Merge pull request #44 from datum-cloud/feature/custom-hostnames

feat: Implement custom hostname support for HTTPProxies and Gateways

Author: joshlreese

api/v1alpha/httpproxy_types.go

@@ -10,6 +10,46 @@ import (
 
 // HTTPProxySpec defines the desired state of HTTPProxy.
 type HTTPProxySpec struct {
+
+	// Hostnames defines a set of hostnames that should match against the HTTP
+	// Host header to select a HTTPProxy used to process the request.
+	//
+	// Valid values for Hostnames are determined by RFC 1123 definition of a
+	// hostname with 1 notable exception:
+	//
+	// 1. IPs are not allowed.
+	//
+	// Hostnames must be verified before being programmed. This is accomplished
+	// via the use of `Domain` resources. A hostname is considered verified if any
+	// verified `Domain` resource exists in the same namespace where the
+	// `spec.domainName` of the resource either exactly matches the hostname, or
+	// is a suffix match of the hostname. That means that a Domain with a
+	// `spec.domainName` of `example.com` will match a hostname of
+	// `test.example.com`, `foo.test.example.com`, and exactly `example.com`, but
+	// not a hostname of `test-example.com`. If a `Domain` resource does not exist
+	// that matches a hostname, one will automatically be created when the system
+	// attempts to program the HTTPProxy.
+	//
+	// In addition to verifying ownership, hostnames must be unique across the
+	// platform. If a hostname is already programmed on another resource, a
+	// conflict will be encountered and communicated in the `HostnamesVerified`
+	// condition.
+	//
+	// Hostnames which have been programmed will be listed in the
+	// `status.hostnames` field. Any hostname which has not been programmed will
+	// be listed in the `message` field of the `HostnamesVerified` condition with
+	// an indication as to why it was not programmed.
+	//
+	// The system may automatically generate and associate hostnames with the
+	// HTTPProxy. In such cases, these will be listed in the `status.hostnames`
+	// field and do not require additional configuration by the user.
+	//
+	// Wildcard hostnames are not supported at this time.
+	//
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxItems=16
+	Hostnames []gatewayv1.Hostname `json:"hostnames,omitempty"`
+
 	// Rules are a list of HTTP matchers, filters and actions.
 	//
 	// +kubebuilder:validation:Required
@@ -107,7 +147,7 @@ type HTTPProxyStatus struct {
 	// Hostnames lists the hostnames that have been bound to the HTTPProxy.
 	//
 	// If this list does not match that defined in the HTTPProxy, see the
-	// `Programmed` condition message for details.
+	// `HostnamesVerified` condition message for details.
 	Hostnames []gatewayv1.Hostname `json:"hostnames,omitempty"`
 
 	// Conditions describe the current conditions of the HTTPProxy.
@@ -126,6 +166,14 @@ const (
 	// programmed into underlying Gateway resources, and those resources have also
 	// been programmed.
 	HTTPProxyConditionProgrammed = "Programmed"
+
+	// This condition is true when all hostnames defined in an HTTPProxy or a
+	// Gateway listener have been verified.
+	HTTPProxyConditionHostnamesVerified = "HostnamesVerified"
+
+	// This condition is present and true when a hostname defined in an HTTPProxy
+	// is in use by another resource.
+	HTTPProxyConditionHostnamesInUse = "HostnamesInUse"
 )
 
 const (
@@ -144,6 +192,18 @@ const (
 	// conditions when the status is "Unknown" and no controller has reconciled
 	// the HTTPProxy.
 	HTTPProxyReasonPending = "Pending"
+
+	// This reason is used with the "HostnamesVerified" condition when all hostnames
+	// defined in an HTTPProxy or Gateway listener have been verified.
+	HTTPProxyReasonHostnamesVerified = "HostnamesVerified"
+
+	// This reason is used with the a hostname defined in an HTTPProxy or Gateway
+	// has not been verified.
+	UnverifiedHostnamesPresent = "UnverifiedHostnamesPresent"
+
+	// This reason is used with the a hostname defined in an HTTPProxy or Gateway
+	// is in use by another resource.
+	HostnameInUseReason = "HostnameInUse"
 )
 
