feat: Add httproute support for vmauth.

hkmdxlftjf · hkmdxlftjf · commit d39103a333be · 2025-11-20T11:53:17.000+08:00
diff --git a/api/go.mod b/api/go.mod
@@ -14,7 +14,8 @@ require (
 	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v0.34.1
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
-	sigs.k8s.io/controller-runtime v0.20.2
+	sigs.k8s.io/controller-runtime v0.20.4
+	sigs.k8s.io/gateway-api v1.3.0
 )
 
 require (
diff --git a/api/go.sum b/api/go.sum
@@ -617,8 +617,10 @@ k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.20.2 h1:/439OZVxoEc02psi1h4QO3bHzTgu49bb347Xp4gW1pc=
-sigs.k8s.io/controller-runtime v0.20.2/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
+sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
+sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
+sigs.k8s.io/gateway-api v1.3.0 h1:q6okN+/UKDATola4JY7zXzx40WO4VISk7i9DIfOvr9M=
+sigs.k8s.io/gateway-api v1.3.0/go.mod h1:d8NV8nJbaRbEKem+5IuxkL8gJGOZ+FJ+NvOIltV8gDk=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
diff --git a/api/operator/v1beta1/vmauth_types.go b/api/operator/v1beta1/vmauth_types.go
@@ -13,6 +13,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 var labelNameRegexp = regexp.MustCompile("^[a-zA-Z_:.][a-zA-Z0-9_:.]*$")
@@ -66,6 +67,8 @@ type VMAuthSpec struct {
 	PodDisruptionBudget *EmbeddedPodDisruptionBudgetSpec `json:"podDisruptionBudget,omitempty" yaml:"podDisruptionBudget,omitempty"`
 	// Ingress enables ingress configuration for VMAuth.
 	Ingress *EmbeddedIngress `json:"ingress,omitempty"`
+	// HTTPRoute enables httproute configuration for VMAuth.
+	HTTPRoute *EmbeddedHTTPRoute `json:"httpRoute,omitempty"`
 	// LivenessProbe that will be added to VMAuth pod
 	*EmbeddedProbes `json:",inline"`
 	// UnauthorizedAccessConfig configures access for un authorized users
@@ -469,6 +472,15 @@ func (cr *VMAuthSpec) UnmarshalJSON(src []byte) error {
 	return nil
 }
 
+// EmbeddedHTTPRoute describes httproute configuration options.
+type EmbeddedHTTPRoute struct {
+	//  EmbeddedObjectMetadata adds labels and annotations for object.
+	EmbeddedObjectMetadata `json:",inline"`
+	// Spec describes the attributes that a user creates on a httproute.
+	// More info: https://gateway-api.sigs.k8s.io/api-types/httproute/
+	Spec gwapiv1.HTTPRouteSpec `json:"spec"`
+}
+
 // EmbeddedIngress describes ingress configuration options.
 type EmbeddedIngress struct {
 	// ClassName defines ingress class name for VMAuth
diff --git a/api/operator/v1beta1/zz_generated.deepcopy.go b/api/operator/v1beta1/zz_generated.deepcopy.go
diff --git a/config/base-with-webhook/kustomization.yaml b/config/base-with-webhook/kustomization.yaml
@@ -80,3 +80,9 @@ replacements:
       group: cert-manager.io
       kind: Certificate
       version: v1
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+images:
+- name: manager
+  newName: localhost:5001/victoriametrics/operator
+  newTag: heads-master-0-g1a308796-dirty-8e974fa6
diff --git a/config/crd/overlay/crd.yaml b/config/crd/overlay/crd.yaml
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
@@ -1,2 +1,3 @@
 resources:
 - manager.yaml
+- ../rbac
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -200,3 +200,9 @@ rules:
   - vmanomalies/status
   verbs:
   - '*'
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - httproutes
+  verbs:
+  - '*'
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
@@ -18,6 +18,7 @@ aliases:
 * FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): add `VM_ENABLETCP6` variable that runs all operator CRs in IPv6 mode. See [#1581](https://github.com/VictoriaMetrics/operator/issues/1581).
 * FEATURE: [config-reloader](https://github.com/VictoriaMetrics/operator/blob/master/cmd/config-reloader/README.md): set default config reloader image version equal to current operator version. See [#2562](https://github.com/VictoriaMetrics/helm-charts/pull/2562).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): do not set `promscrape.cluster.membersCount` and `promscrape.cluster.memberNum` flags in ingestOnly mode. See [#1594](https://github.com/VictoriaMetrics/operator/issues/1594).
+* FEATURE: [vmauth](https://docs.victoriametrics.com/operator/resources/vmauth/): Add httproute support for vmauth. See[#1625](https://github.com/VictoriaMetrics/operator/issues/1625)
 
