Merge pull request #1164 from shipt/contour-retryon-support

Contour: Update the httproxy API and enable RetryOn

pkg/apis/projectcontour/v1/detailedconditions.go

@@ -0,0 +1,190 @@
+// Copyright Project Contour Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +k8s:deepcopy-gen=package
+
+// Package v1 is the v1 version of the API.
+// +groupName=projectcontour.io
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// ConditionStatus is a type alias for the k8s.io/apimachinery/pkg/apis/meta/v1
+// ConditionStatus type to maintain API compatibility.
+// +k8s:deepcopy-gen=false
+type ConditionStatus = metav1.ConditionStatus
+
+// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
+// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
+// can't decide if a resource is in the condition or not. In the future, we could add other
+// intermediate conditions, e.g. ConditionDegraded. These are retained here for API compatibility.
+const (
+	ConditionTrue    ConditionStatus = metav1.ConditionTrue
+	ConditionFalse   ConditionStatus = metav1.ConditionFalse
+	ConditionUnknown ConditionStatus = metav1.ConditionUnknown
+)
+
+// Condition is a type alias for the k8s.io/apimachinery/pkg/apis/meta/v1
+// Condition type to maintain API compatibility.
+// +k8s:deepcopy-gen=false
+type Condition = metav1.Condition
+
+// SubCondition is a Condition-like type intended for use as a subcondition inside a DetailedCondition.
+//
+// It contains a subset of the Condition fields.
+//
+// It is intended for warnings and errors, so `type` names should use abnormal-true polarity,
+// that is, they should be of the form "ErrorPresent: true".
+//
+// The expected lifecycle for these errors is that they should only be present when the error or warning is,
+// and should be removed when they are not relevant.
+type SubCondition struct {
+	// Type of condition in `CamelCase` or in `foo.example.com/CamelCase`.
+	//
+	// This must be in abnormal-true polarity, that is, `ErrorFound` or `controller.io/ErrorFound`.
+	//
+	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+	// +kubebuilder:validation:MaxLength=316
+	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
+	// Status of the condition, one of True, False, Unknown.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=True;False;Unknown
+	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"`
+	// Reason contains a programmatic identifier indicating the reason for the condition's last transition.
+	// Producers of specific condition types may define expected values and meanings for this field,
+	// and whether the values are considered a guaranteed API.
+	//
+	// The value should be a CamelCase string.
+	//
+	// This field may not be empty.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	Reason string `json:"reason" protobuf:"bytes,3,opt,name=reason"`
+	// Message is a human readable message indicating details about the transition.
+	//
+	// This may be an empty string.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=32768
+	Message string `json:"message" protobuf:"bytes,4,opt,name=message"`
+}
+
+// DetailedCondition is an extension of the normal Kubernetes conditions, with two extra
+// fields to hold sub-conditions, which provide more detailed reasons for the state (True or False)
+// of the condition.
+//
+// `errors` holds information about sub-conditions which are fatal to that condition and render its state False.
+//
+// `warnings` holds information about sub-conditions which are not fatal to that condition and do not force the state to be False.
+//
+// Remember that Conditions have a type, a status, and a reason.
+//
+// The type is the type of the condition, the most important one in this CRD set is `Valid`.
+// `Valid` is a positive-polarity condition: when it is `status: true` there are no problems.
+//
+// In more detail, `status: true` means that the object is has been ingested into Contour with no errors.