 // +kubebuilder:object:root=true

api/v1alpha/zz_generated.deepcopy.go

@@ -240,11 +240,10 @@ func main() {
 	}
 
 	validationOpts := validation.GatewayValidationOptions{
-		ControllerName:          serverConfig.Gateway.ControllerName,
-		PermittedTLSOptions:     serverConfig.Gateway.PermittedTLSOptions,
-		ValidPortNumbers:        serverConfig.Gateway.ValidPortNumbers,
-		ValidProtocolTypes:      serverConfig.Gateway.ValidProtocolTypes,
-		CustomHostnameAllowList: serverConfig.Gateway.CustomHostnameAllowList,
+		ControllerName:      serverConfig.Gateway.ControllerName,
+		PermittedTLSOptions: serverConfig.Gateway.PermittedTLSOptions,
+		ValidPortNumbers:    serverConfig.Gateway.ValidPortNumbers,
+		ValidProtocolTypes:  serverConfig.Gateway.ValidProtocolTypes,
 	}
 
 	if err := networkinggatewayv1webhooks.SetupGatewayWebhookWithManager(mgr, validationOpts); err != nil {

cmd/main.go

@@ -51,6 +51,64 @@ spec:
           spec:
             description: Spec defines the desired state of an HTTPProxy.
             properties:
+              hostnames:
+                description: |-
+                  Hostnames defines a set of hostnames that should match against the HTTP
+                  Host header to select a HTTPProxy used to process the request.
+
+                  Valid values for Hostnames are determined by RFC 1123 definition of a
+                  hostname with 1 notable exception:
+
+                  1. IPs are not allowed.
+
+                  Hostnames must be verified before being programmed. This is accomplished
+                  via the use of `Domain` resources. A hostname is considered verified if any
+                  verified `Domain` resource exists in the same namespace where the
+                  `spec.domainName` of the resource either exactly matches the hostname, or
+                  is a suffix match of the hostname. That means that a Domain with a
+                  `spec.domainName` of `example.com` will match a hostname of
+                  `test.example.com`, `foo.test.example.com`, and exactly `example.com`, but
+                  not a hostname of `test-example.com`. If a `Domain` resource does not exist
+                  that matches a hostname, one will automatically be created when the system
+                  attempts to program the HTTPProxy.
+
+                  In addition to verifying ownership, hostnames must be unique across the
+                  platform. If a hostname is already programmed on another resource, a
+                  conflict will be encountered and communicated in the `HostnamesVerified`
+                  condition.
+
+                  Hostnames which have been programmed will be listed in the
+                  `status.hostnames` field. Any hostname which has not been programmed will
+                  be listed in the `message` field of the `HostnamesVerified` condition with
+                  an indication as to why it was not programmed.
+
+                  The system may automatically generate and associate hostnames with the
+                  HTTPProxy. In such cases, these will be listed in the `status.hostnames`
+                  field and do not require additional configuration by the user.
+
+                  Wildcard hostnames are not supported at this time.
+                items:
+                  description: |-
+                    Hostname is the fully qualified domain name of a network host. This matches
+                    the RFC 1123 definition of a hostname with 2 notable exceptions:
+
+                     1. IPs are not allowed.
+                     2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
+                        label must appear by itself as the first label.
+
+                    Hostname can be "precise" which is a domain name without the terminating
+                    dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
+                    domain name prefixed with a single wildcard label (e.g. `*.example.com`).
+
+                    Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
+                    alphanumeric characters or '-', and must start and end with an alphanumeric
+                    character. No other punctuation is allowed.
+                  maxLength: 253
+                  minLength: 1
+                  pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                  type: string
+                maxItems: 16
+                type: array
               rules:
                 description: Rules are a list of HTTP matchers, filters and actions.
                 items:
@@ -2136,7 +2194,7 @@ spec:
                   Hostnames lists the hostnames that have been bound to the HTTPProxy.
 
