Skip to content

Commit ea3d385

Browse files
joshlreesejoshlreese
committed
Add support for Envoy Gateway APIs: Backends, BackendTrafficPolicies, HTTPRouteFilters, SecurityPolicies.
Validation for BackendTrafficPolicies is complete. Validation for Backends, HTTPRouteFilters, and SecurityPolicies will come next, along with test coverage. A generic resource replicator has been created to replicate resources from upstream control planes into the downstream control plane, while transforming namespace names. In addition to the Envoy Gateway types now supported, there's default support to replicate ConfigMaps and Secrets which are labeled appropriately. Additional work is required to replicate downstream resource status into upstream resources. This will come in after validation and validation test suites are complete.
1 parent 35b5af1 commit ea3d385

21 files changed

Lines changed: 1306 additions & 110 deletions

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ build-installer: set-image-controller generate ## Generate a consolidated YAML w
138138

139139
.PHONY: set-image-controller
140140
set-image-controller: manifests kustomize
141-
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
141+
cd config/manager && $(KUSTOMIZE) edit set image ghcr.io/datum-cloud/network-services-operator=${IMG}
142142

143143
.PHONY: prepare-infra-cluster
144144
prepare-infra-cluster: cert-manager envoy-gateway external-dns

‎PROJECT‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ resources:
7777
path: sigs.k8s.io/gateway-api/apis/v1
7878
version: v1
7979
webhooks:
80-
validation: true
8180
defaulting: true
81+
validation: true
8282
webhookVersion: v1
8383
- domain: k8s.io
8484
external: true
@@ -107,4 +107,40 @@ resources:
107107
kind: Domain
108108
path: go.datum.net/network-services-operator/api/v1alpha
109109
version: v1alpha
110+
- domain: envoyproxy.io
111+
external: true
112+
group: gateway
113+
kind: BackendTrafficPolicy
114+
path: github.com/envoyproxy/gateway/api/v1alpha1
115+
version: v1alpha1
116+
webhooks:
117+
validation: true
118+
webhookVersion: v1
119+
- domain: envoyproxy.io
120+
external: true
121+
group: gateway
122+
kind: SecurityPolicy
123+
path: github.com/envoyproxy/gateway/api/v1alpha1
124+
version: v1alpha1
125+
webhooks:
126+
validation: true
127+
webhookVersion: v1
128+
- domain: envoyproxy.io
129+
external: true
130+
group: gateway
131+
kind: HTTPRouteFilter
132+
path: github.com/envoyproxy/gateway/api/v1alpha1
133+
version: v1alpha1
134+
webhooks:
135+
validation: true
136+
webhookVersion: v1
137+
- domain: envoyproxy.io
138+
external: true
139+
group: gateway
140+
kind: Backend
141+
path: github.com/envoyproxy/gateway/api/v1alpha1
142+
version: v1alpha1
143+
webhooks:
144+
validation: true
145+
webhookVersion: v1
110146
version: "3"

‎cmd/main.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
// to ensure that exec-entrypoint and run can make use of them.
1212
_ "k8s.io/client-go/plugin/pkg/client/auth"
1313

14+
envoygatewayv1alpha1 "github.com/envoyproxy/gateway/api/v1alpha1"
1415
multiclusterproviders "go.miloapis.com/milo/pkg/multicluster-runtime"
1516
milomulticluster "go.miloapis.com/milo/pkg/multicluster-runtime/milo"
1617
"golang.org/x/sync/errgroup"
@@ -38,6 +39,7 @@ import (
3839
networkingwebhook "go.datum.net/network-services-operator/internal/webhook"
3940
networkinggatewayv1webhooks "go.datum.net/network-services-operator/internal/webhook/v1"
4041
networkingv1alphawebhooks "go.datum.net/network-services-operator/internal/webhook/v1alpha"
42+
webhookgatewayv1alpha1 "go.datum.net/network-services-operator/internal/webhook/v1alpha1"
4143
// +kubebuilder:scaffold:imports
4244
)
4345

@@ -56,9 +58,11 @@ func init() {
5658
utilruntime.Must(gatewayv1.Install(scheme))
5759
utilruntime.Must(gatewayv1alpha2.Install(scheme))
5860
utilruntime.Must(gatewayv1alpha3.Install(scheme))
61+
utilruntime.Must(envoygatewayv1alpha1.AddToScheme(scheme))
5962
// +kubebuilder:scaffold:scheme
6063
}
6164