+// `warnings` may still be present, and will be indicated in the Reason field. There must be zero entries in the `errors`
+// slice in this case.
+//
+// `Valid`, `status: false` means that the object has had one or more fatal errors during processing into Contour.
+//  The details of the errors will be present under the `errors` field. There must be at least one error in the `errors`
+// slice if `status` is `false`.
+//
+// For DetailedConditions of types other than `Valid`, the Condition must be in the negative polarity.
+// When they have `status` `true`, there is an error. There must be at least one entry in the `errors` Subcondition slice.
+// When they have `status` `false`, there are no serious errors, and there must be zero entries in the `errors` slice.
+// In either case, there may be entries in the `warnings` slice.
+//
+// Regardless of the polarity, the `reason` and `message` fields must be updated with either the detail of the reason
+// (if there is one and only one entry in total across both the `errors` and `warnings` slices), or
+// `MultipleReasons` if there is more than one entry.
+type DetailedCondition struct {
+	Condition `json:",inline"`
+	// Errors contains a slice of relevant error subconditions for this object.
+	//
+	// Subconditions are expected to appear when relevant (when there is a error), and disappear when not relevant.
+	// An empty slice here indicates no errors.
+	// +optional
+	Errors []SubCondition `json:"errors,omitempty"`
+	// Warnings contains a slice of relevant warning subconditions for this object.
+	//
+	// Subconditions are expected to appear when relevant (when there is a warning), and disappear when not relevant.
+	// An empty slice here indicates no warnings.
+	// +optional
+	Warnings []SubCondition `json:"warnings,omitempty"`
+}
+
+const (
+	// ValidConditionType describes an valid condition.
+	ValidConditionType = "Valid"
+
+	// ConditionTypeAuthError describes an error condition related to Auth.
+	ConditionTypeAuthError = "AuthError"
+
+	// ConditionTypeCORSError describes an error condition related to CORS.
+	ConditionTypeCORSError = "CORSError"
+
+	// ConditionTypeIncludeError describes an error condition with
+	// inclusion of another HTTPProxy resource.
+	ConditionTypeIncludeError = "IncludeError"
+
+	// ConditionTypeOrphanedError describes an error condition
+	// with an HTTPProxy resource which is not part of a delegation chain.
+	ConditionTypeOrphanedError = "Orphaned"
+
+	// ConditionTypePrefixReplaceError describes an error condition with
+	// an HTTPProxy path prefix replacement issue.
+	ConditionTypePrefixReplaceError = "PrefixReplaceError"
+
+	// ConditionTypeRootNamespaceError describes an error condition
+	// with an HTTPProxy resource created in non-root namespace.
+	ConditionTypeRootNamespaceError = "RootNamespaceError"
+
+	// ConditionTypeRouteError describes an error condition that
+	// relates to Routes within an HTTPProxy.
+	ConditionTypeRouteError = "RouteError"
+
+	// ConditionTypeServiceError describes an error condition that
+	// relates to a Service error within an HTTPProxy.
+	ConditionTypeServiceError = "ServiceError"
+
+	// ConditionTypeSpecError describes an error condition that
+	// relates to the Spec of an HTTPProxy resource.
+	ConditionTypeSpecError = "SpecError"
+
+	// ConditionTypeTCPProxyIncludeError describes an error condition
+	// with inclusion of another HTTPProxy TCP Proxy resource.
+	ConditionTypeTCPProxyIncludeError = "TCPProxyIncludeError"
+
+	// ConditionTypeTCPProxyError describes an error condition relating
+	// to a TCP Proxy HTTPProxy resource.
+	ConditionTypeTCPProxyError = "TCPProxyError"
+
+	// ConditionTypeTLSError describes an error condition relating
+	// to TLS configuration.
+	ConditionTypeTLSError = "TLSError"
+
+	// ConditionTypeVirtualHostError describes an error condition relating
+	// to the VirtualHost configuration section of an HTTPProxy resource.
+	ConditionTypeVirtualHostError = "VirtualHostError"
+)