                   If this list does not match that defined in the HTTPProxy, see the
-                  `Programmed` condition message for details.
+                  `HostnamesVerified` condition message for details.
                 items:
                   description: |-
                     Hostname is the fully qualified domain name of a network host. This matches

config/crd/bases/networking.datumapis.com_httpproxies.yaml

@@ -15,10 +15,6 @@ gateway:
   downstreamGatewayClassName: datum-downstream-gateway-e2e
   permittedTLSOptions:
     gateway.networking.datumapis.com/certificate-issuer: []
-  customHostnameAllowList:
-    - clusterName: ""
-      suffixes:
-        - e2e.env.datum.net
 
 httpProxy:
   tlsOptions:

config/dev/config.yaml

@@ -10,9 +10,5 @@ gateway:
   downstreamGatewayClassName: datum-downstream-gateway-e2e
   permittedTLSOptions:
     gateway.networking.datumapis.com/certificate-issuer: []
-  customHostnameAllowList:
-    - clusterName: ""
-      suffixes:
-        - e2e.env.datum.net
 downstreamResourceManagement:
   kubeconfigPath: /etc/downstream-cluster/kubeconfig

config/e2e/config.yaml

@@ -10,6 +10,18 @@ spec:
         name: [metadata, name]
         namespace: [metadata, namespace]
       metrics:
+      - name: "owner"
+        help: "Owner information"
+        errorLogV: 10
+        each:
+          type: Info
+          info:
+            path: [metadata,ownerReferences]
+            labelsFromPath:
+              owner_kind: [kind]
+              owner_name: [name]
+              owner_uid: [uid]
+              controller: [controller]
       - name: "info"
         help: "Domain information"
         each:

config/resource-metrics/domains.yaml

@@ -10,6 +10,18 @@ spec:
         name: [metadata, name]
         namespace: [metadata, namespace]
       metrics:
+      - name: "owner"
+        help: "Owner information"
+        errorLogV: 10
+        each:
+          type: Info
+          info:
+            path: [metadata,ownerReferences]
+            labelsFromPath:
+              owner_kind: [kind]
+              owner_name: [name]
+              owner_uid: [uid]
+              controller: [controller]
       - name: "info"
         help: "Gateway information"
         each:
@@ -48,6 +60,18 @@ spec:
         name: [metadata, name]
         namespace: [metadata, namespace]
       metrics:
+      - name: "owner"
+        help: "Owner information"
+        errorLogV: 10
+        each:
+          type: Info
+          info:
+            path: [metadata,ownerReferences]
+            labelsFromPath:
+              owner_kind: [kind]
+              owner_name: [name]
+              owner_uid: [uid]
+              controller: [controller]
       - name: "info"
         help: "HTTPRoute information"
         each:

config/resource-metrics/gateways.yaml

@@ -5,11 +5,23 @@ spec:
         group: networking.datumapis.com
         kind: "HTTPProxy"
         version: "v1alpha"
-      metricNamePrefix: datum_cloud_networking_httpproxy
+      metricNamePrefix: datum_cloud_networking_http_proxy
       labelsFromPath:
         name: [metadata, name]
         namespace: [metadata, namespace]
       metrics:
+      - name: "owner"
+        help: "Owner information"
+        errorLogV: 10
+        each:
+          type: Info
+          info:
+            path: [metadata,ownerReferences]
+            labelsFromPath:
+              owner_kind: [kind]
+              owner_name: [name]
+              owner_uid: [uid]
+              controller: [controller]
       - name: "info"
         help: "HTTPProxy information"
         each:

config/resource-metrics/httpproxies.yaml

@@ -10,6 +10,18 @@ spec:
         namespace: [metadata, namespace]
         name: [metadata, name]
       metrics:
+        - name: "owner"
+          help: "Owner information"
+          errorLogV: 10
+          each:
+            type: Info
+            info:
+              path: [metadata,ownerReferences]
+              labelsFromPath:
+                owner_kind: [kind]
+                owner_name: [name]
+                owner_uid: [uid]
+                controller: [controller]
         - name: "info"
           help: "Information about location"
           each: