Fix route attachments to gateways
Co-authored-by: Romain <rtribotte@users.noreply.github.com>
This commit is contained in:
Kevin Pollet
GitHub
parent
6e61fe0de1
commit
e9bd2b45ac
12 changed files with 2243 additions and 2498 deletions
|
|
@ -199,19 +199,10 @@ func (s *K8sConformanceSuite) TestK8sGatewayAPIConformance() {
|
|||
RunTest: *k8sConformanceRunTest,
|
||||
// Until the feature are all supported, following tests are skipped.
|
||||
SkipTests: []string{
|
||||
tests.GatewayClassObservedGenerationBump.ShortName,
|
||||
tests.GatewayWithAttachedRoutes.ShortName,
|
||||
tests.GatewayModifyListeners.ShortName,
|
||||
tests.GatewayInvalidTLSConfiguration.ShortName,
|
||||
tests.HTTPRouteHostnameIntersection.ShortName,
|
||||
tests.HTTPRouteListenerHostnameMatching.ShortName,
|
||||
tests.HTTPRouteInvalidReferenceGrant.ShortName,
|
||||
tests.HTTPRouteInvalidCrossNamespaceParentRef.ShortName,
|
||||
tests.HTTPRouteInvalidParentRefNotMatchingSectionName.ShortName,
|
||||
tests.HTTPRouteInvalidCrossNamespaceBackendRef.ShortName,
|
||||
tests.HTTPRouteMatchingAcrossRoutes.ShortName,
|
||||
tests.HTTPRoutePartiallyInvalidViaInvalidReferenceGrant.ShortName,
|
||||
tests.HTTPRouteRedirectHostAndStatus.ShortName,
|
||||
tests.HTTPRoutePathMatchOrder.ShortName,
|
||||
tests.HTTPRouteHeaderMatching.ShortName,
|
||||
tests.HTTPRouteReferenceGrant.ShortName,
|
||||
|
|
|
|||
|
|
@ -32,11 +32,11 @@ type resourceEventHandler struct {
|
|||
ev chan<- interface{}
|
||||
}
|
||||
|
||||
func (reh *resourceEventHandler) OnAdd(obj interface{}, isInInitialList bool) {
|
||||
func (reh *resourceEventHandler) OnAdd(obj interface{}, _ bool) {
|
||||
eventHandlerFunc(reh.ev, obj)
|
||||
}
|
||||
|
||||
func (reh *resourceEventHandler) OnUpdate(oldObj, newObj interface{}) {
|
||||
func (reh *resourceEventHandler) OnUpdate(_, newObj interface{}) {
|
||||
eventHandlerFunc(reh.ev, newObj)
|
||||
}
|
||||
|
||||
|
|
@ -49,19 +49,21 @@ func (reh *resourceEventHandler) OnDelete(obj interface{}) {
|
|||
// The stores can then be accessed via the Get* functions.
|
||||
type Client interface {
|
||||
WatchAll(namespaces []string, stopCh <-chan struct{}) (<-chan interface{}, error)
|
||||
GetGatewayClasses() ([]*gatev1.GatewayClass, error)
|
||||
UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStatus gatev1.GatewayStatus) error
|
||||
UpdateGatewayClassStatus(gatewayClass *gatev1.GatewayClass, condition metav1.Condition) error
|
||||
UpdateHTTPRouteStatus(ctx context.Context, gateway *gatev1.Gateway, nsName ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error
|
||||
GetGateways() []*gatev1.Gateway
|
||||
GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute, error)
|
||||
GetTCPRoutes(namespaces []string) ([]*gatev1alpha2.TCPRoute, error)
|
||||
GetTLSRoutes(namespaces []string) ([]*gatev1alpha2.TLSRoute, error)
|
||||
GetReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error)
|
||||
UpdateHTTPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error
|
||||
UpdateTCPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TCPRouteStatus) error
|
||||
UpdateTLSRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TLSRouteStatus) error
|
||||
ListGatewayClasses() ([]*gatev1.GatewayClass, error)
|
||||
ListGateways() []*gatev1.Gateway
|
||||
ListHTTPRoutes() ([]*gatev1.HTTPRoute, error)
|
||||
ListTCPRoutes() ([]*gatev1alpha2.TCPRoute, error)
|
||||
ListTLSRoutes() ([]*gatev1alpha2.TLSRoute, error)
|
||||
ListNamespaces(selector labels.Selector) ([]string, error)
|
||||
ListReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error)
|
||||
GetService(namespace, name string) (*corev1.Service, bool, error)
|
||||
GetSecret(namespace, name string) (*corev1.Secret, bool, error)
|
||||
GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error)
|
||||
GetNamespaces(selector labels.Selector) ([]string, error)
|
||||
}
|
||||
|
||||
type clientWrapper struct {
|
||||
|
|
@ -280,7 +282,7 @@ func (c *clientWrapper) WatchAll(namespaces []string, stopCh <-chan struct{}) (<
|
|||
return eventCh, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetNamespaces(selector labels.Selector) ([]string, error) {
|
||||
func (c *clientWrapper) ListNamespaces(selector labels.Selector) ([]string, error) {
|
||||
ns, err := c.factoryNamespace.Core().V1().Namespaces().Lister().List(selector)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
|
|
@ -297,22 +299,12 @@ func (c *clientWrapper) GetNamespaces(selector labels.Selector) ([]string, error
|
|||
return namespaces, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute, error) {
|
||||
func (c *clientWrapper) ListHTTPRoutes() ([]*gatev1.HTTPRoute, error) {
|
||||
var httpRoutes []*gatev1.HTTPRoute
|
||||
for _, namespace := range namespaces {
|
||||
if !c.isWatchedNamespace(namespace) {
|
||||
log.Warn().Msgf("Failed to get HTTPRoutes: %q is not within watched namespaces", namespace)
|
||||
continue
|
||||
}
|
||||
|
||||
for _, namespace := range c.watchedNamespaces {
|
||||
routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(namespace).List(labels.Everything())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(routes) == 0 {
|
||||
log.Debug().Msgf("No HTTPRoutes found in namespace %q", namespace)
|
||||
continue
|
||||
return nil, fmt.Errorf("listing HTTP routes in namespace %s", namespace)
|
||||
}
|
||||
|
||||
httpRoutes = append(httpRoutes, routes...)
|
||||
|
|
@ -321,53 +313,35 @@ func (c *clientWrapper) GetHTTPRoutes(namespaces []string) ([]*gatev1.HTTPRoute,
|
|||
return httpRoutes, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetTCPRoutes(namespaces []string) ([]*gatev1alpha2.TCPRoute, error) {
|
||||
func (c *clientWrapper) ListTCPRoutes() ([]*gatev1alpha2.TCPRoute, error) {
|
||||
var tcpRoutes []*gatev1alpha2.TCPRoute
|
||||
for _, namespace := range namespaces {
|
||||
if !c.isWatchedNamespace(namespace) {
|
||||
log.Warn().Msgf("Failed to get TCPRoutes: %q is not within watched namespaces", namespace)
|
||||
continue
|
||||
}
|
||||
|
||||
for _, namespace := range c.watchedNamespaces {
|
||||
routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1alpha2().TCPRoutes().Lister().TCPRoutes(namespace).List(labels.Everything())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(routes) == 0 {
|
||||
log.Debug().Msgf("No TCPRoutes found in namespace %q", namespace)
|
||||
continue
|
||||
return nil, fmt.Errorf("listing TCP routes in namespace %s", namespace)
|
||||
}
|
||||
|
||||
tcpRoutes = append(tcpRoutes, routes...)
