Skip to content

Commit 5a0b04d

Browse files
zirainzirain
committed
don't patch default resources
Signed-off-by: zirain <zirain2009@gmail.com>
1 parent 33e7345 commit 5a0b04d

10 files changed

Lines changed: 181 additions & 57 deletions

‎internal/xds/translator/jsonpatch.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func (t typedName) String() string {
3636
}
3737

3838
// processJSONPatches applies each JSONPatch to the Xds Resources for a specific type.
39-
func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []*ir.EnvoyPatchPolicy) error {
39+
func processJSONPatches(tCtx *types.ResourceVersionTable, gResources *ir.GlobalResources, envoyPatchPolicies []*ir.EnvoyPatchPolicy) error {
4040
var errs error
4141

4242
for _, e := range envoyPatchPolicies {
@@ -96,7 +96,7 @@ func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []*
9696
}
9797

9898
// find the resources to patch and convert them to JSON
99-
dests, err = findXdsResources(tCtx, p)
99+
dests, err = findXdsResources(tCtx, gResources, p)
100100
if err != nil {
101101
tErrs = errors.Join(tErrs, err)
102102
continue
@@ -217,19 +217,19 @@ var jsonMarshalOpts = protojson.MarshalOptions{
217217
// findXdsResources returns XDS resources to patch based on the patch configuration.
218218
// If p.Name is empty, all resources of the specified type are returned.
219219
// If p.Name is specified, only resources with matching names are returned.
220-
func findXdsResources(tCtx *types.ResourceVersionTable, p *ir.JSONPatchConfig) ([]cachetypes.Resource, error) {
220+
func findXdsResources(tCtx *types.ResourceVersionTable, gResources *ir.GlobalResources, p *ir.JSONPatchConfig) ([]cachetypes.Resource, error) {
221221
var resources []cachetypes.Resource
222222
switch p.Type {
223223
case resourcev3.ListenerType:
224224
resources = findXdsListeners(tCtx, p.Name)
225225
case resourcev3.RouteType:
226226
resources = findXdsRouteConfigs(tCtx, p.Name)
227227
case resourcev3.ClusterType:
228-
resources = findXdsClusters(tCtx, p.Name)
228+
resources = findXdsClusters(tCtx, gResources, p.Name)
229229
case resourcev3.EndpointType:
230230
resources = findXdsEndpoints(tCtx, p.Name)
231231
case resourcev3.SecretType:
232-
resources = findXdsSecrets(tCtx, p.Name)
232+
resources = findXdsSecrets(tCtx, gResources, p.Name)
233233
default:
234234
return nil, fmt.Errorf("unsupported patch type %s", p.Type)
235235
}

‎internal/xds/translator/listener_ready.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ import (
2121
"github.com/envoyproxy/gateway/internal/xds/filters"
2222
)
2323

24+
const (
25+
readyListenerPrefix = "envoy-gateway-proxy-ready"
26+
readyRouteName = "ready_route"
27+
)
28+
2429
func buildReadyListener(ready *ir.ReadyListener) (*listenerv3.Listener, error) {
2530
ipv4Compact := ready.IPFamily == egv1a1.IPv6 || ready.IPFamily == egv1a1.DualStack
2631

@@ -41,10 +46,10 @@ func buildReadyListener(ready *ir.ReadyListener) (*listenerv3.Listener, error) {
4146
StatPrefix: "eg-ready-http",
4247
RouteSpecifier: &hcmv3.HttpConnectionManager_RouteConfig{
4348
RouteConfig: &routev3.RouteConfiguration{
44-
Name: "ready_route",
49+
Name: readyRouteName,
4550
VirtualHosts: []*routev3.VirtualHost{
4651
{
47-
Name: "ready_route",
52+
Name: readyRouteName,
4853
Domains: []string{"*"},
4954
Routes: []*routev3.Route{
5055
{
@@ -73,7 +78,7 @@ func buildReadyListener(ready *ir.ReadyListener) (*listenerv3.Listener, error) {
7378
}
7479

7580
return &listenerv3.Listener{
76-
Name: fmt.Sprintf("envoy-gateway-proxy-ready-%s-%d", ready.Address, ready.Port),
81+
Name: fmt.Sprintf("%s-%s-%d", readyListenerPrefix, ready.Address, ready.Port),
7782
Address: &corev3.Address{
7883
Address: &corev3.Address_SocketAddress{
7984
SocketAddress: &corev3.SocketAddress{

