diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go index ff00af355e..742349e253 100644 --- a/api/v1alpha1/envoyproxy_types.go +++ b/api/v1alpha1/envoyproxy_types.go @@ -216,6 +216,19 @@ type EnvoyProxySpec struct { // +kubebuilder:validation:Enum=Replace;StrategicMerge;JSONMerge // +optional MergeType *MergeType `json:"mergeType,omitempty"` + // SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + // and controls how Envoy proxies fetch secrets from the control plane. + // + // +optional + SDSConfig *SDSConfig `json:"sdsConfig,omitempty"` +} + +type SDSConfig struct { + // AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + // If unspecified, it allows reading SDS settings from a secret in any namespace. + // + // +optional + AllowedNamespaces *metav1.LabelSelector `json:"allowedNamespaces,omitempty"` } // EnvoyProxyGeoIP defines shared GeoIP provider settings for EnvoyProxy. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index ff395861b1..1bfcfd0eab 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -3267,6 +3267,11 @@ func (in *EnvoyProxySpec) DeepCopyInto(out *EnvoyProxySpec) { *out = new(MergeType) **out = **in } + if in.SDSConfig != nil { + in, out := &in.SDSConfig, &out.SDSConfig + *out = new(SDSConfig) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxySpec. @@ -7732,6 +7737,26 @@ func (in *RuntimeFlags) DeepCopy() *RuntimeFlags { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SDSConfig) DeepCopyInto(out *SDSConfig) { + *out = *in + if in.AllowedNamespaces != nil { + in, out := &in.AllowedNamespaces, &out.AllowedNamespaces + *out = new(metav1.LabelSelector) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SDSConfig. +func (in *SDSConfig) DeepCopy() *SDSConfig { + if in == nil { + return nil + } + out := new(SDSConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretTranslationConfig) DeepCopyInto(out *SecretTranslationConfig) { *out = *in diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml index 8b19d5b1b0..5e80209e2d 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -11253,6 +11253,60 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + sdsConfig: + description: |- + SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + and controls how Envoy proxies fetch secrets from the control plane. + properties: + allowedNamespaces: + description: |- + AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + If unspecified, it allows reading SDS settings from a secret in any namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml index 58f11213f9..4b14d47d9e 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -11252,6 +11252,60 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + sdsConfig: + description: |- + SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + and controls how Envoy proxies fetch secrets from the control plane. + properties: + allowedNamespaces: + description: |- + AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + If unspecified, it allows reading SDS settings from a secret in any namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go index f70c5d9443..e23ae592c6 100644 --- a/internal/gatewayapi/backendtlspolicy.go +++ b/internal/gatewayapi/backendtlspolicy.go @@ -11,6 +11,7 @@ import ( "reflect" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/types" "k8s.io/utils/ptr" gwapiv1 "sigs.k8s.io/gateway-api/apis/v1" @@ -97,6 +98,11 @@ func (t *Translator) applyBackendTLSSetting( err error ) + var envoyproxy *egv1a1.EnvoyProxy + if gtwCtx != nil { + envoyproxy = gtwCtx.envoyProxy + } + // If the backendRef is a Backend resource, we need to check if it has TLS settings. if KindDerefOr(backendRef.Kind, resource.KindService) == egv1a1.KindBackend { backend := t.GetBackend(backendNamespace, string(backendRef.Name)) @@ -105,14 +111,15 @@ func (t *Translator) applyBackendTLSSetting( } if backend.Spec.TLS != nil { // Get the server certificate validation settings from Backend resource. - if backendValidationTLSConfig, err = t.processServerValidationTLSSettings(backend); err != nil { + if backendValidationTLSConfig, err = t.processServerValidationTLSSettings(envoyproxy, backend); err != nil { return nil, err } // Get the client certificate and common TLS settings from Backend resource. if backend.Spec.TLS.BackendTLSConfig != nil { if backendClientTLSConfig, err = t.processClientTLSSettings( - backend.Spec.TLS.BackendTLSConfig, &ResourceMetadata{ + envoyproxy, backend.Spec.TLS.BackendTLSConfig, + &ResourceMetadata{ Name: backend.Name, Namespace: backend.Namespace, Kind: egv1a1.KindBackend, @@ -124,7 +131,7 @@ func (t *Translator) applyBackendTLSSetting( } // Get the backend certificate validation settings from BackendTLSPolicy. - if btpValidationTLSConfig, err = t.processBackendTLSPolicy(backendRef, backendNamespace, parent, resources); err != nil { + if btpValidationTLSConfig, err = t.processBackendTLSPolicy(envoyproxy, backendRef, backendNamespace, parent, resources); err != nil { return nil, err } @@ -144,7 +151,7 @@ func (t *Translator) applyBackendTLSSetting( // Get the client certificate and common TLS settings from EnvoyProxy resource. if gtwBackendTLSConfig, owner := gtwCtx.GetBackendTLSConfig(); gtwBackendTLSConfig != nil { if envoyProxyClientTLSConfig, err = t.processClientTLSSettings( - gtwBackendTLSConfig, owner); err != nil { + envoyproxy, gtwBackendTLSConfig, owner); err != nil { return nil, err } } @@ -250,6 +257,7 @@ func mergeClientTLSConfigs( } func (t *Translator) processServerValidationTLSSettings( + envoyproxy *egv1a1.EnvoyProxy, backend *egv1a1.Backend, ) (*ir.TLSUpstreamConfig, error) { tlsConfig := &ir.TLSUpstreamConfig{ @@ -269,7 +277,7 @@ func (t *Translator) processServerValidationTLSSettings( } else if len(backend.Spec.TLS.CACertificateRefs) > 0 { caRefs := getObjectReferences(gwapiv1.Namespace(backend.Namespace), backend.Spec.TLS.CACertificateRefs) // Backend doesn't allow cross-namespace reference, so pass nil resources here. - caCert, sds, err := t.getCaCertsFromCARefs(nil, caRefs, resource.ResourceMetadata{ + caCert, sds, err := t.getCaCertsFromCARefs(nil, envoyproxy, caRefs, resource.ResourceMetadata{ Name: backend.Name, Namespace: backend.Namespace, Kind: resource.KindBackendTLSPolicy, @@ -289,6 +297,7 @@ func (t *Translator) processServerValidationTLSSettings( } func (t *Translator) processBackendTLSPolicy( + envoyproxy *egv1a1.EnvoyProxy, backendRef gwapiv1.BackendObjectReference, backendNamespace string, parent gwapiv1.ParentReference, @@ -299,7 +308,7 @@ func (t *Translator) processBackendTLSPolicy( return nil, nil } - tlsBundle, err := t.getBackendTLSBundle(policy) + tlsBundle, err := t.getBackendTLSBundle(envoyproxy, policy) ancestorRefs := getAncestorRefs(policy) ancestorRefs = append(ancestorRefs, &parent) @@ -351,6 +360,7 @@ func (t *Translator) processBackendTLSPolicy( } func (t *Translator) processClientTLSSettings( + envoyproxy *egv1a1.EnvoyProxy, clientTLS *egv1a1.BackendTLSConfig, owner *ResourceMetadata, ) (*ir.TLSConfig, error) { @@ -406,8 +416,8 @@ func (t *Translator) processClientTLSSettings( } // Check if this is an SDS reference secret if secret.Type == egv1a1.SDSSecretType { - if !t.SDSSecretRefEnabled { - return tlsConfig, fmt.Errorf("SDS Secret reference is not enabled in EnvoyGateway configuration") + if err := t.validateSDSRef(envoyproxy, secret.Namespace); err != nil { + return tlsConfig, err } // For SDS reference secrets, extract the SDS secret name and URL from data s, err := ir.NewSDSConfig(secret) @@ -428,6 +438,35 @@ func (t *Translator) processClientTLSSettings( return tlsConfig, nil } +func (t *Translator) validateSDSRef(ep *egv1a1.EnvoyProxy, ns string) error { + if !t.SDSSecretRefEnabled { + return fmt.Errorf("SDS Secret reference is not enabled in EnvoyGateway configuration") + } + + // Empty namespaces selector means all namespaces are allowed + if ep == nil || ep.Spec.SDSConfig == nil || ep.Spec.SDSConfig.AllowedNamespaces == nil { + return nil + } + + secretNs := t.GetNamespace(ns) + if secretNs == nil { + // this should not happen, just in case. + return fmt.Errorf("namespace %s not found for SDS Secret reference", ns) + } + + sdsSelector := ep.Spec.SDSConfig.AllowedNamespaces + selector, err := metav1.LabelSelectorAsSelector(sdsSelector) + if err != nil { + return fmt.Errorf("invalid AllowedNamespaces for SDS Secret reference: %w", err) + } + + if !selector.Matches(labels.Set(secretNs.Labels)) { + return fmt.Errorf("SDS Secret reference is not allowed in namespace: %s", secretNs.Name) + } + + return nil +} + func backendTLSTargetMatched(policy *gwapiv1.BackendTLSPolicy, target gwapiv1.LocalPolicyTargetReferenceWithSectionName, backendNamespace string) bool { for _, currTarget := range policy.Spec.TargetRefs { if target.Group == currTarget.Group && @@ -460,7 +499,7 @@ func (t *Translator) getBackendTLSPolicy( return nil } -func (t *Translator) getBackendTLSBundle(backendTLSPolicy *gwapiv1.BackendTLSPolicy) (*ir.TLSUpstreamConfig, error) { +func (t *Translator) getBackendTLSBundle(envoyproxy *egv1a1.EnvoyProxy, backendTLSPolicy *gwapiv1.BackendTLSPolicy) (*ir.TLSUpstreamConfig, error) { // Translate SubjectAltNames from gwapiv1a3 to ir subjectAltNames := make([]ir.SubjectAltName, 0, len(backendTLSPolicy.Spec.Validation.SubjectAltNames)) for _, san := range backendTLSPolicy.Spec.Validation.SubjectAltNames { @@ -491,7 +530,7 @@ func (t *Translator) getBackendTLSBundle(backendTLSPolicy *gwapiv1.BackendTLSPol caRefs := getObjectReferences(gwapiv1.Namespace(backendTLSPolicy.Namespace), backendTLSPolicy.Spec.Validation.CACertificateRefs) // BackendTLSPolicy doesn't allow cross-namespace reference, // so pass nil resources here - caCert, sds, err := t.getCaCertsFromCARefs(nil, caRefs, resource.ResourceMetadata{ + caCert, sds, err := t.getCaCertsFromCARefs(nil, envoyproxy, caRefs, resource.ResourceMetadata{ Group: egv1a1.GroupName, Name: backendTLSPolicy.Name, Namespace: backendTLSPolicy.Namespace, @@ -525,7 +564,8 @@ func getObjectReferences(ns gwapiv1.Namespace, refs []gwapiv1.LocalObjectReferen // getCaCertsFromCARefs retrieves CA certificates from the given CA refs. It supports ConfigMap, Secret, and ClusterTrustBundle kinds. // TODO: move out of backendtlspolicy.go -func (t *Translator) getCaCertsFromCARefs(resources *resource.Resources, caCertificates []gwapiv1.ObjectReference, meta resource.ResourceMetadata, +func (t *Translator) getCaCertsFromCARefs(resources *resource.Resources, envoyproxy *egv1a1.EnvoyProxy, + caCertificates []gwapiv1.ObjectReference, meta resource.ResourceMetadata, ) (caCert []byte, sds *ir.SDSConfig, err error) { ca := "" foundSupportedRef := false @@ -581,8 +621,8 @@ func (t *Translator) getCaCertsFromCARefs(resources *resource.Resources, caCerti if secret != nil { // Check if this is an SDS reference secret if secret.Type == egv1a1.SDSSecretType { - if !t.SDSSecretRefEnabled { - return nil, nil, fmt.Errorf("SDS Secret reference is not enabled in EnvoyGateway configuration") + if err := t.validateSDSRef(envoyproxy, secret.Namespace); err != nil { + return nil, nil, err } if foundSDSConfig != nil { return nil, nil, fmt.Errorf("multiple SDS reference secrets are not supported") diff --git a/internal/gatewayapi/listener.go b/internal/gatewayapi/listener.go index a7bbc26957..2cc91a967a 100644 --- a/internal/gatewayapi/listener.go +++ b/internal/gatewayapi/listener.go @@ -51,7 +51,7 @@ func (t *Translator) ProcessGatewayTLS(gateways []*GatewayContext, resources *re gtwDefaultFrontendTLSValidation := gtw.Spec.TLS.Frontend.Default allowInsecureFallback := false if gtwDefaultFrontendTLSValidation.Validation != nil { - caCert, sds, err := t.getCaCertsFromCARefs(resources, gtwDefaultFrontendTLSValidation.Validation.CACertificateRefs, resource.ResourceMetadata{ + caCert, sds, err := t.getCaCertsFromCARefs(resources, gtw.envoyProxy, gtwDefaultFrontendTLSValidation.Validation.CACertificateRefs, resource.ResourceMetadata{ Group: gwapiv1.GroupVersion.Group, Kind: resource.KindGateway, Name: gtw.Name, @@ -88,7 +88,7 @@ func (t *Translator) ProcessGatewayTLS(gateways []*GatewayContext, resources *re gtwPerPortCaCertificate[portValidation.Port] = nil continue } - caCert, sds, err := t.getCaCertsFromCARefs(resources, portValidation.TLS.Validation.CACertificateRefs, resource.ResourceMetadata{ + caCert, sds, err := t.getCaCertsFromCARefs(resources, gtw.envoyProxy, portValidation.TLS.Validation.CACertificateRefs, resource.ResourceMetadata{ Group: gwapiv1.GroupVersion.Group, Kind: resource.KindGateway, Name: gtw.Name, diff --git a/internal/gatewayapi/listener_test.go b/internal/gatewayapi/listener_test.go index 40094dfa6b..bf463715f5 100644 --- a/internal/gatewayapi/listener_test.go +++ b/internal/gatewayapi/listener_test.go @@ -1225,7 +1225,7 @@ func TestProcessServerValidationTLSSettings(t *testing.T) { for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { translator := &Translator{} - actual, err := translator.processServerValidationTLSSettings(tc.input) + actual, err := translator.processServerValidationTLSSettings(nil, tc.input) require.NoError(t, err) require.Equal(t, tc.expected, actual) }) diff --git a/internal/gatewayapi/testdata/sds-with-selector.in.yaml b/internal/gatewayapi/testdata/sds-with-selector.in.yaml new file mode 100644 index 0000000000..78b137da5b --- /dev/null +++ b/internal/gatewayapi/testdata/sds-with-selector.in.yaml @@ -0,0 +1,212 @@ +namespaces: + - apiVersion: v1 + kind: Namespace + metadata: + name: sds-allowed + labels: + sds: allowed +envoyProxyForGatewayClass: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + namespace: envoy-gateway-system + name: test + spec: + backendTLS: + clientCertificateRef: + kind: Secret + name: sds-client-cert-default + alpnProtocols: + # without this, need to enforce mTLS with PeerAuthentication + - istio + sdsConfig: + allowedNamespaces: + matchLabels: + sds: allowed +envoyProxiesForGateways: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + namespace: sds-allowed + name: proxy-config + spec: + backendTLS: + clientCertificateRef: + kind: Secret + name: sds-client-cert-default + alpnProtocols: + # without this, need to enforce mTLS with PeerAuthentication + - istio + sdsConfig: + allowedNamespaces: + matchLabels: + sds: allowed +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: envoy-gateway + name: gateway-1 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: sds-allowed + name: gateway-2 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All + infrastructure: + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: proxy-config +backendTLSPolicies: + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls + namespace: default + spec: + targetRefs: + - kind: Service + name: service-1 + validation: + caCertificateRefs: + - name: sds-client-cert-rootca + kind: Secret + hostname: example.com + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls + namespace: sds-allowed + spec: + targetRefs: + - kind: Backend + name: backend-fqdn + validation: + caCertificateRefs: + - name: sds-client-cert-rootca + kind: Secret + hostname: primary.foo.com +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: sds-allowed + spec: + endpoints: + - fqdn: + hostname: primary.foo.com + port: 3000 +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-1 + namespace: default + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + type: Exact + value: "/exact" + backendRefs: + - name: service-1 + port: 8080 + # This route is invalid because the client SDS is not allowed. + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-2 + namespace: sds-allowed + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-1 + sectionName: http + rules: + - backendRefs: + - name: backend-fqdn + kind: Backend + port: 3000 + # This route is valid because the client SDS is allowed in sds-allowed namespace. + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-3 + namespace: sds-allowed + spec: + parentRefs: + - name: gateway-2 + sectionName: http + rules: + - backendRefs: + - name: backend-fqdn + kind: Backend + port: 3000 +secrets: + - apiVersion: v1 + kind: Secret + metadata: + name: sds-client-cert-default + namespace: envoy-gateway-system + type: gateway.envoyproxy.io/sds + data: + # /var/run/secrets/workload-spiffe-uds/socket + url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA== + # base64 for "default" + secretName: ZGVmYXVsdA== + - apiVersion: v1 + kind: Secret + metadata: + name: sds-client-cert-rootca + namespace: default + type: gateway.envoyproxy.io/sds + data: + # /var/run/secrets/workload-spiffe-uds/socket + url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA== + # base64 for "ROOTCA" + secretName: Uk9PVENB + - apiVersion: v1 + kind: Secret + metadata: + name: sds-client-cert-default + namespace: sds-allowed + type: gateway.envoyproxy.io/sds + data: + # /var/run/secrets/workload-spiffe-uds/socket + url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA== + # base64 for "default" + secretName: ZGVmYXVsdA== + - apiVersion: v1 + kind: Secret + metadata: + name: sds-client-cert-rootca + namespace: sds-allowed + type: gateway.envoyproxy.io/sds + data: + # /var/run/secrets/workload-spiffe-uds/socket + url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA== + # base64 for "ROOTCA" + secretName: Uk9PVENB diff --git a/internal/gatewayapi/testdata/sds-with-selector.out.yaml b/internal/gatewayapi/testdata/sds-with-selector.out.yaml new file mode 100644 index 0000000000..45ba88e524 --- /dev/null +++ b/internal/gatewayapi/testdata/sds-with-selector.out.yaml @@ -0,0 +1,518 @@ +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls + namespace: default + spec: + targetRefs: + - group: "" + kind: Service + name: service-1 + validation: + caCertificateRefs: + - group: "" + kind: Secret + name: sds-client-cert-rootca + hostname: example.com + status: + ancestors: + - ancestorRef: + name: gateway-1 + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: 'SDS Secret reference is not allowed in namespace: default.' + reason: NoValidCACertificate + status: "False" + type: Accepted + - lastTransitionTime: null + message: 'SDS Secret reference is not allowed in namespace: default.' + reason: InvalidCACertificateRef + status: "False" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls + namespace: sds-allowed + spec: + targetRefs: + - group: "" + kind: Backend + name: backend-fqdn + validation: + caCertificateRefs: + - group: "" + kind: Secret + name: sds-client-cert-rootca + hostname: primary.foo.com + status: + ancestors: + - ancestorRef: + name: gateway-1 + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller + - ancestorRef: + name: gateway-2 + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: sds-allowed + spec: + endpoints: + - fqdn: + hostname: primary.foo.com + port: 3000 + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-1 + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 2 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-2 + namespace: sds-allowed + spec: + gatewayClassName: envoy-gateway-class + infrastructure: + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: proxy-config + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-1 + namespace: default + spec: + parentRefs: + - name: gateway-1 + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + type: Exact + value: /exact + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: 'Failed to process route rule 0 backendRef 0: SDS Secret reference + is not allowed in namespace: default.' + reason: InvalidBackendTLS + status: "False" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: envoy-gateway + sectionName: http +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-2 + namespace: sds-allowed + spec: + parentRefs: + - name: gateway-1 + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - kind: Backend + name: backend-fqdn + port: 3000 + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: 'Failed to process route rule 0 backendRef 0: namespace envoy-gateway-system + not found for SDS Secret reference.' + reason: InvalidBackendTLS + status: "False" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: envoy-gateway + sectionName: http +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-3 + namespace: sds-allowed + spec: + parentRefs: + - name: gateway-2 + sectionName: http + rules: + - backendRefs: + - kind: Backend + name: backend-fqdn + port: 3000 + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-2 + sectionName: http +infraIR: + envoy-gateway/gateway-1: + proxy: + config: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + name: test + namespace: envoy-gateway-system + spec: + backendTLS: + alpnProtocols: + - istio + clientCertificateRef: + kind: Secret + name: sds-client-cert-default + logging: {} + sdsConfig: + allowedNamespaces: + matchLabels: + sds: allowed + status: {} + listeners: + - name: envoy-gateway/gateway-1/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-1 + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-1 + namespace: envoy-gateway-system + sds-allowed/gateway-2: + proxy: + config: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + name: proxy-config + namespace: sds-allowed + spec: + backendTLS: + alpnProtocols: + - istio + clientCertificateRef: + kind: Secret + name: sds-client-cert-default + logging: {} + sdsConfig: + allowedNamespaces: + matchLabels: + sds: allowed + status: {} + listeners: + - name: sds-allowed/gateway-2/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-2 + gateway.envoyproxy.io/owning-gateway-namespace: sds-allowed + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: sds-allowed/gateway-2 + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-1: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - directResponse: + statusCode: 500 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" + - directResponse: + statusCode: 500 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-2 + namespace: sds-allowed + name: httproute/sds-allowed/httproute-2/rule/0/match/-1/* + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 + sds-allowed/gateway-2: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-sds-allowed-gateway-2-87fc41cd + namespace: envoy-gateway-system + sectionName: "8080" + name: sds-allowed/gateway-2 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-sds-allowed-gateway-2-87fc41cd + namespace: envoy-gateway-system + sectionName: "8080" + name: sds-allowed/gateway-2 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-2 + namespace: sds-allowed + sectionName: http + name: sds-allowed/gateway-2/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-3 + namespace: sds-allowed + name: httproute/sds-allowed/httproute-3/rule/0 + settings: + - addressType: FQDN + endpoints: + - host: primary.foo.com + port: 3000 + metadata: + kind: Backend + name: backend-fqdn + namespace: sds-allowed + name: httproute/sds-allowed/httproute-3/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: + - istio + caCertificate: + name: policy-btls/sds-allowed-ca + sds: + secretName: ROOTCA + url: /var/run/secrets/workload-spiffe-uds/socket + clientCertificates: + - name: "" + sds: + secretName: default + url: /var/run/secrets/workload-spiffe-uds/socket + sni: primary.foo.com + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-3 + namespace: sds-allowed + name: httproute/sds-allowed/httproute-3/rule/0/match/-1/* + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go index 4e56d762a8..74793ada2f 100644 --- a/internal/gatewayapi/translator_test.go +++ b/internal/gatewayapi/translator_test.go @@ -93,6 +93,11 @@ func TestTranslate(t *testing.T) { BackendEnabled: true, SDSEnabled: true, }, + { + name: "sds-with-selector", + BackendEnabled: true, + SDSEnabled: true, + }, } inputFiles, err := filepath.Glob(filepath.Join("testdata", "*.in.yaml")) diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 130bddae4d..c6d1ec59ba 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -2228,6 +2228,7 @@ _Appears in:_ | `dynamicModules` | _[DynamicModuleEntry](#dynamicmoduleentry) array_ | false | | DynamicModules defines the set of dynamic modules that are allowed to be
used by EnvoyExtensionPolicy resources and dynamic module load balancer
policies. Each entry registers a module by a logical name and specifies
the shared library that Envoy will load.
The EnvoyProxy owner is responsible for ensuring the module .so files are available
on the proxy container's filesystem (e.g., via init containers, custom images,
or shared volumes). | | `geoIP` | _[EnvoyProxyGeoIP](#envoyproxygeoip)_ | false | | GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet. | | `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType controls how this EnvoyProxy merges with less specific configurations
in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway).
If unset, this EnvoyProxy completely replaces less specific settings.
Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. | +| `sdsConfig` | _[SDSConfig](#sdsconfig)_ | false | | SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS)
and controls how Envoy proxies fetch secrets from the control plane. | #### EnvoyProxyStatus @@ -5692,6 +5693,20 @@ _Appears in:_ | `disabled` | _[RuntimeFlag](#runtimeflag) array_ | true | | | +#### SDSConfig + + + + + +_Appears in:_ +- [EnvoyProxySpec](#envoyproxyspec) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `allowedNamespaces` | _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#labelselector-v1-meta)_ | false | | AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed.
If unspecified, it allows reading SDS settings from a secret in any namespace. | + + #### SchemeHeaderTransform diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index c826ebb424..7a81db2d19 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -42580,6 +42580,60 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + sdsConfig: + description: |- + SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + and controls how Envoy proxies fetch secrets from the control plane. + properties: + allowedNamespaces: + description: |- + AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + If unspecified, it allows reading SDS settings from a secret in any namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index e814908295..24ad490bf4 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -20553,6 +20553,60 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + sdsConfig: + description: |- + SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + and controls how Envoy proxies fetch secrets from the control plane. + properties: + allowedNamespaces: + description: |- + AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + If unspecified, it allows reading SDS settings from a secret in any namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index d8def29527..ee1c7bd65c 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -20553,6 +20553,60 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + sdsConfig: + description: |- + SDSConfig defines configuration for Envoy's Secret Discovery Service (SDS) + and controls how Envoy proxies fetch secrets from the control plane. + properties: + allowedNamespaces: + description: |- + AllowedNamespaces selects namespaces where reading SDS settings from a secret is allowed. + If unspecified, it allows reading SDS settings from a secret in any namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process.