|
||||
}
|
||||
|
||||
return tcpRoutes, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetTLSRoutes(namespaces []string) ([]*gatev1alpha2.TLSRoute, error) {
|
||||
func (c *clientWrapper) ListTLSRoutes() ([]*gatev1alpha2.TLSRoute, error) {
|
||||
var tlsRoutes []*gatev1alpha2.TLSRoute
|
||||
for _, namespace := range namespaces {
|
||||
if !c.isWatchedNamespace(namespace) {
|
||||
log.Warn().Msgf("Failed to get TLSRoutes: %q is not within watched namespaces", namespace)
|
||||
continue
|
||||
}
|
||||
|
||||
for _, namespace := range c.watchedNamespaces {
|
||||
routes, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1alpha2().TLSRoutes().Lister().TLSRoutes(namespace).List(labels.Everything())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(routes) == 0 {
|
||||
log.Debug().Msgf("No TLSRoutes found in namespace %q", namespace)
|
||||
continue
|
||||
return nil, fmt.Errorf("listing TLS routes in namespace %s", namespace)
|
||||
}
|
||||
|
||||
tlsRoutes = append(tlsRoutes, routes...)
|
||||
}
|
||||
|
||||
return tlsRoutes, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error) {
|
||||
func (c *clientWrapper) ListReferenceGrants(namespace string) ([]*gatev1beta1.ReferenceGrant, error) {
|
||||
if !c.isWatchedNamespace(namespace) {
|
||||
log.Warn().Msgf("Failed to get ReferenceGrants: %q is not within watched namespaces", namespace)
|
||||
|
||||
|
|
@ -382,7 +356,7 @@ func (c *clientWrapper) GetReferenceGrants(namespace string) ([]*gatev1beta1.Ref
|
|||
return referenceGrants, nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetGateways() []*gatev1.Gateway {
|
||||
func (c *clientWrapper) ListGateways() []*gatev1.Gateway {
|
||||
var result []*gatev1.Gateway
|
||||
|
||||
for ns, factory := range c.factoriesGateway {
|
||||
|
|
@ -397,7 +371,7 @@ func (c *clientWrapper) GetGateways() []*gatev1.Gateway {
|
|||
return result
|
||||
}
|
||||
|
||||
func (c *clientWrapper) GetGatewayClasses() ([]*gatev1.GatewayClass, error) {
|
||||
func (c *clientWrapper) ListGatewayClasses() ([]*gatev1.GatewayClass, error) {
|
||||
return c.factoryGatewayClass.Gateway().V1().GatewayClasses().Lister().List(labels.Everything())
|
||||
}
|
||||
|
||||
|
|
@ -437,7 +411,7 @@ func (c *clientWrapper) UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStat
|
|||
return fmt.Errorf("cannot update Gateway status %s/%s: namespace is not within watched namespaces", gateway.Namespace, gateway.Name)
|
||||
}
|
||||
|
||||
if statusEquals(gateway.Status, gatewayStatus) {
|
||||
if gatewayStatusEquals(gateway.Status, gatewayStatus) {
|
||||
return nil
|
||||
}
|
||||
|
||||
|
|
@ -455,89 +429,106 @@ func (c *clientWrapper) UpdateGatewayStatus(gateway *gatev1.Gateway, gatewayStat
|
|||
return nil
|
||||
}
|
||||
|
||||
func (c *clientWrapper) UpdateHTTPRouteStatus(ctx context.Context, gateway *gatev1.Gateway, nsName ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error {
|
||||
if !c.isWatchedNamespace(nsName.Namespace) {
|
||||
return fmt.Errorf("updating HTTPRoute status %s/%s: namespace is not within watched namespaces", nsName.Namespace, nsName.Name)
|
||||
func (c *clientWrapper) UpdateHTTPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1.HTTPRouteStatus) error {
|
||||
if !c.isWatchedNamespace(route.Namespace) {
|
||||
return fmt.Errorf("updating HTTPRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
|
||||
}
|
||||
|
||||
route, err := c.factoriesGateway[c.lookupNamespace(nsName.Namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(nsName.Namespace).Get(nsName.Name)
|
||||
currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1().HTTPRoutes().Lister().HTTPRoutes(route.Namespace).Get(route.Name)
|
||||
if err != nil {
|
||||
return fmt.Errorf("getting HTTPRoute %s/%s: %w", nsName.Namespace, nsName.Name, err)
|
||||
return fmt.Errorf("getting HTTPRoute %s/%s: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
|
||||
var statuses []gatev1.RouteParentStatus
|
||||
for _, status := range route.Status.Parents {
|
||||
if status.ControllerName != controllerName {
|
||||
statuses = append(statuses, status)
|
||||
continue
|
||||
}
|
||||
if status.ParentRef.Namespace != nil && string(*status.ParentRef.Namespace) != gateway.Namespace {
|
||||
statuses = append(statuses, status)
|
||||
continue
|
||||
}
|
||||
if string(status.ParentRef.Name) != gateway.Name {
|
||||
statuses = append(statuses, status)
|
||||
// TODO: keep statuses for gateways managed by other Traefik instances.
|
||||
var parentStatuses []gatev1.RouteParentStatus
|
||||
for _, currentParentStatus := range currentRoute.Status.Parents {
|
||||
if currentParentStatus.ControllerName != controllerName {
|
||||
parentStatuses = append(parentStatuses, currentParentStatus)
|
||||
continue
|
||||
}
|
||||
}
|
||||
statuses = append(statuses, status.Parents...)
|
||||
|
||||
route = route.DeepCopy()
|
||||
route.Status = gatev1.HTTPRouteStatus{
|
||||
parentStatuses = append(parentStatuses, status.Parents...)
|
||||
|
||||
currentRoute = currentRoute.DeepCopy()
|
||||
currentRoute.Status = gatev1.HTTPRouteStatus{
|
||||
RouteStatus: gatev1.RouteStatus{
|
||||
Parents: statuses,
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
|
||||
if _, err := c.csGateway.GatewayV1().HTTPRoutes(nsName.Namespace).UpdateStatus(ctx, route, metav1.UpdateOptions{}); err != nil {
|
||||
return fmt.Errorf("updating HTTPRoute %s/%s status: %w", nsName.Namespace, nsName.Name, err)
|
||||
if _, err := c.csGateway.GatewayV1().HTTPRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
|
||||
return fmt.Errorf("updating HTTPRoute %s/%s status: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func statusEquals(oldStatus, newStatus gatev1.GatewayStatus) bool {
|
||||
if len(oldStatus.Listeners) != len(newStatus.Listeners) {
|
||||
return false
|
||||
func (c *clientWrapper) UpdateTCPRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TCPRouteStatus) error {
|
||||
if !c.isWatchedNamespace(route.Namespace) {
|
||||
return fmt.Errorf("updating TCPRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
|
||||
}
|
||||
|
||||
if !conditionsEquals(oldStatus.Conditions, newStatus.Conditions) {
|
||||
return false
|
||||
currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1alpha2().TCPRoutes().Lister().TCPRoutes(route.Namespace).Get(route.Name)
|
||||
if err != nil {
|
||||
return fmt.Errorf("getting TCPRoute %s/%s: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
|
||||
listenerMatches := 0
|
||||
for _, newListener := range newStatus.Listeners {
|
||||
for _, oldListener := range oldStatus.Listeners {
|
||||
if newListener.Name == oldListener.Name {
|
||||
if !conditionsEquals(newListener.Conditions, oldListener.Conditions) {
|
||||
return false
|
||||
}
|
||||
|
||||
listenerMatches++
|
||||
}
|
||||
// TODO: keep statuses for gateways managed by other Traefik instances.
|
||||
var parentStatuses []gatev1alpha2.RouteParentStatus
|
||||
for _, currentParentStatus := range currentRoute.Status.Parents {
|
||||
if currentParentStatus.ControllerName != controllerName {
|
||||
parentStatuses = append(parentStatuses, currentParentStatus)
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
return listenerMatches == len(oldStatus.Listeners)
|
||||
parentStatuses = append(parentStatuses, status.Parents...)