 * BUGFIX: [vmalertmanager](https://docs.victoriametrics.com/operator/resources/vmalertmanager/): check `mute_time_intervals` in subroutes: See [#1618](https://github.com/VictoriaMetrics/operator/issues/1618).
 
diff --git a/docs/api.md b/docs/api.md
@@ -1726,6 +1726,14 @@ Appears in: [VMAuthSpec](#vmauthspec)
 | tlsSecretName<a href="#embeddedingress-tlssecretname" id="embeddedingress-tlssecretname">#</a><br/>_string_ | _(Optional)_<br/>TlsSecretName defines secretname at the VMAuth namespace with cert and key<br />https://kubernetes.io/docs/concepts/services-networking/ingress/#tls |
 
 
+#### EmbeddedHTTPRoute
+
+
+| Field                                                                                                                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **spec**<a href="#embeddedhttproute-spec" id="embeddedhttproute-spec">#</a><br/>*[HTTPRouteSpec](https://gateway-api.sigs.k8s.io/reference/spec/#httproutespec)* | *(Required)*<br/>The specification of the HTTPRoute resource. This field defines routing rules, matches, filters, backend references, and other HTTP-level behaviors.<br/>See: [https://gateway-api.sigs.k8s.io/api-types/httproute/](https://gateway-api.sigs.k8s.io/api-types/httproute/)                                                   |
+
+
 #### EmbeddedObjectMetadata
 
 
diff --git a/go.mod b/go.mod
@@ -31,6 +31,7 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	sigs.k8s.io/controller-runtime v0.22.2
+	sigs.k8s.io/gateway-api v1.3.0
 )
 
 require (
diff --git a/go.sum b/go.sum
@@ -643,6 +643,8 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
 sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
+sigs.k8s.io/gateway-api v1.3.0 h1:q6okN+/UKDATola4JY7zXzx40WO4VISk7i9DIfOvr9M=
+sigs.k8s.io/gateway-api v1.3.0/go.mod h1:d8NV8nJbaRbEKem+5IuxkL8gJGOZ+FJ+NvOIltV8gDk=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
diff --git a/internal/controller/operator/factory/build/httproute.go b/internal/controller/operator/factory/build/httproute.go
@@ -0,0 +1,53 @@
+package build
+
+import (
+	"strconv"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
+)
+
+// HTTPRoute creates HTTPRoute object
+func HTTPRoute(cr builderOpts, port string, httpRoute *vmv1beta1.EmbeddedHTTPRoute) (*gwapiv1.HTTPRoute, error) {
+	var (
+		defaultPort gwapiv1.PortNumber
+	)
+	if defaultPortVal, err := strconv.Atoi(port); err != nil {
+		return nil, err
+	} else {
+		defaultPort = gwapiv1.PortNumber(defaultPortVal)
+	}
+
+	defaultBackendRef := gwapiv1.HTTPBackendRef{
+		BackendRef: gwapiv1.BackendRef{
+			BackendObjectReference: gwapiv1.BackendObjectReference{
+				Name: gwapiv1.ObjectName(cr.PrefixedName()),
+				Port: &defaultPort,
+			},
+		},
+	}
+
+	lbls := labels.Merge(httpRoute.Labels, cr.SelectorLabels())
+	spec := httpRoute.Spec
+	for i := range spec.Rules {
+		if spec.Rules[i].BackendRefs == nil {
+			spec.Rules[i].BackendRefs = []gwapiv1.HTTPBackendRef{}
+		}
+		spec.Rules[i].BackendRefs = append(spec.Rules[i].BackendRefs, defaultBackendRef)
+	}
+
+	return &gwapiv1.HTTPRoute{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:            cr.PrefixedName(),
+			Namespace:       cr.GetNamespace(),
+			Labels:          lbls,
+			Annotations:     httpRoute.Annotations,
+			OwnerReferences: []metav1.OwnerReference{cr.AsOwner()},
+			Finalizers:      []string{vmv1beta1.FinalizerName},
+		},
+		Spec: spec,
+	}, nil
+}
diff --git a/internal/controller/operator/factory/finalize/vmauth.go b/internal/controller/operator/factory/finalize/vmauth.go
@@ -3,14 +3,14 @@ package finalize
 import (
 	"context"
 