65+
// nolint:gocyclo
6266
func main() {
6367
var enableLeaderElection bool
6468
var leaderElectionNamespace string
@@ -226,6 +230,14 @@ func main() {
226230
os.Exit(1)
227231
}
228232

233+
if err := (&controller.GatewayResourceReplicatorReconciler{
234+
Config: serverConfig,
235+
DownstreamCluster: downstreamCluster,
236+
}).SetupWithManager(mgr); err != nil {
237+
setupLog.Error(err, "unable to create controller", "controller", "GatewayResourceReplicator")
238+
os.Exit(1)
239+
}
240+
229241
if err := (&controller.DomainReconciler{
230242
Config: serverConfig,
231243
}).SetupWithManager(mgr); err != nil {
@@ -253,6 +265,26 @@ func main() {
253265
os.Exit(1)
254266
}
255267

268+
if err = webhookgatewayv1alpha1.SetupBackendTrafficPolicyWebhookWithManager(mgr); err != nil {
269+
setupLog.Error(err, "unable to create webhook", "webhook", "BackendTrafficPolicy")
270+
os.Exit(1)
271+
}
272+
273+
if err = webhookgatewayv1alpha1.SetupSecurityPolicyWebhookWithManager(mgr); err != nil {
274+
setupLog.Error(err, "unable to create webhook", "webhook", "SecurityPolicy")
275+
os.Exit(1)
276+
}
277+
278+
if err = webhookgatewayv1alpha1.SetupHTTPRouteFilterWebhookWithManager(mgr); err != nil {
279+
setupLog.Error(err, "unable to create webhook", "webhook", "HTTPRouteFilter")
280+
os.Exit(1)
281+
}
282+
283+
if err = webhookgatewayv1alpha1.SetupBackendWebhookWithManager(mgr); err != nil {
284+
setupLog.Error(err, "unable to create webhook", "webhook", "Backend")
285+
os.Exit(1)
286+
}
287+
256288
// +kubebuilder:scaffold:builder
257289

258290
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {

‎config/dev/webhook_patch.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,30 @@ patch: |-
5252
path: /webhooks/2/clientConfig/url
5353
- op: remove
5454
path: /webhooks/2/clientConfig/service
55+
56+
- op: move
57+
from: /webhooks/3/clientConfig/service/path
58+
path: /webhooks/3/clientConfig/url
59+
- op: remove
60+
path: /webhooks/3/clientConfig/service
61+
62+
- op: move
63+
from: /webhooks/4/clientConfig/service/path
64+
path: /webhooks/4/clientConfig/url
65+
- op: remove
66+
path: /webhooks/4/clientConfig/service
67+
68+
- op: move
69+
from: /webhooks/5/clientConfig/service/path
70+
path: /webhooks/5/clientConfig/url
71+
- op: remove
72+
path: /webhooks/5/clientConfig/service
73+
74+
- op: move
75+
from: /webhooks/6/clientConfig/service/path
76+
path: /webhooks/6/clientConfig/url
77+
- op: remove
78+
path: /webhooks/6/clientConfig/service
5579
target:
5680
kind: ValidatingWebhookConfiguration
5781
---

‎config/tools/envoy-gateway/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,12 @@ helmCharts:
77
releaseName: envoy-gateway
88
version: v1.5.0
99
repo: oci://docker.io/envoyproxy
10+
valuesInline:
11+
config:
12+
envoyGateway:
13+
extensionApis:
14+
enableBackend: true
15+
enableEnvoyPatchPolicy: true
16+
runtimeFlags:
17+
enabled:
18+
- XDSNameSchemeV2