|
||||
|
||||
currentRoute = currentRoute.DeepCopy()
|
||||
currentRoute.Status = gatev1alpha2.TCPRouteStatus{
|
||||
RouteStatus: gatev1.RouteStatus{
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
|
||||
func conditionsEquals(conditionsA, conditionsB []metav1.Condition) bool {
|
||||
if len(conditionsA) != len(conditionsB) {
|
||||
return false
|
||||
if _, err := c.csGateway.GatewayV1alpha2().TCPRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
|
||||
return fmt.Errorf("updating TCPRoute %s/%s status: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
conditionMatches := 0
|
||||
for _, conditionA := range conditionsA {
|
||||
for _, conditionB := range conditionsB {
|
||||
if conditionA.Type == conditionB.Type {
|
||||
if conditionA.Reason != conditionB.Reason || conditionA.Status != conditionB.Status || conditionA.Message != conditionB.Message || conditionA.ObservedGeneration != conditionB.ObservedGeneration {
|
||||
return false
|
||||
func (c *clientWrapper) UpdateTLSRouteStatus(ctx context.Context, route ktypes.NamespacedName, status gatev1alpha2.TLSRouteStatus) error {
|
||||
if !c.isWatchedNamespace(route.Namespace) {
|
||||
return fmt.Errorf("updating TLSRoute status %s/%s: namespace is not within watched namespaces", route.Namespace, route.Name)
|
||||
}
|
||||
conditionMatches++
|
||||
|
||||
currentRoute, err := c.factoriesGateway[c.lookupNamespace(route.Namespace)].Gateway().V1alpha2().TLSRoutes().Lister().TLSRoutes(route.Namespace).Get(route.Name)
|
||||
if err != nil {
|
||||
return fmt.Errorf("getting TLSRoute %s/%s: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
|
||||
// TODO: keep statuses for gateways managed by other Traefik instances.
|
||||
var parentStatuses []gatev1alpha2.RouteParentStatus
|
||||
for _, currentParentStatus := range currentRoute.Status.Parents {
|
||||
if currentParentStatus.ControllerName != controllerName {
|
||||
parentStatuses = append(parentStatuses, currentParentStatus)
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
return conditionMatches == len(conditionsA)
|
||||
parentStatuses = append(parentStatuses, status.Parents...)
|
||||
|
||||
currentRoute = currentRoute.DeepCopy()
|
||||
currentRoute.Status = gatev1alpha2.TLSRouteStatus{
|
||||
RouteStatus: gatev1.RouteStatus{
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
|
||||
if _, err := c.csGateway.GatewayV1alpha2().TLSRoutes(route.Namespace).UpdateStatus(ctx, currentRoute, metav1.UpdateOptions{}); err != nil {
|
||||
return fmt.Errorf("updating TLSRoute %s/%s status: %w", route.Namespace, route.Name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetService returns the named service from the given namespace.
|
||||
|
|
@ -582,11 +573,21 @@ func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, bool,
|
|||
// The distinction is necessary because we index all informers on the special
|
||||
// identifier iff all-namespaces are requested but receive specific namespace
|
||||
// identifiers from the Kubernetes API, so we have to bridge this gap.
|
||||
func (c *clientWrapper) lookupNamespace(ns string) string {
|
||||
func (c *clientWrapper) lookupNamespace(namespace string) string {
|
||||
if c.isNamespaceAll {
|
||||
return metav1.NamespaceAll
|
||||
}
|
||||
return ns
|
||||
return namespace
|
||||
}
|
||||
|
||||
// isWatchedNamespace checks to ensure that the namespace is being watched before we request
|
||||
// it to ensure we don't panic by requesting an out-of-watch object.
|
||||
func (c *clientWrapper) isWatchedNamespace(namespace string) bool {
|
||||
if c.isNamespaceAll {
|
||||
return true
|
||||
}
|
||||
|
||||
return slices.Contains(c.watchedNamespaces, namespace)
|
||||
}
|
||||
|
||||
// eventHandlerFunc will pass the obj on to the events channel or drop it.
|
||||
|
|
@ -608,12 +609,51 @@ func translateNotFoundError(err error) (bool, error) {
|
|||
return err == nil, err
|
||||
}
|
||||
|
||||
// isWatchedNamespace checks to ensure that the namespace is being watched before we request
|
||||
// it to ensure we don't panic by requesting an out-of-watch object.
|
||||
func (c *clientWrapper) isWatchedNamespace(ns string) bool {
|
||||
if c.isNamespaceAll {
|
||||
return true
|
||||
func gatewayStatusEquals(statusA, statusB gatev1.GatewayStatus) bool {
|
||||
if len(statusA.Listeners) != len(statusB.Listeners) {
|
||||
return false
|
||||
}
|
||||
|
||||
return slices.Contains(c.watchedNamespaces, ns)
|
||||
if !conditionsEquals(statusA.Conditions, statusB.Conditions) {
|
||||
return false
|
||||
}
|
||||
|
||||
listenerMatches := 0
|
||||
for _, newListener := range statusB.Listeners {
|
||||
for _, oldListener := range statusA.Listeners {
|
||||
if newListener.Name == oldListener.Name {
|
||||
if !conditionsEquals(newListener.Conditions, oldListener.Conditions) {
|
||||
return false
|
||||
}
|
||||
|
||||
if newListener.AttachedRoutes != oldListener.AttachedRoutes {
|
||||
return false
|
||||
}
|
||||
|
||||
listenerMatches++
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return listenerMatches == len(statusA.Listeners)
|
||||
}
|
||||
|
||||
func conditionsEquals(conditionsA, conditionsB []metav1.Condition) bool {
|
||||
if len(conditionsA) != len(conditionsB) {
|
||||
return false
|
||||
}
|
||||
|
||||
conditionMatches := 0
|
||||
for _, conditionA := range conditionsA {
|
||||
for _, conditionB := range conditionsB {
|
||||
if conditionA.Type == conditionB.Type {
|
||||
if conditionA.Reason != conditionB.Reason || conditionA.Status != conditionB.Status || conditionA.Message != conditionB.Message || conditionA.ObservedGeneration != conditionB.ObservedGeneration {
|
||||
return false
|
||||
}
|
||||
conditionMatches++
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return conditionMatches == len(conditionsA)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ import (
|
|||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
)
|
||||
|
||||
func TestStatusEquals(t *testing.T) {
|
||||
func Test_gatewayStatusEquals(t *testing.T) {
|
||||
testCases := []struct {
|
||||
desc string
|
||||
statusA gatev1.GatewayStatus
|
||||
|
|
@ -230,13 +230,45 @@ func TestStatusEquals(t *testing.T) {
|
|||
},
|
||||
expected: false,
|
||||
},
|
||||
{
|
||||
desc: "Gateway listeners with same conditions but different number of attached routes",
|
||||
statusA: gatev1.GatewayStatus{
|
||||
Listeners: []gatev1.ListenerStatus{
|
||||
{
|
||||
Name: "foo",
|
||||
AttachedRoutes: 1,
|
||||
Conditions: []metav1.Condition{
|
||||
{
|
||||
Type: "foobar",
|
||||
Reason: "foobar",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
statusB: gatev1.GatewayStatus{
|
||||
Listeners: []gatev1.ListenerStatus{
|
||||
{
|
||||
Name: "foo",
|
||||
AttachedRoutes: 2,
|
||||
Conditions: []metav1.Condition{
|
||||
{
|
||||
Type: "foobar",
|
||||
Reason: "foobar",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expected: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range testCases {
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
result := statusEquals(test.statusA, test.statusB)
|
||||
result := gatewayStatusEquals(test.statusA, test.statusB)
|
||||
|
||||
assert.Equal(t, test.expected, result)
|
||||
})
|
||||
|
|
|
|||
|
|
@ -1,46 +0,0 @@
|
|||
---
|
||||
kind: GatewayClass
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
metadata:
|
||||
name: my-gateway-class
|
||||
spec:
|
||||
controllerName: traefik.io/gateway-controller
|
||||
|
||||
---
|
||||
kind: Gateway
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
metadata:
|
||||
name: my-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
gatewayClassName: my-gateway-class
|
||||
listeners: # Use GatewayClass defaults for listener definition.
