟡 Changes recommended

The certificate retry test relies on fixed sleeps and may remain intermittent under load.

Get a fresh assessment by requesting another Copilot review.

Review details

Files reviewed: 3/3 changed files
Comments generated: 1
Review effort level: Lite

+	// Wait long enough for the ADD request to be processed and the error path
+	// (including scheduling a time.AfterFunc retry) to complete.
+	time.Sleep(500 * time.Millisecond)
 	patches2.Reset()

+	// Wait for any pending auto-retry (time.AfterFunc(1s) in fetchCert) to fire
+	// after the patch has been removed so it can succeed with the real mock client.
+	time.Sleep(1500 * time.Millisecond)


Copilot AI lite review requested due to automatic review settings July 30, 2026 20:48

kmesh-bot requested review from Okabe-Rintarou-0 and hzxuzhonghu July 30, 2026 20:48

Copilot AI reviewed Jul 30, 2026

kmesh-bot added the size/M label Jul 30, 2026

Copilot AI review requested due to automatic review settings July 31, 2026 15:22

Copilot AI reviewed Jul 31, 2026

kmesh-bot added the do-not-merge/contains-merge-commits label Jul 31, 2026

devGPP23 force-pushed the fix-authz-get-handler branch from c103467 to 8375bbd Compare August 1, 2026 18:57

Copilot AI review requested due to automatic review settings August 1, 2026 18:57

kmesh-bot removed the do-not-merge/contains-merge-commits label Aug 1, 2026

Copilot started reviewing on behalf of devGPP23 August 1, 2026 18:58 View session

Copilot AI reviewed Aug 1, 2026

View reviewed changes

kmesh-bot added the do-not-merge/contains-merge-commits label Aug 1, 2026

devGPP23 force-pushed the fix-authz-get-handler branch from dac5669 to ef61602 Compare August 1, 2026 20:42

kmesh-bot removed the do-not-merge/contains-merge-commits label Aug 1, 2026

devGPP23 requested a review from Copilot August 2, 2026 05:41

Copilot started reviewing on behalf of devGPP23 August 2, 2026 05:42 View session

Copilot AI reviewed Aug 2, 2026

View reviewed changes

Dreamstick9 mentioned this pull request Aug 3, 2026

test(status): add unit tests for the version and config_dump handlers #1851

Open

test: fix authz handler coverage and json assertions

5f673d4

Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

Copilot AI review requested due to automatic review settings August 4, 2026 11:28

kmesh-bot added size/L and removed size/M labels Aug 4, 2026

Copilot started reviewing on behalf of devGPP23 August 4, 2026 11:29 View session

Copilot AI reviewed Aug 4, 2026

View reviewed changes

kmesh-bot assigned yashisrani Aug 10, 2026

kmesh-bot added the lgtm label Aug 10, 2026

LiZhenCheng9527 reviewed Sep 17, 2026

View reviewed changes

Merge branch 'main' into fix-authz-get-handler

7b99942

Copilot AI review requested due to automatic review settings September 17, 2026 18:17

kmesh-bot removed the lgtm label Sep 17, 2026

kmesh-bot added the do-not-merge/contains-merge-commits label Sep 17, 2026

Copilot started reviewing on behalf of devGPP23 September 17, 2026 18:20 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

Comment thread pkg/status/status_server.go

Copilot AI review requested due to automatic review settings September 17, 2026 20:26

devGPP23 force-pushed the fix-authz-get-handler branch from c473d9f to 6cb75a7 Compare September 17, 2026 20:26

Copilot started reviewing on behalf of devGPP23 September 17, 2026 20:27 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

devGPP23 force-pushed the fix-authz-get-handler branch from 6cb75a7 to 742bb2b Compare September 17, 2026 20:34

fix(status): set Content-Type application/json in getAuthzStatus resp…

877008d

…onse Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

devGPP23 force-pushed the fix-authz-get-handler branch from 742bb2b to 877008d Compare September 17, 2026 20:37

test(security): fix flaky TestretryFetchCert timing issues

53f57aa

Signed-off-by: devGP7 <gauravpatil232005@gmail.com>

Copilot AI review requested due to automatic review settings September 17, 2026 21:52

Copilot started reviewing on behalf of devGPP23 September 17, 2026 21:52 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

Conversation

devGPP23 commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

devGPP23 commented Aug 1, 2026

Uh oh!

kmesh-bot commented Aug 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

devGPP23 commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

devGPP23 commented Aug 7, 2026

Uh oh!

yashisrani commented Aug 10, 2026

Uh oh!

LiZhenCheng9527 Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kmesh-bot commented Sep 17, 2026

Uh oh!

kmesh-bot commented Sep 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (1)

Uh oh!

kmesh-bot commented Sep 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

devGPP23 commented Jul 30, 2026 •

edited

Loading

codecov Bot commented Aug 1, 2026 •

edited

Loading

devGPP23 commented Aug 2, 2026 •

edited

Loading