‎config/webhook/manifests.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,3 +90,83 @@ webhooks:
9090
resources:
9191
- httpproxies
9292
sideEffects: None
93+
- admissionReviewVersions:
94+
- v1
95+
clientConfig:
96+
service:
97+
name: webhook-service
98+
namespace: system
99+
path: /validate-gateway-envoyproxy-io-v1alpha1-backend
100+
failurePolicy: Fail
101+
name: vbackend-v1alpha1.kb.io
102+
rules:
103+
- apiGroups:
104+
- gateway.envoyproxy.io
105+
apiVersions:
106+
- v1alpha1
107+
operations:
108+
- CREATE
109+
- UPDATE
110+
resources:
111+
- backends
112+
sideEffects: None
113+
- admissionReviewVersions:
114+
- v1
115+
clientConfig:
116+
service:
117+
name: webhook-service
118+
namespace: system
119+
path: /validate-gateway-envoyproxy-io-v1alpha1-backendtrafficpolicy
120+
failurePolicy: Fail
121+
name: vbackendtrafficpolicy-v1alpha1.kb.io
122+
rules:
123+
- apiGroups:
124+
- gateway.envoyproxy.io
125+
apiVersions:
126+
- v1alpha1
127+
operations:
128+
- CREATE
129+
- UPDATE
130+
resources:
131+
- backendtrafficpolicies
132+
sideEffects: None
133+
- admissionReviewVersions:
134+
- v1
135+
clientConfig:
136+
service:
137+
name: webhook-service
138+
namespace: system
139+
path: /validate-gateway-envoyproxy-io-v1alpha1-httproutefilter
140+
failurePolicy: Fail
141+
name: vhttproutefilter-v1alpha1.kb.io
142+
rules:
143+
- apiGroups:
144+
- gateway.envoyproxy.io
145+
apiVersions:
146+
- v1alpha1
147+
operations:
148+
- CREATE
149+
- UPDATE
150+
resources:
151+
- httproutefilters
152+
sideEffects: None
153+
- admissionReviewVersions:
154+
- v1
155+
clientConfig:
156+
service:
157+
name: webhook-service
158+
namespace: system
159+
path: /validate-gateway-envoyproxy-io-v1alpha1-securitypolicy
160+
failurePolicy: Fail
161+
name: vsecuritypolicy-v1alpha1.kb.io
162+
rules:
163+
- apiGroups:
164+
- gateway.envoyproxy.io
165+
apiVersions:
166+
- v1alpha1
167+
operations:
168+
- CREATE
169+
- UPDATE
170+
resources:
171+
- securitypolicies
172+
sideEffects: None

‎go.mod‎

Lines changed: 36 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
module go.datum.net/network-services-operator
22

3-
go 1.24.0
4-
5-
toolchain go1.24.2
3+
go 1.24.7
64

75
require (
6+
github.com/envoyproxy/gateway v1.5.1
7+
github.com/go-logr/logr v1.4.3
88
github.com/google/go-cmp v0.7.0
99
github.com/google/uuid v1.6.0
1010
github.com/onsi/ginkgo/v2 v2.23.4
1111
github.com/onsi/gomega v1.37.0
1212
github.com/stretchr/testify v1.10.0
1313
go.miloapis.com/milo v0.1.0
14-
golang.org/x/sync v0.15.0
14+
golang.org/x/sync v0.16.0
1515
google.golang.org/protobuf v1.36.6
16-
k8s.io/api v0.33.1
17-
k8s.io/apimachinery v0.33.2
18-
k8s.io/client-go v0.33.1
16+
k8s.io/api v0.33.3
17+
k8s.io/apimachinery v0.33.3
18+
k8s.io/client-go v0.33.3
1919
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
2020
sigs.k8s.io/controller-runtime v0.21.0
21-
sigs.k8s.io/gateway-api v1.3.0
21+
sigs.k8s.io/gateway-api v1.3.1-0.20250527223622-54df0a899c1c
2222
sigs.k8s.io/multicluster-runtime v0.21.0-alpha.8
2323
)
2424