|
||||
- name: http
|
||||
protocol: HTTP
|
||||
port: 80
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
|
||||
---
|
||||
kind: HTTPRoute
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
metadata:
|
||||
name: http-app-1
|
||||
namespace: default
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: my-gateway
|
||||
kind: Gateway
|
||||
group: gateway.networking.k8s.io
|
||||
hostnames:
|
||||
- "foo.com"
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: Unsupported
|
||||
value: /bar
|
||||
backendRefs:
|
||||
- name: whoami
|
||||
port: 80
|
||||
weight: 1
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
---
|
||||
kind: GatewayClass
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
metadata:
|
||||
name: my-gateway-class
|
||||
spec:
|
||||
controllerName: traefik.io/gateway-controller
|
||||
|
||||
---
|
||||
kind: Gateway
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
metadata:
|
||||
name: my-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
gatewayClassName: my-gateway-class
|
||||
listeners: # Use GatewayClass defaults for listener definition.
|
||||
- name: tls
|
||||
protocol: TLS
|
||||
port: 9001
|
||||
tls:
|
||||
mode: Passthrough
|
||||
allowedRoutes:
|
||||
kinds:
|
||||
- kind: TLSRoute
|
||||
group: gateway.networking.k8s.io
|
||||
namespaces:
|
||||
from: Same
|
||||
|
||||
---
|
||||
kind: TLSRoute
|
||||
apiVersion: gateway.networking.k8s.io/v1alpha2
|
||||
metadata:
|
||||
name: tls-app-1
|
||||
namespace: default
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: my-gateway
|
||||
kind: Gateway
|
||||
group: gateway.networking.k8s.io
|
||||
hostnames:
|
||||
- "*.foo.*.bar"
|
||||
rules:
|
||||
- backendRefs:
|
||||
- name: whoamitcp
|
||||
port: 9000
|
||||
weight: 1
|
||||
kind: Service
|
||||
group: ""
|
||||
575
pkg/provider/kubernetes/gateway/httproute.go
Normal file
575
pkg/provider/kubernetes/gateway/httproute.go
Normal file
|
|
@ -0,0 +1,575 @@
|
|||
package gateway
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/rs/zerolog/log"
|
||||
"github.com/traefik/traefik/v3/pkg/config/dynamic"
|
||||
"github.com/traefik/traefik/v3/pkg/provider"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
ktypes "k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/utils/ptr"
|
||||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
)
|
||||
|
||||
func (p *Provider) loadHTTPRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
|
||||
routes, err := client.ListHTTPRoutes()
|
||||
if err != nil {
|
||||
log.Ctx(ctx).Error().Err(err).Msg("Unable to list HTTPRoutes")
|
||||
return
|
||||
}
|
||||
|
||||
for _, route := range routes {
|
||||
logger := log.Ctx(ctx).With().
|
||||
Str("http_route", route.Name).
|
||||
Str("namespace", route.Namespace).
|
||||
Logger()
|
||||
|
||||
var parentStatuses []gatev1.RouteParentStatus
|
||||
for _, parentRef := range route.Spec.ParentRefs {
|
||||
parentStatus := &gatev1.RouteParentStatus{
|
||||
ParentRef: parentRef,
|
||||
ControllerName: controllerName,
|
||||
Conditions: []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonAccepted),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
var attachedListeners bool
|
||||
notAcceptedReason := gatev1.RouteReasonNoMatchingParent
|
||||
for _, listener := range gatewayListeners {
|
||||
if !matchListener(listener, route.Namespace, parentRef) {
|
||||
continue
|
||||
}
|
||||
|
||||
if !allowRoute(listener, route.Namespace, kindHTTPRoute) {
|
||||
notAcceptedReason = gatev1.RouteReasonNotAllowedByListeners
|
||||
continue
|
||||
}
|
||||
|
||||
hostnames, ok := findMatchingHostnames(listener.Hostname, route.Spec.Hostnames)
|
||||
if !ok {
|
||||
notAcceptedReason = gatev1.RouteReasonNoMatchingListenerHostname
|
||||
continue
|
||||
}
|
||||
|
||||
listener.Status.AttachedRoutes++
|
||||
|
||||
// TODO should we build the conf if the listener is not attached
|
||||
// only consider the route attached if the listener is in an "attached" state.
|
||||
if listener.Attached {
|
||||
attachedListeners = true
|
||||
}
|
||||
resolveConditions := p.loadHTTPRoute(logger.WithContext(ctx), client, listener, route, hostnames, conf)
|
||||
|
||||
// TODO: handle more accurately route conditions (in case of multiple listener matching).
|
||||
for _, condition := range resolveConditions {
|
||||
parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
|
||||
}
|
||||
}
|
||||
|
||||
if !attachedListeners {
|
||||
parentStatus.Conditions = []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(notAcceptedReason),
|
||||
},
|
||||
{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonRefNotPermitted),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
parentStatuses = append(parentStatuses, *parentStatus)
|
||||
}
|
||||
|
||||
status := gatev1.HTTPRouteStatus{
|
||||
RouteStatus: gatev1.RouteStatus{
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
if err := client.UpdateHTTPRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, status); err != nil {
|
||||
logger.Error().
|
||||
Err(err).
|
||||
Msg("Unable to update HTTPRoute status")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (p *Provider) loadHTTPRoute(ctx context.Context, client Client, listener gatewayListener, route *gatev1.HTTPRoute, hostnames []gatev1.Hostname, conf *dynamic.Configuration) []metav1.Condition {
|
||||
routeConditions := []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteConditionResolvedRefs),
|
||||
},
|
||||
}
|
||||
|
||||
hostRule := hostRule(hostnames)
|
||||
|
||||
for _, routeRule := range route.Spec.Rules {
|
||||
router := dynamic.Router{
|
||||
RuleSyntax: "v3",
|
||||
Rule: routerRule(routeRule, hostRule),
|
||||
EntryPoints: []string{listener.EPName},
|
||||
}
|
||||
if listener.Protocol == gatev1.HTTPSProtocolType {
|
||||
router.TLS = &dynamic.RouterTLSConfig{}
|
||||
}
|
||||
|
||||
// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
|
||||
routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
|
||||
routerKey := makeRouterKey(router.Rule, makeID(route.Namespace, routerName))
|
||||
|
||||
var wrr dynamic.WeightedRoundRobin
|
||||
wrrName := provider.Normalize(routerKey + "-wrr")
|
||||
|
||||
middlewares, err := p.loadMiddlewares(listener.Protocol, route.Namespace, routerKey, routeRule.Filters)
|
||||
if err != nil {
|
||||
log.Ctx(ctx).Error().
|
||||
Err(err).
|
||||
Msg("Unable to load HTTPRoute filters")
|
||||
|
||||
wrr.Services = append(wrr.Services, dynamic.WRRService{
|
||||
Name: "invalid-httproute-filter",
|
||||
Status: ptr.To(500),
|
||||
Weight: ptr.To(1),
|
||||
})
|
||||
|
||||
conf.HTTP.Services[wrrName] = &dynamic.Service{Weighted: &wrr}
|
||||
router.Service = wrrName
|
||||
} else {
|
||||
for name, middleware := range middlewares {
|
||||
// If the middleware config is nil in the return of the loadMiddlewares function,
|
||||
// it means that we just need a reference to that middleware.
|
||||
if middleware != nil {
|
||||
conf.HTTP.Middlewares[name] = middleware
|
||||
}
|
||||
|
||||
router.Middlewares = append(router.Middlewares, name)
|
||||
}
|
||||
|
||||
// Traefik internal service can be used only if there is only one BackendRef service reference.