‎internal/xds/translator/testdata/in/xds-ir/jsonpatch-patch-multiple-resources.yaml‎

Lines changed: 38 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ envoyPatchPolicies:
44
- ancestorRef:
55
group: "gateway.networking.k8s.io"
66
kind: "Gateway"
7-
namespace: "default"
8-
name: "foobar"
7+
namespace: "envoy-gateway"
8+
name: "gateway-1"
99
name: "first-policy"
1010
namespace: "default"
1111
jsonPatches:
@@ -41,37 +41,24 @@ envoyPatchPolicies:
4141
- actions:
4242
- remote_address: {}
4343
- type: "type.googleapis.com/envoy.config.cluster.v3.Cluster"
44-
name: rate-limit-cluster
44+
name: ""
4545
operation:
4646
op: add
47-
path: ""
48-
value:
49-
name: rate-limit-cluster
50-
type: STRICT_DNS
51-
connect_timeout: 10s
52-
lb_policy: ROUND_ROBIN
53-
http2_protocol_options: {}
54-
load_assignment:
55-
cluster_name: rate-limit-cluster
56-
endpoints:
57-
- lb_endpoints:
58-
- endpoint:
59-
address:
60-
socket_address:
61-
address: ratelimit.svc.cluster.local
62-
port_value: 8081
47+
path: "/altStatName"
48+
value: altStatName
6349
- type: "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"
6450
name: "first-route-dest"
6551
operation:
6652
op: "replace"
6753
path: "/endpoints/0/load_balancing_weight"
6854
value: "50"
6955
- type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
70-
name: "secret-1"
56+
name: ""
7157
operation:
7258
op: "replace"
7359
path: "/tls_certificate/certificate_chain/inline_bytes"
74-
value: "a2V5LWRhdGE="
60+
# replaced-secret
61+
value: "cmVwbGFjZWQtc2VjcmV0"
7562
- type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
7663
name: "test-secret"
7764
operation:
@@ -163,3 +150,33 @@ http:
163150
- host: "1.2.3.4"
164151
port: 50000
165152
name: "second-route-dest/backend/0"
153+
readyListener:
154+
address: 0.0.0.0
155+
ipFamily: IPv4
156+
path: /ready
157+
port: 19001
158+
globalResources:
159+
envoyClientCertificate:
160+
certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
161+
name: envoy-gateway-system/envoy
162+
privateKey: "[redacted]"
163+
proxyServiceCluster:
164+
metadata:
165+
kind: Service
166+
name: envoy-envoy-gateway-gateway-1-196ae069
167+
namespace: envoy-gateway-system
168+
sectionName: "8080"
169+
name: envoy-gateway/gateway-1
170+
settings:
171+
- addressType: IP
172+
endpoints:
173+
- host: 7.6.5.4
174+
port: 8080
175+
zone: zone1
176+
metadata:
177+
kind: Service
178+
name: envoy-envoy-gateway-gateway-1-196ae069
179+
namespace: envoy-gateway-system
180+
sectionName: "8080"
181+
name: envoy-gateway/gateway-1
182+
protocol: TCP

‎internal/xds/translator/testdata/out/xds-ir/jsonpatch-patch-multiple-resources.clusters.yaml‎

Lines changed: 37 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
- circuitBreakers:
1+
- altStatName: altStatName
2+
circuitBreakers:
23
thresholds:
34
- maxRetries: 1024
45
commonLbConfig: {}
@@ -22,7 +23,8 @@
2223
name: first-route-dest
2324
perConnectionBufferLimitBytes: 32768
2425
type: EDS
25-
- circuitBreakers:
26+
- altStatName: altStatName
27+
circuitBreakers:
2628
thresholds:
2729
- maxRetries: 1024
2830
commonLbConfig: {}
@@ -46,16 +48,36 @@
4648
name: second-route-dest
4749
perConnectionBufferLimitBytes: 32768
4850
type: EDS
49-
- connectTimeout: 10s
50-
http2ProtocolOptions: {}
51-
loadAssignment:
52-
clusterName: rate-limit-cluster
53-
endpoints:
54-
- lbEndpoints:
55-
- endpoint:
56-
address:
57-
socketAddress:
58-
address: ratelimit.svc.cluster.local
59-
portValue: 8081
60-
name: rate-limit-cluster
61-
type: STRICT_DNS
51+
- circuitBreakers:
52+
thresholds:
53+
- maxRetries: 1024
54+
commonLbConfig: {}
55+
connectTimeout: 10s
56+
dnsLookupFamily: V4_PREFERRED
57+
edsClusterConfig:
58+
edsConfig:
59+
ads: {}
60+
resourceApiVersion: V3
61+
serviceName: envoy-gateway/gateway-1
62+
ignoreHealthOnHostRemoval: true
63+
lbPolicy: LEAST_REQUEST
64+
loadBalancingPolicy:
65+
policies:
66+
- typedExtensionConfig:
67+
name: envoy.load_balancing_policies.least_request
68+
typedConfig:
69+
'@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
70+
localityLbConfig:
71+
zoneAwareLbConfig:
72+
minClusterSize: "1"
73+
metadata:
74+
filterMetadata:
75+
envoy-gateway:
76+
resources:
77+
- kind: Service
78+
name: envoy-envoy-gateway-gateway-1-196ae069
79+
namespace: envoy-gateway-system
80+
sectionName: "8080"
81+
name: envoy-gateway/gateway-1
82+
perConnectionBufferLimitBytes: 32768
83+
type: EDS

