Skip to content

Commit 4f3511b

Browse files
kahirokunnkahirokunn
committed
feat(gateway-api): Add custom backendRef and filters support for HTTPRoute
Signed-off-by: kahirokunn <okinakahiro@gmail.com>
1 parent 64b5081 commit 4f3511b

File tree

23 files changed

+2220
-135
lines changed

23 files changed

+2220
-135
lines changed

‎artifacts/flagger/crd.yaml

Lines changed: 428 additions & 11 deletions
Large diffs are not rendered by default.

‎charts/flagger/crds/crd.yaml

Lines changed: 428 additions & 11 deletions
Large diffs are not rendered by default.

‎charts/flagger/templates/rbac.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,8 @@ rules:
226226
resources:
227227
- httproutes
228228
- httproutes/finalizers
229+
- referencegrants
230+
- referencegrants/finalizers
229231
verbs:
230232
- get
231233
- list

‎kustomize/base/flagger/crd.yaml

Lines changed: 428 additions & 11 deletions
Large diffs are not rendered by default.

‎pkg/apis/flagger/v1beta1/canary.go

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"fmt"
2121
"time"
2222

23+
v1 "github.com/fluxcd/flagger/pkg/apis/gatewayapi/v1"
2324
"github.com/fluxcd/flagger/pkg/apis/gatewayapi/v1beta1"
2425
istiov1beta1 "github.com/fluxcd/flagger/pkg/apis/istio/v1beta1"
2526
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -213,11 +214,11 @@ type CanaryService struct {
213214

214215
// Primary is the metadata to add to the primary service
215216
// +optional
216-
Primary *CustomMetadata `json:"primary,omitempty"`
217+
Primary *CustomBackend `json:"primary,omitempty"`
217218

218219
// Canary is the metadata to add to the canary service
219220
// +optional
220-
Canary *CustomMetadata `json:"canary,omitempty"`
221+
Canary *CustomBackend `json:"canary,omitempty"`
221222
}
222223

223224
// CanaryAnalysis is used to describe how the analysis should be done
@@ -496,6 +497,30 @@ type CustomMetadata struct {
496497
Annotations map[string]string `json:"annotations,omitempty"`
497498
}
498499

500+
// CustomBackend holds labels, annotations, and proxyRef to set on generated objects.
501+
type CustomBackend struct {
502+
CustomMetadata
503+
504+
// Ref references a Kubernetes object.
505+
BackendObjectReference *v1.BackendObjectReference `json:"backendRef,omitempty"`
506+
507+
// Filters defined at this level should be executed if and only if the
508+
// request is being forwarded to the backend defined here.
509+
//
510+
// Support: Implementation-specific (For broader support of filters, use the
511+
// Filters field in HTTPRouteRule.)
512+
//
513+
// +optional
514+
// +kubebuilder:validation:MaxItems=16
515+
// +kubebuilder:validation:XValidation:message="May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both",rule="!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))"
516+
// +kubebuilder:validation:XValidation:message="May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both",rule="!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))"
517+
// +kubebuilder:validation:XValidation:message="RequestHeaderModifier filter cannot be repeated",rule="self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1"
518+
// +kubebuilder:validation:XValidation:message="ResponseHeaderModifier filter cannot be repeated",rule="self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1"
519+
// +kubebuilder:validation:XValidation:message="RequestRedirect filter cannot be repeated",rule="self.filter(f, f.type == 'RequestRedirect').size() <= 1"
520+
// +kubebuilder:validation:XValidation:message="URLRewrite filter cannot be repeated",rule="self.filter(f, f.type == 'URLRewrite').size() <= 1"
521+
Filters []v1.HTTPRouteFilter `json:"filters,omitempty"`
522+
}
523+
499524
// HTTPRewrite holds information about how to modify a request URI during
500525
// forwarding.
501526
type HTTPRewrite struct {

‎pkg/apis/flagger/v1beta1/zz_generated.deepcopy.go

Lines changed: 32 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/gatewayapi/v1beta1/referencegrant_types.go