|
||||
if len(routeRule.BackendRefs) == 1 && isInternalService(routeRule.BackendRefs[0].BackendRef) {
|
||||
router.Service = string(routeRule.BackendRefs[0].Name)
|
||||
} else {
|
||||
for _, backendRef := range routeRule.BackendRefs {
|
||||
name, svc, errCondition := p.loadHTTPService(client, route, backendRef)
|
||||
weight := ptr.To(int(ptr.Deref(backendRef.Weight, 1)))
|
||||
if errCondition != nil {
|
||||
routeConditions = appendCondition(routeConditions, *errCondition)
|
||||
wrr.Services = append(wrr.Services, dynamic.WRRService{
|
||||
Name: name,
|
||||
Status: ptr.To(500),
|
||||
Weight: weight,
|
||||
})
|
||||
continue
|
||||
}
|
||||
|
||||
if svc != nil {
|
||||
conf.HTTP.Services[name] = svc
|
||||
}
|
||||
|
||||
wrr.Services = append(wrr.Services, dynamic.WRRService{
|
||||
Name: name,
|
||||
Weight: weight,
|
||||
})
|
||||
}
|
||||
|
||||
conf.HTTP.Services[wrrName] = &dynamic.Service{Weighted: &wrr}
|
||||
router.Service = wrrName
|
||||
}
|
||||
}
|
||||
|
||||
rt := &router
|
||||
p.applyRouterTransform(ctx, rt, route)
|
||||
|
||||
routerKey = provider.Normalize(routerKey)
|
||||
conf.HTTP.Routers[routerKey] = rt
|
||||
}
|
||||
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
// loadHTTPService returns a dynamic.Service config corresponding to the given gatev1.HTTPBackendRef.
|
||||
// Note that the returned dynamic.Service config can be nil (for cross-provider, internal services, and backendFunc).
|
||||
func (p *Provider) loadHTTPService(client Client, route *gatev1.HTTPRoute, backendRef gatev1.HTTPBackendRef) (string, *dynamic.Service, *metav1.Condition) {
|
||||
group := groupCore
|
||||
if backendRef.Group != nil && *backendRef.Group != "" {
|
||||
group = string(*backendRef.Group)
|
||||
}
|
||||
|
||||
kind := ptr.Deref(backendRef.Kind, "Service")
|
||||
namespace := ptr.Deref(backendRef.Namespace, gatev1.Namespace(route.Namespace))
|
||||
namespaceStr := string(namespace)
|
||||
serviceName := provider.Normalize(makeID(namespaceStr, string(backendRef.Name)))
|
||||
|
||||
// TODO support cross namespace through ReferenceGrant.
|
||||
if namespaceStr != route.Namespace {
|
||||
return serviceName, nil, &metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonRefNotPermitted),
|
||||
Message: fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s namespace not allowed", group, kind, namespace, backendRef.Name),
|
||||
}
|
||||
}
|
||||
|
||||
if group != groupCore || kind != "Service" {
|
||||
name, service, err := p.loadHTTPBackendRef(namespaceStr, backendRef)
|
||||
if err != nil {
|
||||
return serviceName, nil, &metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonInvalidKind),
|
||||
Message: fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s: %s", group, kind, namespace, backendRef.Name, err),
|
||||
}
|
||||
}
|
||||
|
||||
return name, service, nil
|
||||
}
|
||||
|
||||
port := ptr.Deref(backendRef.Port, gatev1.PortNumber(0))
|
||||
if port == 0 {
|
||||
return serviceName, nil, &metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonUnsupportedProtocol),
|
||||
Message: fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s port is required", group, kind, namespace, backendRef.Name),
|
||||
}
|
||||
}
|
||||
|
||||
portStr := strconv.FormatInt(int64(port), 10)
|
||||
serviceName = provider.Normalize(serviceName + "-" + portStr)
|
||||
|
||||
lb, err := loadHTTPServers(client, namespaceStr, backendRef)
|
||||
if err != nil {
|
||||
return serviceName, nil, &metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonBackendNotFound),
|
||||
Message: fmt.Sprintf("Cannot load HTTPBackendRef %s/%s/%s/%s: %s", group, kind, namespace, backendRef.Name, err),
|
||||
}
|
||||
}
|
||||
|
||||
return serviceName, &dynamic.Service{LoadBalancer: lb}, nil
|
||||
}
|
||||
|
||||
func (p *Provider) loadHTTPBackendRef(namespace string, backendRef gatev1.HTTPBackendRef) (string, *dynamic.Service, error) {
|
||||
// Support for cross-provider references (e.g: api@internal).
|
||||
// This provides the same behavior as for IngressRoutes.
|
||||
if *backendRef.Kind == "TraefikService" && strings.Contains(string(backendRef.Name), "@") {
|
||||
return string(backendRef.Name), nil, nil
|
||||
}
|
||||
|
||||
backendFunc, ok := p.groupKindBackendFuncs[string(*backendRef.Group)][string(*backendRef.Kind)]
|
||||
if !ok {
|
||||
return "", nil, fmt.Errorf("unsupported HTTPBackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
|
||||
}
|
||||
if backendFunc == nil {
|
||||
return "", nil, fmt.Errorf("undefined backendFunc for HTTPBackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
|
||||
}
|
||||
|
||||
return backendFunc(string(backendRef.Name), namespace)
|
||||
}
|
||||
|
||||
func (p *Provider) loadMiddlewares(listenerProtocol gatev1.ProtocolType, namespace, prefix string, filters []gatev1.HTTPRouteFilter) (map[string]*dynamic.Middleware, error) {
|
||||
middlewares := make(map[string]*dynamic.Middleware)
|
||||
|
||||
for i, filter := range filters {
|
||||
switch filter.Type {
|
||||
case gatev1.HTTPRouteFilterRequestRedirect:
|
||||
middlewareName := provider.Normalize(fmt.Sprintf("%s-%s-%d", prefix, strings.ToLower(string(filter.Type)), i))
|
||||
middlewares[middlewareName] = createRedirectRegexMiddleware(listenerProtocol, filter.RequestRedirect)
|
||||
|
||||
case gatev1.HTTPRouteFilterRequestHeaderModifier:
|
||||
middlewareName := provider.Normalize(fmt.Sprintf("%s-%s-%d", prefix, strings.ToLower(string(filter.Type)), i))
|
||||
middlewares[middlewareName] = createRequestHeaderModifier(filter.RequestHeaderModifier)
|
||||
|
||||
case gatev1.HTTPRouteFilterExtensionRef:
|
||||
name, middleware, err := p.loadHTTPRouteFilterExtensionRef(namespace, filter.ExtensionRef)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("loading ExtensionRef filter %s: %w", filter.Type, err)
|
||||
}
|
||||
|
||||
middlewares[name] = middleware
|
||||
|
||||
default:
|
||||
// As per the spec: https://gateway-api.sigs.k8s.io/api-types/httproute/#filters-optional
|
||||
// In all cases where incompatible or unsupported filters are
|
||||
// specified, implementations MUST add a warning condition to
|
||||
// status.
|
||||
return nil, fmt.Errorf("unsupported filter %s", filter.Type)
|
||||
}
|
||||
}
|
||||
|
||||
return middlewares, nil
|
||||
}
|
||||
|
||||
func (p *Provider) loadHTTPRouteFilterExtensionRef(namespace string, extensionRef *gatev1.LocalObjectReference) (string, *dynamic.Middleware, error) {
|
||||
if extensionRef == nil {
|
||||
return "", nil, errors.New("filter extension ref undefined")
|
||||
}
|
||||
|
||||
filterFunc, ok := p.groupKindFilterFuncs[string(extensionRef.Group)][string(extensionRef.Kind)]
|
||||
if !ok {
|
||||
return "", nil, fmt.Errorf("unsupported filter extension ref %s/%s/%s", extensionRef.Group, extensionRef.Kind, extensionRef.Name)
|
||||
}
|
||||
if filterFunc == nil {
|
||||
return "", nil, fmt.Errorf("undefined filterFunc for filter extension ref %s/%s/%s", extensionRef.Group, extensionRef.Kind, extensionRef.Name)
|
||||
}
|
||||
|
||||
return filterFunc(string(extensionRef.Name), namespace)
|
||||
}
|
||||
|
||||
// TODO support cross namespace through ReferencePolicy.
