Wierd logic in genrating VirtualService Match headers.

[luoyanzecs]

After InsertProbe Function, spec.rules[0].http.path[0].headers length become 2 from 1, but only one header(random choice) will be used in generated VirtualService.

This is very wierd, is it a bug?

make match.header here : https://github.com/knative-extensions/net-istio/blob/release-0.24/pkg/reconciler/ingress/resources/virtual_service.go#L265

InsertProbe Function here: https://github.com/knative-extensions/net-istio/blob/release-0.24/vendor/knative.dev/networking/pkg/ingress/ingress.go#L44

Origin Ingress Spec

spec:
  httpOption: Enabled
  rules:
  - hosts:
    - *****
    - *****.fat-faas.svc
    http:
      paths:
      - headers:
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - appendHeaders:
          Knative-Serving-Default-Route: "true"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
    visibility: ClusterLocal
  - hosts:
    - *****
    http:
      paths:
      - headers:
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - appendHeaders:
          Knative-Serving-Default-Route: "true"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
    visibility: ExternalIP

Ingress spec after InsertProbe function

spec:
  httpOption: Enabled
  rules:
  - hosts:
    - *****
    - *****.fat-faas.svc
    http:
      paths:
      - appendHeaders:
          K-Network-Hash: 4a2ff082b4bef282bdc2abe41a4e8352344210835ab2843cbbbcb713e2a868a1
        headers:
          K-Network-Hash:
            exact: override
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - appendHeaders:
          K-Network-Hash: 4a2ff082b4bef282bdc2abe41a4e8352344210835ab2843cbbbcb713e2a868a1
          Knative-Serving-Default-Route: "true"
        headers:
          K-Network-Hash:
            exact: override
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - headers:
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - appendHeaders:
          Knative-Serving-Default-Route: "true"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
    visibility: ClusterLocal
  - hosts:
    - *****
    http:
      paths:
      - appendHeaders:
          K-Network-Hash: 4a2ff082b4bef282bdc2abe41a4e8352344210835ab2843cbbbcb713e2a868a1
        headers:
          K-Network-Hash:
            exact: override
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - headers:
          x-ctx-CanaryReq:
            exact: "1"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
      - appendHeaders:
          Knative-Serving-Default-Route: "true"
        splits:
        - appendHeaders:
            Knative-Serving-Namespace: fat-faas
            Knative-Serving-Revision: *****-00008
          percent: 100
          serviceName: *****-00008
          serviceNamespace: fat-faas
          servicePort: 80
    visibility: ExternalIP

[dprotaso]

/triage accepted

[SharpEdgeMarshall]

We are affected by this and it is generating duplicated rules on Istio.
This is the same issue described here and closed without fix #847

This is causing also reconciliation deadloop on virtualservices in some cases:

Clusters Match
Listeners Match
Routes Don't Match (RDS last loaded at Fri, 19 Jul 2024 16:01:42 CEST)
--- Istiod Routes
+++ Envoy Routes
@@ -5181,17 +5181,17 @@
                         "routes": [
                             {
                                 "match": {
                                     "prefix": "/",
                                     "caseSensitive": true,
                                     "headers": [
                                         {
-                                            "name": "K-Network-Hash",
-                                            "stringMatch": {
-                                                "exact": "override"
+                                            "name": "Knative-Serving-Tag",
+                                            "stringMatch": {
+                                                "exact": "v-2"
                                             }
                                         },
                                         {
                                             "name": ":authority",
                                             "stringMatch": {
                                                 "prefix": "mydomain"
                                             }