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1beta1
18+
19+
import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
21+
// +genclient
22+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
23+
// +kubebuilder:object:root=true
24+
// +kubebuilder:resource:categories=gateway-api,shortName=refgrant
25+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
26+
// +kubebuilder:storageversion
27+
28+
// ReferenceGrant identifies kinds of resources in other namespaces that are
29+
// trusted to reference the specified kinds of resources in the same namespace
30+
// as the policy.
31+
//
32+
// Each ReferenceGrant can be used to represent a unique trust relationship.
33+
// Additional Reference Grants can be used to add to the set of trusted
34+
// sources of inbound references for the namespace they are defined within.
35+
//
36+
// All cross-namespace references in Gateway API (with the exception of cross-namespace
37+
// Gateway-route attachment) require a ReferenceGrant.
38+
//
39+
// ReferenceGrant is a form of runtime verification allowing users to assert
40+
// which cross-namespace object references are permitted. Implementations that
41+
// support ReferenceGrant MUST NOT permit cross-namespace references which have
42+
// no grant, and MUST respond to the removal of a grant by revoking the access
43+
// that the grant allowed.
44+
type ReferenceGrant struct {
45+
metav1.TypeMeta `json:",inline"`
46+
metav1.ObjectMeta `json:"metadata,omitempty"`
47+
48+
// Spec defines the desired state of ReferenceGrant.
49+
Spec ReferenceGrantSpec `json:"spec,omitempty"`
50+
51+
// Note that `Status` sub-resource has been excluded at the
52+
// moment as it was difficult to work out the design.
53+
// `Status` sub-resource may be added in future.
54+
}
55+
56+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
57+
// +kubebuilder:object:root=true
58+
// ReferenceGrantList contains a list of ReferenceGrant.
59+
type ReferenceGrantList struct {
60+
metav1.TypeMeta `json:",inline"`
61+
metav1.ListMeta `json:"metadata,omitempty"`
62+
Items []ReferenceGrant `json:"items"`
63+
}
64+
65+
// ReferenceGrantSpec identifies a cross namespace relationship that is trusted
66+
// for Gateway API.
67+
type ReferenceGrantSpec struct {
68+
// From describes the trusted namespaces and kinds that can reference the
69+
// resources described in "To". Each entry in this list MUST be considered
70+
// to be an additional place that references can be valid from, or to put
71+
// this another way, entries MUST be combined using OR.
72+
//
73+
// Support: Core
74+
//
75+
// +kubebuilder:validation:MinItems=1
76+
// +kubebuilder:validation:MaxItems=16
77+
From []ReferenceGrantFrom `json:"from"`
78+
79+
// To describes the resources that may be referenced by the resources
80+
// described in "From". Each entry in this list MUST be considered to be an
81+
// additional place that references can be valid to, or to put this another
82+
// way, entries MUST be combined using OR.
83+
//
84+
// Support: Core
85+
//
86+
// +kubebuilder:validation:MinItems=1
87+
// +kubebuilder:validation:MaxItems=16
88+
To []ReferenceGrantTo `json:"to"`
89+
}
90+
91+
// ReferenceGrantFrom describes trusted namespaces and kinds.
92+
type ReferenceGrantFrom struct {
93+
// Group is the group of the referent.
94+
// When empty, the Kubernetes core API group is inferred.
95+
//
96+
// Support: Core
97+
Group Group `json:"group"`
98+
99+
// Kind is the kind of the referent. Although implementations may support
100+
// additional resources, the following types are part of the "Core"
101+
// support level for this field.
102+
//
103+
// When used to permit a SecretObjectReference:
104+
//
105+
// * Gateway
106+
//
107+
// When used to permit a BackendObjectReference:
108+
//
109+
// * GRPCRoute
110+
// * HTTPRoute
111+
// * TCPRoute
112+
// * TLSRoute
113+
// * UDPRoute
114+
Kind Kind `json:"kind"`
115+
116+
// Namespace is the namespace of the referent.
117+
//
118+
// Support: Core
119+
Namespace Namespace `json:"namespace"`
120+
}
121+
122+
// ReferenceGrantTo describes what Kinds are allowed as targets of the
123+
// references.
124+
type ReferenceGrantTo struct {
125+
// Group is the group of the referent.
126+
// When empty, the Kubernetes core API group is inferred.
127+
//
128+
// Support: Core
129+
Group Group `json:"group"`
130+
131+
// Kind is the kind of the referent. Although implementations may support
132+
// additional resources, the following types are part of the "Core"
133+
// support level for this field:
134+
//
135+
// * Secret when used to permit a SecretObjectReference
136+
// * Service when used to permit a BackendObjectReference
137+
Kind Kind `json:"kind"`
138+
139+
// Name is the name of the referent. When unspecified, this policy
140+
// refers to all resources of the specified Group and Kind in the local
141+
// namespace.
142+
//
143+
// +optional
144+
Name *ObjectName `json:"name,omitempty"`
145+
}

‎pkg/apis/gatewayapi/v1beta1/register.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
3333
scheme.AddKnownTypes(SchemeGroupVersion,
3434
&HTTPRoute{},
3535
&HTTPRouteList{},
36+
&ReferenceGrant{},
37+
&ReferenceGrantList{},
3638
)
3739
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
3840
return nil

0 commit comments

Comments
 (0)