|
||||
func loadHTTPServers(client Client, namespace string, backendRef gatev1.HTTPBackendRef) (*dynamic.ServersLoadBalancer, error) {
|
||||
service, exists, err := client.GetService(namespace, string(backendRef.Name))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("getting service: %w", err)
|
||||
}
|
||||
if !exists {
|
||||
return nil, errors.New("service not found")
|
||||
}
|
||||
|
||||
var portSpec corev1.ServicePort
|
||||
var match bool
|
||||
|
||||
for _, p := range service.Spec.Ports {
|
||||
if backendRef.Port == nil || p.Port == int32(*backendRef.Port) {
|
||||
portSpec = p
|
||||
match = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !match {
|
||||
return nil, errors.New("service port not found")
|
||||
}
|
||||
|
||||
endpoints, endpointsExists, err := client.GetEndpoints(namespace, string(backendRef.Name))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("getting endpoints: %w", err)
|
||||
}
|
||||
if !endpointsExists {
|
||||
return nil, errors.New("endpoints not found")
|
||||
}
|
||||
|
||||
if len(endpoints.Subsets) == 0 {
|
||||
return nil, errors.New("subset not found")
|
||||
}
|
||||
|
||||
lb := &dynamic.ServersLoadBalancer{}
|
||||
lb.SetDefaults()
|
||||
|
||||
var port int32
|
||||
var portStr string
|
||||
for _, subset := range endpoints.Subsets {
|
||||
for _, p := range subset.Ports {
|
||||
if portSpec.Name == p.Name {
|
||||
port = p.Port
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if port == 0 {
|
||||
return nil, errors.New("cannot define a port")
|
||||
}
|
||||
|
||||
protocol := getProtocol(portSpec)
|
||||
|
||||
portStr = strconv.FormatInt(int64(port), 10)
|
||||
for _, addr := range subset.Addresses {
|
||||
lb.Servers = append(lb.Servers, dynamic.Server{
|
||||
URL: fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(addr.IP, portStr)),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
return lb, nil
|
||||
}
|
||||
|
||||
func hostRule(hostnames []gatev1.Hostname) string {
|
||||
var rules []string
|
||||
|
||||
for _, hostname := range hostnames {
|
||||
host := string(hostname)
|
||||
|
||||
wildcard := strings.Count(host, "*")
|
||||
if wildcard == 0 {
|
||||
rules = append(rules, fmt.Sprintf("Host(`%s`)", host))
|
||||
continue
|
||||
}
|
||||
|
||||
host = strings.Replace(regexp.QuoteMeta(host), `\*\.`, `[a-z0-9-\.]+\.`, 1)
|
||||
rules = append(rules, fmt.Sprintf("HostRegexp(`^%s$`)", host))
|
||||
}
|
||||
|
||||
switch len(rules) {
|
||||
case 0:
|
||||
return ""
|
||||
case 1:
|
||||
return rules[0]
|
||||
default:
|
||||
return fmt.Sprintf("(%s)", strings.Join(rules, " || "))
|
||||
}
|
||||
}
|
||||
|
||||
func routerRule(routeRule gatev1.HTTPRouteRule, hostRule string) string {
|
||||
var rule string
|
||||
var matchesRules []string
|
||||
|
||||
for _, match := range routeRule.Matches {
|
||||
path := ptr.Deref(match.Path, gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchPathPrefix),
|
||||
Value: ptr.To("/"),
|
||||
})
|
||||
pathType := ptr.Deref(path.Type, gatev1.PathMatchPathPrefix)
|
||||
pathValue := ptr.Deref(path.Value, "/")
|
||||
|
||||
var matchRules []string
|
||||
switch pathType {
|
||||
case gatev1.PathMatchExact:
|
||||
matchRules = append(matchRules, fmt.Sprintf("Path(`%s`)", pathValue))
|
||||
case gatev1.PathMatchPathPrefix:
|
||||
matchRules = append(matchRules, buildPathMatchPathPrefixRule(pathValue))
|
||||
case gatev1.PathMatchRegularExpression:
|
||||
matchRules = append(matchRules, fmt.Sprintf("PathRegexp(`%s`)", pathValue))
|
||||
}
|
||||
|
||||
matchRules = append(matchRules, headerRules(match.Headers)...)
|
||||
matchesRules = append(matchesRules, strings.Join(matchRules, " && "))
|
||||
}
|
||||
|
||||
// If no matches are specified, the default is a prefix
|
||||
// path match on "/", which has the effect of matching every
|
||||
// HTTP request.
|
||||
if len(routeRule.Matches) == 0 {
|
||||
matchesRules = append(matchesRules, "PathPrefix(`/`)")
|
||||
}
|
||||
|
||||
if hostRule != "" {
|
||||
if len(matchesRules) == 0 {
|
||||
return hostRule
|
||||
}
|
||||
rule += hostRule + " && "
|
||||
}
|
||||
|
||||
if len(matchesRules) == 1 {
|
||||
return rule + matchesRules[0]
|
||||
}
|
||||
|
||||
if len(rule) == 0 {
|
||||
return strings.Join(matchesRules, " || ")
|
||||
}
|
||||
|
||||
return rule + "(" + strings.Join(matchesRules, " || ") + ")"
|
||||
}
|
||||
|
||||
func headerRules(headers []gatev1.HTTPHeaderMatch) []string {
|
||||
var headerRules []string
|
||||
for _, header := range headers {
|
||||
typ := ptr.Deref(header.Type, gatev1.HeaderMatchExact)
|
||||
switch typ {
|
||||
case gatev1.HeaderMatchExact:
|
||||
headerRules = append(headerRules, fmt.Sprintf("Header(`%s`,`%s`)", header.Name, header.Value))
|
||||
case gatev1.HeaderMatchRegularExpression:
|
||||
headerRules = append(headerRules, fmt.Sprintf("HeaderRegexp(`%s`,`%s`)", header.Name, header.Value))
|
||||
}
|
||||
}
|
||||
return headerRules
|
||||
}
|
||||
|
||||
func buildPathMatchPathPrefixRule(path string) string {
|
||||
if path == "/" {
|
||||
return "PathPrefix(`/`)"
|
||||
}
|
||||
|
||||
path = strings.TrimSuffix(path, "/")
|
||||
return fmt.Sprintf("(Path(`%[1]s`) || PathPrefix(`%[1]s/`))", path)
|
||||
}
|
||||
|
||||
// createRequestHeaderModifier does not enforce/check the configuration,
|
||||
// as the spec indicates that either the webhook or CEL (since v1.0 GA Release) should enforce that.
|
||||
func createRequestHeaderModifier(filter *gatev1.HTTPHeaderFilter) *dynamic.Middleware {
|
||||
sets := map[string]string{}
|
||||
for _, header := range filter.Set {
|
||||
sets[string(header.Name)] = header.Value
|
||||
}
|
||||
|
||||
adds := map[string]string{}
|
||||
for _, header := range filter.Add {
|
||||
adds[string(header.Name)] = header.Value
|
||||
}
|
||||
|
||||
return &dynamic.Middleware{
|
||||
RequestHeaderModifier: &dynamic.RequestHeaderModifier{
|
||||
Set: sets,
|
||||
Add: adds,
|
||||
Remove: filter.Remove,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func createRedirectRegexMiddleware(listenerProtocol gatev1.ProtocolType, filter *gatev1.HTTPRequestRedirectFilter) *dynamic.Middleware {
|
||||
// The spec allows for an empty string in which case we should use the
|
||||
// scheme of the request which in this case is the listener scheme.
|
||||
filterScheme := ptr.Deref(filter.Scheme, strings.ToLower(string(listenerProtocol)))
|
||||
statusCode := ptr.Deref(filter.StatusCode, http.StatusFound)
|
||||
|
||||
port := "${port}"
|
||||
if filter.Port != nil {
|
||||
port = fmt.Sprintf(":%d", *filter.Port)
|
||||
}
|
||||
|
||||
hostname := "${hostname}"
|
||||
if filter.Hostname != nil && *filter.Hostname != "" {
|
||||
hostname = string(*filter.Hostname)
|
||||
}
|
||||
|
||||
return &dynamic.Middleware{
|
||||
RedirectRegex: &dynamic.RedirectRegex{
|
||||
Regex: `^[a-z]+:\/\/(?P<userInfo>.+@)?(?P<hostname>\[[\w:\.]+\]|[\w\._-]+)(?P<port>:\d+)?\/(?P<path>.*)`,
|
||||
Replacement: fmt.Sprintf("%s://${userinfo}%s%s/${path}", filterScheme, hostname, port),
|
||||
Permanent: statusCode == http.StatusMovedPermanently,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func getProtocol(portSpec corev1.ServicePort) string {
|
||||
protocol := "http"
|
||||
if portSpec.Port == 443 || strings.HasPrefix(portSpec.Name, "https") {
|
||||
protocol = "https"
|
||||
}
|
||||
|
||||
return protocol
|
||||
}
|
||||
281
pkg/provider/kubernetes/gateway/httproute_test.go
Normal file
281
pkg/provider/kubernetes/gateway/httproute_test.go
Normal file
|
|
@ -0,0 +1,281 @@
|
|||
package gateway
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"k8s.io/utils/ptr"
|
||||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
)
|
||||
|
||||
func Test_hostRule(t *testing.T) {
|
||||
testCases := []struct {
|
||||
desc string
|
||||
hostnames []gatev1.Hostname
|
||||
expectedRule string
|
||||
expectErr bool
|
||||
}{
|
||||
{
|
||||
desc: "Empty rule and matches",
|
||||
expectedRule: "",
|
||||
},
|
||||
{
|
||||
desc: "One Host",
|
||||
hostnames: []gatev1.Hostname{
|
||||
"Foo",
|
||||
},
|
||||
expectedRule: "Host(`Foo`)",
|
||||
},
|
||||
{
|
||||
desc: "Multiple Hosts",
|
||||
hostnames: []gatev1.Hostname{
|
||||
"Foo",
|
||||
"Bar",
|
||||
"Bir",
|
||||
},
|
||||
expectedRule: "(Host(`Foo`) || Host(`Bar`) || Host(`Bir`))",
|
||||
},
|
||||
{
|
||||
desc: "Several Host and wildcard",
|
||||
hostnames: []gatev1.Hostname{
|
||||
"*.bar.foo",
|
||||
"bar.foo",
|
||||
"foo.foo",
|
||||
},
|
||||
expectedRule: "(HostRegexp(`^[a-z0-9-\\.]+\\.bar\\.foo$`) || Host(`bar.foo`) || Host(`foo.foo`))",
|
||||
},
|
||||
{
|
||||
desc: "Host with wildcard",
|
||||
hostnames: []gatev1.Hostname{
|
||||
"*.bar.foo",
|
||||
},
|
||||
expectedRule: "HostRegexp(`^[a-z0-9-\\.]+\\.bar\\.foo$`)",
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range testCases {
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
rule := hostRule(test.hostnames)
|
||||
assert.Equal(t, test.expectedRule, rule)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_routerRule(t *testing.T) {
|
||||
testCases := []struct {
|
||||
desc string
|
||||
routeRule gatev1.HTTPRouteRule
|
||||
hostRule string
|
||||
expectedRule string
|
||||
expectedError bool
|
||||
}{
|
||||
{
|
||||
desc: "Empty rule and matches",
|
||||
expectedRule: "PathPrefix(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "One Host rule without matches",
|
||||
hostRule: "Host(`foo.com`)",
|
||||
expectedRule: "Host(`foo.com`) && PathPrefix(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "One HTTPRouteMatch with nil HTTPHeaderMatch",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: ptr.To(gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchPathPrefix),
|
||||
Value: ptr.To("/"),
|
||||
}),
|
||||
Headers: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "PathPrefix(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "One HTTPRouteMatch with nil HTTPHeaderMatch Type",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: ptr.To(gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchPathPrefix),
|
||||
Value: ptr.To("/"),
|
||||
}),
|
||||
Headers: []gatev1.HTTPHeaderMatch{
|
||||
{Name: "foo", Value: "bar"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "PathPrefix(`/`) && Header(`foo`,`bar`)",
|
||||
},
|
||||
{
|
||||
desc: "One HTTPRouteMatch with nil HTTPPathMatch",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{Path: nil},
|
||||
},
|
||||
},
|
||||
expectedRule: "PathPrefix(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "One HTTPRouteMatch with nil HTTPPathMatch Type",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: nil,
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "(Path(`/foo`) || PathPrefix(`/foo/`))",
|
||||
},
|
||||
{
|
||||
desc: "One HTTPRouteMatch with nil HTTPPathMatch Values",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Path(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "One Path in matches",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Path(`/foo/`)",
|
||||
},
|
||||
{
|
||||
desc: "One Path in matches and another empty",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
},
|
||||
{},
|
||||
},
|
||||
},
|
||||
expectedRule: "Path(`/foo/`) || PathPrefix(`/`)",
|
||||
},
|
||||
{
|
||||
desc: "Path OR Header rules",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
},
|
||||
{
|
||||
Headers: []gatev1.HTTPHeaderMatch{
|
||||
{
|
||||
Type: ptr.To(gatev1.HeaderMatchExact),
|
||||
Name: "my-header",
|
||||
Value: "foo",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Path(`/foo/`) || PathPrefix(`/`) && Header(`my-header`,`foo`)",
|
||||
},
|
||||
{
|
||||
desc: "Path && Header rules",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
Headers: []gatev1.HTTPHeaderMatch{
|
||||
{
|
||||
Type: ptr.To(gatev1.HeaderMatchExact),
|
||||
Name: "my-header",
|
||||
Value: "foo",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Path(`/foo/`) && Header(`my-header`,`foo`)",
|
||||
},
|
||||
{
|
||||
desc: "Host && Path && Header rules",
|
||||
hostRule: "Host(`foo.com`)",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
Headers: []gatev1.HTTPHeaderMatch{
|
||||
{
|
||||
Type: ptr.To(gatev1.HeaderMatchExact),
|
||||
Name: "my-header",
|
||||
Value: "foo",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Host(`foo.com`) && Path(`/foo/`) && Header(`my-header`,`foo`)",
|
||||
},
|
||||
{
|
||||
desc: "Host && (Path || Header) rules",
|
||||
hostRule: "Host(`foo.com`)",
|
||||
routeRule: gatev1.HTTPRouteRule{
|
||||
Matches: []gatev1.HTTPRouteMatch{
|
||||
{
|
||||
Path: &gatev1.HTTPPathMatch{
|
||||
Type: ptr.To(gatev1.PathMatchExact),
|
||||
Value: ptr.To("/foo/"),
|
||||
},
|
||||
},
|
||||
{
|
||||
Headers: []gatev1.HTTPHeaderMatch{
|
||||
{
|
||||
Type: ptr.To(gatev1.HeaderMatchExact),
|
||||
Name: "my-header",
|
||||
Value: "foo",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedRule: "Host(`foo.com`) && (Path(`/foo/`) || PathPrefix(`/`) && Header(`my-header`,`foo`))",
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range testCases {
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
rule := routerRule(test.routeRule, test.hostRule)
|
||||
assert.Equal(t, test.expectedRule, rule)
|
||||
})
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
296
pkg/provider/kubernetes/gateway/tcproute.go
Normal file
296
pkg/provider/kubernetes/gateway/tcproute.go
Normal file
|
|
@ -0,0 +1,296 @@
|
|||
package gateway
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
|
||||
"github.com/rs/zerolog/log"
|
||||
"github.com/traefik/traefik/v3/pkg/config/dynamic"
|
||||
"github.com/traefik/traefik/v3/pkg/provider"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
ktypes "k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/utils/ptr"
|
||||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
|
||||
)
|
||||
|
||||
func (p *Provider) loadTCPRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
|
||||
logger := log.Ctx(ctx)
|
||||
routes, err := client.ListTCPRoutes()
|
||||
if err != nil {
|
||||
logger.Error().Err(err).Msgf("Get TCPRoutes: %s", err)
|
||||
}
|
||||
|
||||
for _, route := range routes {
|
||||
logger := log.Ctx(ctx).With().Str("tcproute", route.Name).Str("namespace", route.Namespace).Logger()
|
||||
|
||||
var parentStatuses []gatev1alpha2.RouteParentStatus
|
||||
for _, parentRef := range route.Spec.ParentRefs {
|
||||
parentStatus := &gatev1alpha2.RouteParentStatus{
|
||||
ParentRef: parentRef,
|
||||
ControllerName: controllerName,
|
||||
Conditions: []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonAccepted),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
var attachedListeners bool
|
||||
for _, listener := range gatewayListeners {
|
||||
if !matchListener(listener, route.Namespace, parentRef) {
|
||||
continue
|
||||
}
|
||||
|
||||
if !allowRoute(listener, route.Namespace, kindTCPRoute) {
|
||||
continue
|
||||
}
|
||||
|
||||
listener.Status.AttachedRoutes++
|
||||
attachedListeners = true
|
||||
|
||||
resolveConditions := p.loadTCPRoute(client, listener, route, conf)
|
||||
|
||||
// TODO: handle more accurately route conditions (in case of multiple listener matching).