@@ -31,12 +31,11 @@ require (
3131
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3232
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
3333
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
34-
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
34+
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
3535
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
3636
github.com/felixge/httpsnoop v1.0.4 // indirect
3737
github.com/fsnotify/fsnotify v1.9.0 // indirect
3838
github.com/fxamacker/cbor/v2 v2.8.0 // indirect
39-
github.com/go-logr/logr v1.4.3 // indirect
4039
github.com/go-logr/stdr v1.2.2 // indirect
4140
github.com/go-logr/zapr v1.3.0 // indirect
4241
github.com/go-openapi/jsonpointer v0.21.1 // indirect
@@ -45,63 +44,63 @@ require (
4544
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
4645
github.com/gogo/protobuf v1.3.2 // indirect
4746
github.com/google/btree v1.1.3 // indirect
48-
github.com/google/cel-go v0.25.0 // indirect
47+
github.com/google/cel-go v0.26.0 // indirect
4948
github.com/google/gnostic-models v0.6.9 // indirect
5049
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
51-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
50+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
5251
github.com/inconshreveable/mousetrap v1.1.0 // indirect
5352
github.com/josharian/intern v1.0.0 // indirect
5453
github.com/json-iterator/go v1.1.12 // indirect
5554
github.com/mailru/easyjson v0.9.0 // indirect
5655
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
57-
github.com/modern-go/reflect2 v1.0.2 // indirect
56+
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
5857
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
5958
github.com/pkg/errors v0.9.1 // indirect
6059
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
61-
github.com/prometheus/client_golang v1.22.0 // indirect
60+
github.com/prometheus/client_golang v1.23.0 // indirect
6261
github.com/prometheus/client_model v0.6.2 // indirect
63-
github.com/prometheus/common v0.64.0 // indirect
64-
github.com/prometheus/procfs v0.16.1 // indirect
62+
github.com/prometheus/common v0.65.0 // indirect
63+
github.com/prometheus/procfs v0.17.0 // indirect
6564
github.com/spf13/cobra v1.9.1 // indirect
6665
github.com/spf13/pflag v1.0.7 // indirect
67-
github.com/stoewer/go-strcase v1.3.0 // indirect
66+
github.com/stoewer/go-strcase v1.3.1 // indirect
6867
github.com/x448/float16 v0.8.4 // indirect
6968
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
70-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
71-
go.opentelemetry.io/otel v1.35.0 // indirect
72-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
69+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
70+
go.opentelemetry.io/otel v1.37.0 // indirect
71+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
7372
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
74-
go.opentelemetry.io/otel/metric v1.35.0 // indirect
75-
go.opentelemetry.io/otel/sdk v1.35.0 // indirect
76-
go.opentelemetry.io/otel/trace v1.35.0 // indirect
77-
go.opentelemetry.io/proto/otlp v1.6.0 // indirect
73+
go.opentelemetry.io/otel/metric v1.37.0 // indirect
74+
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
75+
go.opentelemetry.io/otel/trace v1.37.0 // indirect
76+
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
7877
go.uber.org/automaxprocs v1.6.0 // indirect
7978
go.uber.org/multierr v1.11.0 // indirect
8079
go.uber.org/zap v1.27.0 // indirect
8180
go.yaml.in/yaml/v2 v2.4.2 // indirect
82-
golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
83-
golang.org/x/net v0.41.0 // indirect
81+
golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
82+
golang.org/x/net v0.42.0 // indirect
8483
golang.org/x/oauth2 v0.30.0 // indirect
85-
golang.org/x/sys v0.33.0 // indirect
86-
golang.org/x/term v0.32.0 // indirect
87-
golang.org/x/text v0.26.0 // indirect
84+
golang.org/x/sys v0.34.0 // indirect
85+
golang.org/x/term v0.33.0 // indirect
86+
golang.org/x/text v0.27.0 // indirect
8887
golang.org/x/time v0.12.0 // indirect
89-
golang.org/x/tools v0.33.0 // indirect
88+
golang.org/x/tools v0.35.0 // indirect
9089
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
91-
google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 // indirect
92-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
93-
google.golang.org/grpc v1.72.1 // indirect
90+
google.golang.org/genproto/googleapis/api v0.0.0-20250728155136-f173205681a0 // indirect
91+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 // indirect
92+
google.golang.org/grpc v1.74.2 // indirect
9493
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
9594
gopkg.in/inf.v0 v0.9.1 // indirect
9695
gopkg.in/yaml.v3 v3.0.1 // indirect
97-
k8s.io/apiextensions-apiserver v0.33.1 // indirect
98-
k8s.io/apiserver v0.33.1 // indirect
99-
k8s.io/component-base v0.33.1 // indirect
96+
k8s.io/apiextensions-apiserver v0.33.3 // indirect
97+
k8s.io/apiserver v0.33.3 // indirect
98+
k8s.io/component-base v0.33.3 // indirect
10099
k8s.io/klog/v2 v2.130.1 // indirect
101100
k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a // indirect
102101
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
103102
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
104103
sigs.k8s.io/randfill v1.0.0 // indirect
105104
sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
106-
sigs.k8s.io/yaml v1.5.0 // indirect
105+
sigs.k8s.io/yaml v1.6.0 // indirect
107106
)

0 commit comments

Comments
 (0)