pkg/apis/projectcontour/v1/zz_generated.deepcopy.go

@@ -26,22 +26,269 @@ import (
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Condition) DeepCopyInto(out *Condition) {
+func (in *AuthorizationPolicy) DeepCopyInto(out *AuthorizationPolicy) {
 	*out = *in
-	if in.Header != nil {
-		in, out := &in.Header, &out.Header
-		*out = new(HeaderCondition)
+	if in.Context != nil {
+		in, out := &in.Context, &out.Context
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicy.
+func (in *AuthorizationPolicy) DeepCopy() *AuthorizationPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthorizationPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationServer) DeepCopyInto(out *AuthorizationServer) {
+	*out = *in
+	out.ExtensionServiceRef = in.ExtensionServiceRef
+	if in.AuthPolicy != nil {
+		in, out := &in.AuthPolicy, &out.AuthPolicy
+		*out = new(AuthorizationPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.WithRequestBody != nil {
+		in, out := &in.WithRequestBody, &out.WithRequestBody
+		*out = new(AuthorizationServerBufferSettings)
 		**out = **in
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Condition.
-func (in *Condition) DeepCopy() *Condition {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationServer.
+func (in *AuthorizationServer) DeepCopy() *AuthorizationServer {
 	if in == nil {
 		return nil
 	}
-	out := new(Condition)
+	out := new(AuthorizationServer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationServerBufferSettings) DeepCopyInto(out *AuthorizationServerBufferSettings) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationServerBufferSettings.
+func (in *AuthorizationServerBufferSettings) DeepCopy() *AuthorizationServerBufferSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthorizationServerBufferSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CORSPolicy) DeepCopyInto(out *CORSPolicy) {
+	*out = *in
+	if in.AllowOrigin != nil {
+		in, out := &in.AllowOrigin, &out.AllowOrigin
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowMethods != nil {
+		in, out := &in.AllowMethods, &out.AllowMethods
+		*out = make([]CORSHeaderValue, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowHeaders != nil {
+		in, out := &in.AllowHeaders, &out.AllowHeaders
+		*out = make([]CORSHeaderValue, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExposeHeaders != nil {
+		in, out := &in.ExposeHeaders, &out.ExposeHeaders
+		*out = make([]CORSHeaderValue, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CORSPolicy.
+func (in *CORSPolicy) DeepCopy() *CORSPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CORSPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CookieDomainRewrite) DeepCopyInto(out *CookieDomainRewrite) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CookieDomainRewrite.
+func (in *CookieDomainRewrite) DeepCopy() *CookieDomainRewrite {
+	if in == nil {
+		return nil
+	}
+	out := new(CookieDomainRewrite)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CookiePathRewrite) DeepCopyInto(out *CookiePathRewrite) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CookiePathRewrite.
+func (in *CookiePathRewrite) DeepCopy() *CookiePathRewrite {
+	if in == nil {
+		return nil
+	}
+	out := new(CookiePathRewrite)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CookieRewritePolicy) DeepCopyInto(out *CookieRewritePolicy) {
+	*out = *in
+	if in.PathRewrite != nil {
+		in, out := &in.PathRewrite, &out.PathRewrite
+		*out = new(CookiePathRewrite)
+		**out = **in
+	}
+	if in.DomainRewrite != nil {
+		in, out := &in.DomainRewrite, &out.DomainRewrite
+		*out = new(CookieDomainRewrite)
+		**out = **in
+	}
+	if in.Secure != nil {
+		in, out := &in.Secure, &out.Secure
+		*out = new(bool)
+		**out = **in
+	}
+	if in.SameSite != nil {
+		in, out := &in.SameSite, &out.SameSite
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CookieRewritePolicy.
+func (in *CookieRewritePolicy) DeepCopy() *CookieRewritePolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CookieRewritePolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DetailedCondition) DeepCopyInto(out *DetailedCondition) {
+	*out = *in
+	in.Condition.DeepCopyInto(&out.Condition)
+	if in.Errors != nil {
+		in, out := &in.Errors, &out.Errors
+		*out = make([]SubCondition, len(*in))
+		copy(*out, *in)
+	}
+	if in.Warnings != nil {
+		in, out := &in.Warnings, &out.Warnings
+		*out = make([]SubCondition, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DetailedCondition.
+func (in *DetailedCondition) DeepCopy() *DetailedCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(DetailedCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DownstreamValidation) DeepCopyInto(out *DownstreamValidation) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DownstreamValidation.
+func (in *DownstreamValidation) DeepCopy() *DownstreamValidation {
+	if in == nil {
+		return nil
+	}
+	out := new(DownstreamValidation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtensionServiceReference) DeepCopyInto(out *ExtensionServiceReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionServiceReference.
+func (in *ExtensionServiceReference) DeepCopy() *ExtensionServiceReference {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtensionServiceReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GenericKeyDescriptor) DeepCopyInto(out *GenericKeyDescriptor) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GenericKeyDescriptor.
+func (in *GenericKeyDescriptor) DeepCopy() *GenericKeyDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(GenericKeyDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalRateLimitPolicy) DeepCopyInto(out *GlobalRateLimitPolicy) {
+	*out = *in
+	if in.Descriptors != nil {
+		in, out := &in.Descriptors, &out.Descriptors
+		*out = make([]RateLimitDescriptor, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRateLimitPolicy.
+func (in *GlobalRateLimitPolicy) DeepCopy() *GlobalRateLimitPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalRateLimitPolicy)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -68,7 +315,7 @@ func (in *HTTPProxy) DeepCopyInto(out *HTTPProxy) {
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
-	out.Status = in.Status
+	in.Status.DeepCopyInto(&out.Status)
 	return
 }
 
@@ -164,17 +411,103 @@ func (in *HTTPProxySpec) DeepCopy() *HTTPProxySpec {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HeaderCondition) DeepCopyInto(out *HeaderCondition) {
+func (in *HTTPProxyStatus) DeepCopyInto(out *HTTPProxyStatus) {
+	*out = *in
+	in.LoadBalancer.DeepCopyInto(&out.LoadBalancer)
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]DetailedCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPProxyStatus.
+func (in *HTTPProxyStatus) DeepCopy() *HTTPProxyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPProxyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPRequestRedirectPolicy) DeepCopyInto(out *HTTPRequestRedirectPolicy) {
+	*out = *in
+	if in.Scheme != nil {
+		in, out := &in.Scheme, &out.Scheme
+		*out = new(string)
+		**out = **in
+	}
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
+	if in.Port != nil {
+		in, out := &in.Port, &out.Port
+		*out = new(int32)
+		**out = **in
+	}
+	if in.StatusCode != nil {
+		in, out := &in.StatusCode, &out.StatusCode
+		*out = new(int)
+		**out = **in
+	}
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = new(string)
+		**out = **in
+	}
+	if in.Prefix != nil {
+		in, out := &in.Prefix, &out.Prefix
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPRequestRedirectPolicy.
+func (in *HTTPRequestRedirectPolicy) DeepCopy() *HTTPRequestRedirectPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPRequestRedirectPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HeaderHashOptions) DeepCopyInto(out *HeaderHashOptions) {
 	*out = *in
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderCondition.
-func (in *HeaderCondition) DeepCopy() *HeaderCondition {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderHashOptions.
+func (in *HeaderHashOptions) DeepCopy() *HeaderHashOptions {
 	if in == nil {
 		return nil
 	}
-	out := new(HeaderCondition)
+	out := new(HeaderHashOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HeaderMatchCondition) DeepCopyInto(out *HeaderMatchCondition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderMatchCondition.
+func (in *HeaderMatchCondition) DeepCopy() *HeaderMatchCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(HeaderMatchCondition)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -226,7 +559,7 @@ func (in *Include) DeepCopyInto(out *Include) {
 	*out = *in
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
-		*out = make([]Condition, len(*in))
+		*out = make([]MatchCondition, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -247,6 +580,13 @@ func (in *Include) DeepCopy() *Include {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LoadBalancerPolicy) DeepCopyInto(out *LoadBalancerPolicy) {
 	*out = *in
+	if in.RequestHashPolicies != nil {
+		in, out := &in.RequestHashPolicies, &out.RequestHashPolicies
+		*out = make([]RequestHashPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 
@@ -260,6 +600,48 @@ func (in *LoadBalancerPolicy) DeepCopy() *LoadBalancerPolicy {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LocalRateLimitPolicy) DeepCopyInto(out *LocalRateLimitPolicy) {
+	*out = *in
+	if in.ResponseHeadersToAdd != nil {
+		in, out := &in.ResponseHeadersToAdd, &out.ResponseHeadersToAdd
+		*out = make([]HeaderValue, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimitPolicy.
+func (in *LocalRateLimitPolicy) DeepCopy() *LocalRateLimitPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimitPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MatchCondition) DeepCopyInto(out *MatchCondition) {
+	*out = *in
+	if in.Header != nil {
+		in, out := &in.Header, &out.Header
+		*out = new(HeaderMatchCondition)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchCondition.
+func (in *MatchCondition) DeepCopy() *MatchCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(MatchCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PathRewritePolicy) DeepCopyInto(out *PathRewritePolicy) {
 	*out = *in
@@ -281,6 +663,107 @@ func (in *PathRewritePolicy) DeepCopy() *PathRewritePolicy {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitDescriptor) DeepCopyInto(out *RateLimitDescriptor) {
+	*out = *in
+	if in.Entries != nil {
+		in, out := &in.Entries, &out.Entries
+		*out = make([]RateLimitDescriptorEntry, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitDescriptor.
+func (in *RateLimitDescriptor) DeepCopy() *RateLimitDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitDescriptorEntry) DeepCopyInto(out *RateLimitDescriptorEntry) {
+	*out = *in
+	if in.GenericKey != nil {
+		in, out := &in.GenericKey, &out.GenericKey
+		*out = new(GenericKeyDescriptor)
+		**out = **in
+	}
+	if in.RequestHeader != nil {
+		in, out := &in.RequestHeader, &out.RequestHeader
+		*out = new(RequestHeaderDescriptor)
+		**out = **in
+	}
+	if in.RequestHeaderValueMatch != nil {
+		in, out := &in.RequestHeaderValueMatch, &out.RequestHeaderValueMatch
+		*out = new(RequestHeaderValueMatchDescriptor)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RemoteAddress != nil {
+		in, out := &in.RemoteAddress, &out.RemoteAddress
+		*out = new(RemoteAddressDescriptor)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitDescriptorEntry.
+func (in *RateLimitDescriptorEntry) DeepCopy() *RateLimitDescriptorEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitDescriptorEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitPolicy) DeepCopyInto(out *RateLimitPolicy) {
+	*out = *in
+	if in.Local != nil {
+		in, out := &in.Local, &out.Local
+		*out = new(LocalRateLimitPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Global != nil {
+		in, out := &in.Global, &out.Global
+		*out = new(GlobalRateLimitPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitPolicy.
+func (in *RateLimitPolicy) DeepCopy() *RateLimitPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RemoteAddressDescriptor) DeepCopyInto(out *RemoteAddressDescriptor) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteAddressDescriptor.
+func (in *RemoteAddressDescriptor) DeepCopy() *RemoteAddressDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(RemoteAddressDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ReplacePrefix) DeepCopyInto(out *ReplacePrefix) {
 	*out = *in
@@ -297,9 +780,77 @@ func (in *ReplacePrefix) DeepCopy() *ReplacePrefix {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestHashPolicy) DeepCopyInto(out *RequestHashPolicy) {
+	*out = *in
+	if in.HeaderHashOptions != nil {
+		in, out := &in.HeaderHashOptions, &out.HeaderHashOptions
+		*out = new(HeaderHashOptions)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestHashPolicy.
+func (in *RequestHashPolicy) DeepCopy() *RequestHashPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestHashPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestHeaderDescriptor) DeepCopyInto(out *RequestHeaderDescriptor) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestHeaderDescriptor.
+func (in *RequestHeaderDescriptor) DeepCopy() *RequestHeaderDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestHeaderDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestHeaderValueMatchDescriptor) DeepCopyInto(out *RequestHeaderValueMatchDescriptor) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make([]HeaderMatchCondition, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestHeaderValueMatchDescriptor.
+func (in *RequestHeaderValueMatchDescriptor) DeepCopy() *RequestHeaderValueMatchDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestHeaderValueMatchDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RetryPolicy) DeepCopyInto(out *RetryPolicy) {
 	*out = *in
+	if in.RetryOn != nil {
+		in, out := &in.RetryOn, &out.RetryOn
+		*out = make([]RetryOn, len(*in))
+		copy(*out, *in)
+	}
+	if in.RetriableStatusCodes != nil {
+		in, out := &in.RetriableStatusCodes, &out.RetriableStatusCodes
+		*out = make([]uint32, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -318,7 +869,7 @@ func (in *Route) DeepCopyInto(out *Route) {
 	*out = *in
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
-		*out = make([]Condition, len(*in))
+		*out = make([]MatchCondition, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -330,6 +881,11 @@ func (in *Route) DeepCopyInto(out *Route) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.AuthPolicy != nil {
+		in, out := &in.AuthPolicy, &out.AuthPolicy
+		*out = new(AuthorizationPolicy)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.TimeoutPolicy != nil {
 		in, out := &in.TimeoutPolicy, &out.TimeoutPolicy
 		*out = new(TimeoutPolicy)
@@ -338,7 +894,7 @@ func (in *Route) DeepCopyInto(out *Route) {
 	if in.RetryPolicy != nil {
 		in, out := &in.RetryPolicy, &out.RetryPolicy
 		*out = new(RetryPolicy)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 	if in.HealthCheckPolicy != nil {
 		in, out := &in.HealthCheckPolicy, &out.HealthCheckPolicy
@@ -348,7 +904,7 @@ func (in *Route) DeepCopyInto(out *Route) {
 	if in.LoadBalancerPolicy != nil {
 		in, out := &in.LoadBalancerPolicy, &out.LoadBalancerPolicy
 		*out = new(LoadBalancerPolicy)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 	if in.PathRewritePolicy != nil {
 		in, out := &in.PathRewritePolicy, &out.PathRewritePolicy
@@ -365,6 +921,23 @@ func (in *Route) DeepCopyInto(out *Route) {
 		*out = new(HeadersPolicy)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.CookieRewritePolicies != nil {
+		in, out := &in.CookieRewritePolicies, &out.CookieRewritePolicies
+		*out = make([]CookieRewritePolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.RateLimitPolicy != nil {
+		in, out := &in.RateLimitPolicy, &out.RateLimitPolicy
+		*out = new(RateLimitPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RequestRedirectPolicy != nil {
+		in, out := &in.RequestRedirectPolicy, &out.RequestRedirectPolicy
+		*out = new(HTTPRequestRedirectPolicy)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -401,6 +974,13 @@ func (in *Service) DeepCopyInto(out *Service) {
 		*out = new(HeadersPolicy)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.CookieRewritePolicies != nil {
+		in, out := &in.CookieRewritePolicies, &out.CookieRewritePolicies
+		*out = make([]CookieRewritePolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 
@@ -415,17 +995,33 @@ func (in *Service) DeepCopy() *Service {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Status) DeepCopyInto(out *Status) {
+func (in *SubCondition) DeepCopyInto(out *SubCondition) {
 	*out = *in
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Status.
-func (in *Status) DeepCopy() *Status {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubCondition.
+func (in *SubCondition) DeepCopy() *SubCondition {
 	if in == nil {
 		return nil
 	}
-	out := new(Status)
+	out := new(SubCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPHealthCheckPolicy) DeepCopyInto(out *TCPHealthCheckPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPHealthCheckPolicy.
+func (in *TCPHealthCheckPolicy) DeepCopy() *TCPHealthCheckPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPHealthCheckPolicy)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -436,7 +1032,7 @@ func (in *TCPProxy) DeepCopyInto(out *TCPProxy) {
 	if in.LoadBalancerPolicy != nil {
 		in, out := &in.LoadBalancerPolicy, &out.LoadBalancerPolicy
 		*out = new(LoadBalancerPolicy)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 	if in.Services != nil {
 		in, out := &in.Services, &out.Services
@@ -450,6 +1046,16 @@ func (in *TCPProxy) DeepCopyInto(out *TCPProxy) {
 		*out = new(TCPProxyInclude)
 		**out = **in
 	}
+	if in.IncludesDeprecated != nil {
+		in, out := &in.IncludesDeprecated, &out.IncludesDeprecated
+		*out = new(TCPProxyInclude)
+		**out = **in
+	}
+	if in.HealthCheckPolicy != nil {
+		in, out := &in.HealthCheckPolicy, &out.HealthCheckPolicy
+		*out = new(TCPHealthCheckPolicy)
+		**out = **in
+	}
 	return
 }
 