+	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 // OnVMAuthDelete deletes all vmauth related resources
@@ -61,6 +61,26 @@ func OnVMAuthDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1.VM
 		return err
 	}
 
+	if cr.Spec.HTTPRoute != nil {
+		httpRoute := &gwapiv1.HTTPRoute{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      cr.PrefixedName(),
+				Namespace: cr.Namespace,
+			},
+		}
+		if err := removeFinalizeObjByName(ctx, rclient, httpRoute, cr.PrefixedName(), cr.Namespace); err != nil {
+			return err
+		}
+		if err := SafeDelete(ctx, rclient, httpRoute); err != nil {
+			return err
+		}
+	}
+
+	// check ingress
+	if err := removeFinalizeObjByName(ctx, rclient, &gwapiv1.HTTPRoute{}, cr.PrefixedName(), cr.Namespace); err != nil {
+		return err
+	}
+
 	// check HPA
 	if err := removeFinalizeObjByName(ctx, rclient, &autoscalingv2.HorizontalPodAutoscaler{}, cr.PrefixedName(), cr.Namespace); err != nil {
 		return err
diff --git a/internal/controller/operator/factory/reconcile/httproute.go b/internal/controller/operator/factory/reconcile/httproute.go
@@ -0,0 +1,51 @@
+package reconcile
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	"github.com/VictoriaMetrics/operator/internal/controller/operator/factory/finalize"
+	"github.com/VictoriaMetrics/operator/internal/controller/operator/factory/logger"
+)
+
+// HTTPRoute creates or update HTTPRoute object
+func HTTPRoute(ctx context.Context, rclient client.Client, newHTTPRoute, prevHTTPRoute *gwapiv1.HTTPRoute) error {
+	return retryOnConflict(func() error {
+		var curHTTPRoute gwapiv1.HTTPRoute
+		if err := rclient.Get(ctx, types.NamespacedName{Name: newHTTPRoute.GetName(), Namespace: newHTTPRoute.GetNamespace()}, &curHTTPRoute); err != nil {
+			if k8serrors.IsNotFound(err) {
+				logger.WithContext(ctx).Info(fmt.Sprintf("creating HTTPRoute %s configuration", newHTTPRoute.Name))
+				return rclient.Create(ctx, newHTTPRoute)
+			}
+			return fmt.Errorf("cannot get exist HTTPRoute object: %w", err)
+		}
+		if !curHTTPRoute.DeletionTimestamp.IsZero() {
+			return &errRecreate{
+				origin: fmt.Errorf("waiting for HTTPRoute %q to be removed", newHTTPRoute.Name),
+			}
+		}
+		if err := finalize.FreeIfNeeded(ctx, rclient, &curHTTPRoute); err != nil {
+			return err
+		}
+
+		if equality.Semantic.DeepEqual(newHTTPRoute.Spec, curHTTPRoute.Spec) &&
+			equality.Semantic.DeepEqual(newHTTPRoute.Labels, curHTTPRoute.Labels) &&
+			isObjectMetaEqual(&curHTTPRoute, newHTTPRoute, prevHTTPRoute) {
+			return nil
+		}
+
+		mergeObjectMetadataIntoNew(&curHTTPRoute, newHTTPRoute, prevHTTPRoute)
+		newHTTPRoute.Status = curHTTPRoute.Status
+
+		logMsg := fmt.Sprintf("updating HTTPRoute %s configuration spec_diff: %s", newHTTPRoute.Name, diffDeepDerivative(newHTTPRoute.Spec, curHTTPRoute.Spec))
+		logger.WithContext(ctx).Info(logMsg)
+
+		return rclient.Update(ctx, newHTTPRoute)
+	})
+}
diff --git a/internal/controller/operator/factory/vmauth/vmauth.go b/internal/controller/operator/factory/vmauth/vmauth.go
@@ -21,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
 	"github.com/VictoriaMetrics/operator/internal/config"
@@ -71,6 +72,11 @@ func CreateOrUpdate(ctx context.Context, cr *vmv1beta1.VMAuth, rclient client.Cl
 	if err := createOrUpdateIngress(ctx, rclient, cr); err != nil {
 		return fmt.Errorf("cannot create or update ingress for vmauth: %w", err)
 	}
+
+	if err := createOrUpdateHTTPRoute(ctx, rclient, cr, prevCR); err != nil {
+		return fmt.Errorf("cannot create or update httpRoute for vmauth: %w", err)
+	}
+
 	if err := createOrUpdateHPA(ctx, rclient, cr, prevCR); err != nil {
 		return fmt.Errorf("cannot create or update hpa for vmauth: %w", err)
 	}
@@ -117,6 +123,26 @@ func CreateOrUpdate(ctx context.Context, cr *vmv1beta1.VMAuth, rclient client.Cl
 	return nil
 }
 