‎internal/xds/translator/testdata/out/xds-ir/jsonpatch-patch-multiple-resources.endpoints.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,22 @@
3030
loadBalancingWeight: 1
3131
locality:
3232
region: second-route-dest/backend/0
33+
- clusterName: envoy-gateway/gateway-1
34+
endpoints:
35+
- lbEndpoints:
36+
- endpoint:
37+
address:
38+
socketAddress:
39+
address: 7.6.5.4
40+
portValue: 8080
41+
loadBalancingWeight: 1
42+
locality:
43+
zone: zone1
44+
metadata:
45+
filterMetadata:
46+
envoy-gateway:
47+
resources:
48+
- kind: Service
49+
name: envoy-envoy-gateway-gateway-1-196ae069
50+
namespace: envoy-gateway-system
51+
sectionName: "8080"

‎internal/xds/translator/testdata/out/xds-ir/jsonpatch-patch-multiple-resources.envoypatchpolicies.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
- ancestorRef:
66
group: gateway.networking.k8s.io
77
kind: Gateway
8-
name: foobar
9-
namespace: default
8+
name: gateway-1
9+
namespace: envoy-gateway
1010
conditions:
1111
- lastTransitionTime: null
1212
message: Patches have been successfully applied.

‎internal/xds/translator/testdata/out/xds-ir/jsonpatch-patch-multiple-resources.listeners.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,39 @@
1+
- address:
2+
socketAddress:
3+
address: 0.0.0.0
4+
portValue: 19001
5+
bypassOverloadManager: true
6+
filterChains:
7+
- filters:
8+
- name: envoy.filters.network.http_connection_manager
9+
typedConfig:
10+
'@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
11+
httpFilters:
12+
- name: envoy.filters.http.health_check
13+
typedConfig:
14+
'@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
15+
headers:
16+
- name: :path
17+
stringMatch:
18+
exact: /ready
19+
passThroughMode: false
20+
- name: envoy.filters.http.router
21+
typedConfig:
22+
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
23+
suppressEnvoyHeaders: true
24+
routeConfig:
25+
name: ready_route
26+
virtualHosts:
27+
- domains:
28+
- '*'
29+
name: ready_route
30+
routes:
31+
- directResponse:
32+
status: 500
33+
match:
34+
prefix: /
35+
statPrefix: eg-ready-http
36+
name: envoy-gateway-proxy-ready-0.0.0.0-19001
137
- address:
238
socketAddress:
339
address: 0.0.0.0

‎internal/xds/translator/testdata/out/xds-ir/jsonpatch-patch-multiple-resources.secrets.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,21 @@
11
- name: secret-1
22
tlsCertificate:
33
certificateChain:
4-
inlineBytes: a2V5LWRhdGE=
4+
inlineBytes: cmVwbGFjZWQtc2VjcmV0
55
privateKey:
66
inlineBytes: a2V5LWRhdGE=
77
- name: secret-2
88
tlsCertificate:
99
certificateChain:
10-
inlineBytes: Y2VydC1kYXRh
10+
inlineBytes: cmVwbGFjZWQtc2VjcmV0
1111
privateKey:
1212
inlineBytes: a2V5LWRhdGE=
13+
- name: envoy-gateway-system/envoy
14+
tlsCertificate:
15+
certificateChain:
16+
inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
17+
privateKey:
18+
inlineBytes: W3JlZGFjdGVkXQ==
1319
- name: test_secret
1420
tlsCertificate:
1521
certificateChain:

0 commit comments

Comments
 (0)