@@ -482,6 +1088,11 @@ func (in *TCPProxyInclude) DeepCopy() *TCPProxyInclude {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLS) DeepCopyInto(out *TLS) {
 	*out = *in
+	if in.ClientValidation != nil {
+		in, out := &in.ClientValidation, &out.ClientValidation
+		*out = new(DownstreamValidation)
+		**out = **in
+	}
 	return
 }
 
@@ -533,7 +1144,22 @@ func (in *VirtualHost) DeepCopyInto(out *VirtualHost) {
 	if in.TLS != nil {
 		in, out := &in.TLS, &out.TLS
 		*out = new(TLS)
-		**out = **in
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Authorization != nil {
+		in, out := &in.Authorization, &out.Authorization
+		*out = new(AuthorizationServer)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.CORSPolicy != nil {
+		in, out := &in.CORSPolicy, &out.CORSPolicy
+		*out = new(CORSPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RateLimitPolicy != nil {
+		in, out := &in.RateLimitPolicy, &out.RateLimitPolicy
+		*out = new(RateLimitPolicy)
+		(*in).DeepCopyInto(*out)
 	}
 	return
 }

pkg/router/contour.go

@@ -19,6 +19,7 @@ package router
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -51,7 +52,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 	newSpec := contourv1.HTTPProxySpec{
 		Routes: []contourv1.Route{
 			{
-				Conditions: []contourv1.Condition{
+				Conditions: []contourv1.MatchCondition{
 					{
 						Prefix: cr.makePrefix(canary),
 					},
@@ -62,7 +63,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 					{
 						Name:   primaryName,
 						Port:   int(canary.Spec.Service.Port),
-						Weight: uint32(100),
+						Weight: int64(100),
 						RequestHeadersPolicy: &contourv1.HeadersPolicy{
 							Set: []contourv1.HeaderValue{
 								cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -72,7 +73,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 					{
 						Name:   canaryName,
 						Port:   int(canary.Spec.Service.Port),
-						Weight: uint32(0),
+						Weight: int64(0),
 						RequestHeadersPolicy: &contourv1.HeadersPolicy{
 							Set: []contourv1.HeaderValue{
 								cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -95,7 +96,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 						{
 							Name:   primaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(100),
+							Weight: int64(100),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -105,7 +106,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 						{
 							Name:   canaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(0),
+							Weight: int64(0),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -115,7 +116,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 					},
 				},
 				{
-					Conditions: []contourv1.Condition{
+					Conditions: []contourv1.MatchCondition{
 						{
 							Prefix: cr.makePrefix(canary),
 						},
@@ -126,7 +127,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 						{
 							Name:   primaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(100),
+							Weight: int64(100),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -136,7 +137,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 						{
 							Name:   canaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(0),
+							Weight: int64(0),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -177,7 +178,7 @@ func (cr *ContourRouter) Reconcile(canary *flaggerv1.Canary) error {
 				},
 			},
 			Spec: newSpec,
-			Status: contourv1.Status{
+			Status: contourv1.HTTPProxyStatus{
 				CurrentStatus: "valid",
 				Description:   "valid HTTPProxy",
 			},
@@ -274,7 +275,7 @@ func (cr *ContourRouter) SetRoutes(
 	proxy.Spec = contourv1.HTTPProxySpec{
 		Routes: []contourv1.Route{
 			{
-				Conditions: []contourv1.Condition{
+				Conditions: []contourv1.MatchCondition{
 					{
 						Prefix: cr.makePrefix(canary),
 					},
@@ -285,7 +286,7 @@ func (cr *ContourRouter) SetRoutes(