+func createOrUpdateHTTPRoute(ctx context.Context, rclient client.Client, cr, prevCr *vmv1beta1.VMAuth) error {
+	if cr.Spec.HTTPRoute == nil {
+		return nil
+	}
+	newHTTPRoute, err := build.HTTPRoute(cr, cr.Spec.Port, cr.Spec.HTTPRoute)
+	if err != nil {
+		return err
+	}
+
+	var prevHTTPRoute *gwapiv1.HTTPRoute
+	if prevCr != nil && prevCr.Spec.HTTPRoute != nil {
+		prevHTTPRoute, err = build.HTTPRoute(cr, cr.Spec.Port, prevCr.Spec.HTTPRoute)
+		if err != nil {
+			return err
+		}
+	}
+
+	return reconcile.HTTPRoute(ctx, rclient, newHTTPRoute, prevHTTPRoute)
+}
+
 func newDeployForVMAuth(cr *vmv1beta1.VMAuth) (*appsv1.Deployment, error) {
 
 	cfg := config.MustGetBaseConfig()
diff --git a/internal/controller/operator/vmauth_controller.go b/internal/controller/operator/vmauth_controller.go
@@ -58,6 +58,7 @@ func (r *VMAuthReconciler) Scheme() *runtime.Scheme {
 // Reconcile implements interface
 // +kubebuilder:rbac:groups=operator.victoriametrics.com,resources=vmauths,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=operator.victoriametrics.com,resources=vmauths/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=httproutes,verbs=get;list;watch;create;update;patch;delete
 func (r *VMAuthReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, err error) {
 	l := r.Log.WithValues("vmauth", req.Name, "namespace", req.Namespace)
 	ctx = logger.AddToContext(ctx, l)
diff --git a/internal/manager/manager.go b/internal/manager/manager.go
@@ -39,6 +39,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 	vmv1 "github.com/VictoriaMetrics/operator/api/operator/v1"
 	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
@@ -128,6 +129,7 @@ func init() {
 	utilruntime.Must(metav1.AddToScheme(scheme))
 	utilruntime.Must(v1alpha1.AddToScheme(scheme))
 	utilruntime.Must(promv1.AddToScheme(scheme))
+	utilruntime.Must(gwapiv1.Install(scheme))
 	build.AddDefaults(scheme)
 	// +kubebuilder:scaffold:scheme
 }

Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,8 @@ require (`
`14`	`14`	`k8s.io/apimachinery v0.34.1`
`15`	`15`	`k8s.io/client-go v0.34.1`
`16`	`16`	`k8s.io/utils v0.0.0-20251002143259-bc988d571ff4`
`17`		`- sigs.k8s.io/controller-runtime v0.20.2`
	`17`	`+ sigs.k8s.io/controller-runtime v0.20.4`
	`18`	`+ sigs.k8s.io/gateway-api v1.3.0`
`18`	`19`	`)`
`19`	`20`
`20`	`21`	`require (`
Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`resources:`
`2`	`2`	`- manager.yaml`
	`3`	`+- ../rbac`