(apigw/httproute) Add support to disable traffic with weight 0 in services

[sujay-hashicorp]

Description

This PR fixes Consul API Gateway behavior for Kubernetes HTTPRoute backends with weight: 0.

Previously, HTTPRoute normalization converted all weight <= 0 values to 1, which caused explicit weight: 0 backends to still receive traffic. This conflicted with Gateway API expectations and customer-observed behavior.

This change updates normalization logic to:

• Preserve explicit weight: 0 (so zero-weight backends can be excluded from traffic).
• Continue normalizing negative weights to 1.
  Preserve backward compatibility by normalizing all-zero rules to 1 (to avoid breaking older configs that relied on omitted/default weights).

Links

• Prior related fix: GH-16512
• Kubernetes Gateway API backendRefs.weight semantics: Gateway API HTTPRoute spec

Tests

• With this fix, the routes support definition of 0 weight services.
• The instance with weight: 0 does not receive any traffic.

HTTPRoute config output

$ consul config read -kind http-route -name quill-route

{
    "Kind": "http-route",
    "Name": "quill-route",
    "Parents": [
        {
            "Kind": "api-gateway",
            "Name": "api-gateway",
            "SectionName": "http-listener"
        }
    ],
    "Rules": [
        {
            "Filters": {
                "Headers": null,
                "URLRewrite": null,
                "RetryFilter": null,
                "TimeoutFilter": null,
                "JWT": null
            },
            "ResponseFilters": {
                "Headers": null
            },
            "Matches": [
                {
                    "Headers": null,
                    "Method": "",
                    "Path": {
                        "Match": "prefix",
                        "Value": "/"
                    },
                    "Query": null
                }
            ],
            "Services": [
                {
                    "Name": "quill-v1",
                    "Weight": 0,
                    "Filters": {
                        "Headers": null,
                        "URLRewrite": null,
                        "RetryFilter": null,
                        "TimeoutFilter": null,
                        "JWT": null
                    },
                    "ResponseFilters": {
                        "Headers": null
                    }
                },
                {
                    "Name": "quill-v2",
                    "Weight": 100,
                    "Filters": {
                        "Headers": null,
                        "URLRewrite": null,
                        "RetryFilter": null,
                        "TimeoutFilter": null,
                        "JWT": null
                    },
                    "ResponseFilters": {
                        "Headers": null
                    }
                }
            ]
        }
    ],
    "Hostnames": null,
    "CreateIndex": 43,
    "ModifyIndex": 80,
    "Status": {
        "Conditions": [
            {
                "Type": "Accepted",
                "Status": "True",
                "Reason": "Accepted",
                "Message": "route is valid",
                "Resource": {
                    "Kind": "",
                    "Name": "",
                    "SectionName": ""
                },
                "LastTransitionTime": "2026-02-16T08:17:57.943208Z"
            },
            {
                "Type": "Bound",
                "Status": "True",
                "Reason": "Bound",
                "Message": "successfully bound route",
                "Resource": {
                    "Kind": "api-gateway",
                    "Name": "api-gateway",
                    "SectionName": "http-listener"
                },
                "LastTransitionTime": "2026-02-16T08:17:57.943215Z"
            }
        ]
    }
}

Traffic Distribution

case 1:

Services = [
  {
    Name = "quill-v1"
    Weight = 100
  },
  {
    Name = "quill-v2"
    Weight = 100
  }
]

case 2:

Services = [
  {
    Name = "quill-v1"
    Weight = 0
  },
  {
    Name = "quill-v2"
    Weight = 100
  }
]

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[vdinesh4738]

this is misleading, why can't we simply have
allServicesHaveZeroWeight := true

[sujay-hashicorp]

Sure, I have updated it to true. It was set like this so to skip extra processing in cases where there are no services. But I think HTTPRoute must have at least 1 service.

[krutibaraiya]

Wouldn't this reintroduce the same issue again? This normalisation layer looks fine, but down the discovery chain, the 0-weight services would get skipped here and at the end of the loop no spiltter would be created.
Will this handled by Envoy now? If yes, can we add some test coverage to ensure that we return 503?