 					{
 						Name:   primaryName,
 						Port:   int(canary.Spec.Service.Port),
-						Weight: uint32(primaryWeight),
+						Weight: int64(primaryWeight),
 						RequestHeadersPolicy: &contourv1.HeadersPolicy{
 							Set: []contourv1.HeaderValue{
 								cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -295,7 +296,7 @@ func (cr *ContourRouter) SetRoutes(
 					{
 						Name:   canaryName,
 						Port:   int(canary.Spec.Service.Port),
-						Weight: uint32(canaryWeight),
+						Weight: int64(canaryWeight),
 						RequestHeadersPolicy: &contourv1.HeadersPolicy{
 							Set: []contourv1.HeaderValue{
 								cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -317,7 +318,7 @@ func (cr *ContourRouter) SetRoutes(
 						{
 							Name:   primaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(primaryWeight),
+							Weight: int64(primaryWeight),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -327,7 +328,7 @@ func (cr *ContourRouter) SetRoutes(
 						{
 							Name:   canaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(canaryWeight),
+							Weight: int64(canaryWeight),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -337,7 +338,7 @@ func (cr *ContourRouter) SetRoutes(
 					},
 				},
 				{
-					Conditions: []contourv1.Condition{
+					Conditions: []contourv1.MatchCondition{
 						{
 							Prefix: cr.makePrefix(canary),
 						},
@@ -348,7 +349,7 @@ func (cr *ContourRouter) SetRoutes(
 						{
 							Name:   primaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(100),
+							Weight: int64(100),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, primaryName),
@@ -358,7 +359,7 @@ func (cr *ContourRouter) SetRoutes(
 						{
 							Name:   canaryName,
 							Port:   int(canary.Spec.Service.Port),
-							Weight: uint32(0),
+							Weight: int64(0),
 							RequestHeadersPolicy: &contourv1.HeadersPolicy{
 								Set: []contourv1.HeaderValue{
 									cr.makeLinkerdHeaderValue(canary, canaryName),
@@ -390,36 +391,36 @@ func (cr *ContourRouter) makePrefix(canary *flaggerv1.Canary) string {
 	return prefix
 }
 
-func (cr *ContourRouter) makeConditions(canary *flaggerv1.Canary) []contourv1.Condition {
-	list := []contourv1.Condition{}
+func (cr *ContourRouter) makeConditions(canary *flaggerv1.Canary) []contourv1.MatchCondition {
+	list := []contourv1.MatchCondition{}
 
 	if len(canary.GetAnalysis().Match) > 0 {
 		for _, match := range canary.GetAnalysis().Match {
 			for s, stringMatch := range match.Headers {
-				h := &contourv1.HeaderCondition{
+				h := &contourv1.HeaderMatchCondition{
 					Name:  s,
 					Exact: stringMatch.Exact,
 				}
 				if stringMatch.Suffix != "" {
-					h = &contourv1.HeaderCondition{
+					h = &contourv1.HeaderMatchCondition{
 						Name:     s,
 						Contains: stringMatch.Suffix,
 					}
 				}
 				if stringMatch.Prefix != "" {
-					h = &contourv1.HeaderCondition{
+					h = &contourv1.HeaderMatchCondition{
 						Name:     s,
 						Contains: stringMatch.Prefix,
 					}
 				}
-				list = append(list, contourv1.Condition{
+				list = append(list, contourv1.MatchCondition{
 					Prefix: cr.makePrefix(canary),
 					Header: h,
 				})
 			}
 		}
 	} else {
-		list = []contourv1.Condition{
+		list = []contourv1.MatchCondition{
 			{
 				Prefix: cr.makePrefix(canary),
 			},
@@ -442,13 +443,24 @@ func (cr *ContourRouter) makeTimeoutPolicy(canary *flaggerv1.Canary) *contourv1.
 func (cr *ContourRouter) makeRetryPolicy(canary *flaggerv1.Canary) *contourv1.RetryPolicy {
 	if canary.Spec.Service.Retries != nil {
 		return &contourv1.RetryPolicy{
-			NumRetries:    uint32(canary.Spec.Service.Retries.Attempts),
+			NumRetries:    int64(canary.Spec.Service.Retries.Attempts),
 			PerTryTimeout: canary.Spec.Service.Retries.PerTryTimeout,
+			RetryOn:       makeRetryOn(canary.Spec.Service.Retries.RetryOn),
 		}
 	}
 	return nil
 }
 
+func makeRetryOn(retryOnString string) []contourv1.RetryOn {
+	retryOnSplit := strings.Split(retryOnString, ",")
+
+	retryOn := make([]contourv1.RetryOn, len(retryOnSplit))
+	for i, v := range retryOnSplit {
+		retryOn[i] = contourv1.RetryOn(v)
+	}
+	return retryOn
+}
+
 func (cr *ContourRouter) makeLinkerdHeaderValue(canary *flaggerv1.Canary, serviceName string) contourv1.HeaderValue {
 	return contourv1.HeaderValue{
 		Name:  "l5d-dst-override",

pkg/router/contour_test.go

@@ -20,6 +20,8 @@ import (
 	"context"
 	"testing"
 
+	contourv1 "github.com/fluxcd/flagger/pkg/apis/projectcontour/v1"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -46,8 +48,8 @@ func TestContourRouter_Reconcile(t *testing.T) {
 
 	services := proxy.Spec.Routes[0].Services
 	require.Len(t, services, 2)
-	assert.Equal(t, uint32(100), services[0].Weight)
-	assert.Equal(t, uint32(0), services[1].Weight)
+	assert.Equal(t, int64(100), services[0].Weight)
+	assert.Equal(t, int64(0), services[1].Weight)
 	assert.Equal(t, "contour", proxy.Annotations["projectcontour.io/ingress.class"])
 
 	// test update
@@ -69,7 +71,8 @@ func TestContourRouter_Reconcile(t *testing.T) {
 	assert.Equal(t, 8080, proxy.Spec.Routes[0].Services[0].Port)
 	assert.Equal(t, "1m", proxy.Spec.Routes[0].TimeoutPolicy.Response)
 	assert.Equal(t, "/podinfo", proxy.Spec.Routes[0].Conditions[0].Prefix)
-	assert.Equal(t, uint32(10), proxy.Spec.Routes[0].RetryPolicy.NumRetries)
+	assert.Equal(t, int64(10), proxy.Spec.Routes[0].RetryPolicy.NumRetries)
+	assert.Equal(t, []contourv1.RetryOn{"connect-failure", "gateway-error"}, proxy.Spec.Routes[0].RetryPolicy.RetryOn)
 
 	// test headers update
 	cd, err = mocks.flaggerClient.FlaggerV1beta1().Canaries("default").Get(context.TODO(), "podinfo", metav1.GetOptions{})
@@ -111,7 +114,7 @@ func TestContourRouter_Routes(t *testing.T) {
 	require.NoError(t, err)
 
 	primary := proxy.Spec.Routes[0].Services[0]
-	assert.Equal(t, uint32(50), primary.Weight)
+	assert.Equal(t, int64(50), primary.Weight)
 
 	cd, err := mocks.flaggerClient.FlaggerV1beta1().Canaries("default").Get(context.TODO(), "podinfo", metav1.GetOptions{})
 	require.NoError(t, err)
@@ -135,10 +138,10 @@ func TestContourRouter_Routes(t *testing.T) {
 	require.NoError(t, err)
 
 	primary = proxy.Spec.Routes[0].Services[0]
-	assert.Equal(t, uint32(100), primary.Weight)
+	assert.Equal(t, int64(100), primary.Weight)
 
 	primary = proxy.Spec.Routes[1].Services[0]
-	assert.Equal(t, uint32(100), primary.Weight)
+	assert.Equal(t, int64(100), primary.Weight)
 
 	// test set routers for A/B
 	err = router.SetRoutes(canary, 0, 100, false)
@@ -148,8 +151,8 @@ func TestContourRouter_Routes(t *testing.T) {
 	require.NoError(t, err)
 
 	primary = proxy.Spec.Routes[0].Services[0]
-	assert.Equal(t, uint32(0), primary.Weight)
+	assert.Equal(t, int64(0), primary.Weight)
 
 	primary = proxy.Spec.Routes[1].Services[0]
-	assert.Equal(t, uint32(100), primary.Weight)
+	assert.Equal(t, int64(100), primary.Weight)
 }

pkg/router/router_test.go

@@ -132,6 +132,7 @@ func newTestCanary() *flaggerv1.Canary {
 				Retries: &istiov1alpha3.HTTPRetry{
 					Attempts:      10,
 					PerTryTimeout: "30s",
+					RetryOn:       "connect-failure,gateway-error",
 				},
 				Gateways: []string{
 					"public-gateway.istio",