|
||||
for _, condition := range resolveConditions {
|
||||
parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
|
||||
}
|
||||
}
|
||||
|
||||
if !attachedListeners {
|
||||
parentStatus.Conditions = []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonNoMatchingParent),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
parentStatuses = append(parentStatuses, *parentStatus)
|
||||
}
|
||||
|
||||
routeStatus := gatev1alpha2.TCPRouteStatus{
|
||||
RouteStatus: gatev1alpha2.RouteStatus{
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
if err := client.UpdateTCPRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, routeStatus); err != nil {
|
||||
logger.Error().
|
||||
Err(err).
|
||||
Msg("Unable to update TCPRoute status")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (p *Provider) loadTCPRoute(client Client, listener gatewayListener, route *gatev1alpha2.TCPRoute, conf *dynamic.Configuration) []metav1.Condition {
|
||||
routeConditions := []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteConditionResolvedRefs),
|
||||
},
|
||||
}
|
||||
|
||||
router := dynamic.TCPRouter{
|
||||
Rule: "HostSNI(`*`)",
|
||||
EntryPoints: []string{listener.EPName},
|
||||
RuleSyntax: "v3",
|
||||
}
|
||||
|
||||
if listener.Protocol == gatev1.TLSProtocolType && listener.TLS != nil {
|
||||
// TODO support let's encrypt
|
||||
router.TLS = &dynamic.RouterTCPTLSConfig{
|
||||
Passthrough: listener.TLS.Mode != nil && *listener.TLS.Mode == gatev1.TLSModePassthrough,
|
||||
}
|
||||
}
|
||||
|
||||
// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
|
||||
routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
|
||||
routerKey := provider.Normalize(makeRouterKey("", makeID(route.Namespace, routerName)))
|
||||
|
||||
var ruleServiceNames []string
|
||||
for i, rule := range route.Spec.Rules {
|
||||
if rule.BackendRefs == nil {
|
||||
// Should not happen due to validation.
|
||||
// https://github.com/kubernetes-sigs/gateway-api/blob/v0.4.0/apis/v1alpha2/tcproute_types.go#L76
|
||||
continue
|
||||
}
|
||||
|
||||
wrrService, subServices, err := loadTCPServices(client, route.Namespace, rule.BackendRefs)
|
||||
if err != nil {
|
||||
routeConditions = appendCondition(routeConditions, metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonBackendNotFound),
|
||||
Message: fmt.Sprintf("Cannot load TCPRoute service %s/%s: %v", route.Namespace, route.Name, err),
|
||||
})
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
for svcName, svc := range subServices {
|
||||
conf.TCP.Services[svcName] = svc
|
||||
}
|
||||
|
||||
serviceName := fmt.Sprintf("%s-wrr-%d", routerKey, i)
|
||||
conf.TCP.Services[serviceName] = wrrService
|
||||
|
||||
ruleServiceNames = append(ruleServiceNames, serviceName)
|
||||
}
|
||||
|
||||
if len(ruleServiceNames) == 1 {
|
||||
router.Service = ruleServiceNames[0]
|
||||
conf.TCP.Routers[routerKey] = &router
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
routeServiceKey := routerKey + "-wrr"
|
||||
routeService := &dynamic.TCPService{Weighted: &dynamic.TCPWeightedRoundRobin{}}
|
||||
|
||||
for _, name := range ruleServiceNames {
|
||||
service := dynamic.TCPWRRService{Name: name}
|
||||
service.SetDefaults()
|
||||
|
||||
routeService.Weighted.Services = append(routeService.Weighted.Services, service)
|
||||
}
|
||||
|
||||
conf.TCP.Services[routeServiceKey] = routeService
|
||||
|
||||
router.Service = routeServiceKey
|
||||
conf.TCP.Routers[routerKey] = &router
|
||||
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
// loadTCPServices is generating a WRR service, even when there is only one target.
|
||||
func loadTCPServices(client Client, namespace string, backendRefs []gatev1.BackendRef) (*dynamic.TCPService, map[string]*dynamic.TCPService, error) {
|
||||
services := map[string]*dynamic.TCPService{}
|
||||
|
||||
wrrSvc := &dynamic.TCPService{
|
||||
Weighted: &dynamic.TCPWeightedRoundRobin{
|
||||
Services: []dynamic.TCPWRRService{},
|
||||
},
|
||||
}
|
||||
|
||||
for _, backendRef := range backendRefs {
|
||||
if backendRef.Group == nil || backendRef.Kind == nil {
|
||||
// Should not happen as this is validated by kubernetes
|
||||
continue
|
||||
}
|
||||
|
||||
if isInternalService(backendRef) {
|
||||
return nil, nil, fmt.Errorf("traefik internal service %s is not allowed in a WRR loadbalancer", backendRef.Name)
|
||||
}
|
||||
|
||||
weight := int(ptr.Deref(backendRef.Weight, 1))
|
||||
|
||||
if isTraefikService(backendRef) {
|
||||
wrrSvc.Weighted.Services = append(wrrSvc.Weighted.Services, dynamic.TCPWRRService{Name: string(backendRef.Name), Weight: &weight})
|
||||
continue
|
||||
}
|
||||
|
||||
if *backendRef.Group != "" && *backendRef.Group != groupCore && *backendRef.Kind != "Service" {
|
||||
return nil, nil, fmt.Errorf("unsupported BackendRef %s/%s/%s", *backendRef.Group, *backendRef.Kind, backendRef.Name)
|
||||
}
|
||||
|
||||
svc := dynamic.TCPService{
|
||||
LoadBalancer: &dynamic.TCPServersLoadBalancer{},
|
||||
}
|
||||
|
||||
service, exists, err := client.GetService(namespace, string(backendRef.Name))
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
if !exists {
|
||||
return nil, nil, errors.New("service not found")
|
||||
}
|
||||
|
||||
if len(service.Spec.Ports) > 1 && backendRef.Port == nil {
|
||||
// If the port is unspecified and the backend is a Service
|
||||
// object consisting of multiple port definitions, the route
|
||||
// must be dropped from the Gateway. The controller should
|
||||
// raise the "ResolvedRefs" condition on the Gateway with the
|
||||
// "DroppedRoutes" reason. The gateway status for this route
|
||||
// should be updated with a condition that describes the error
|
||||
// more specifically.
|
||||
log.Error().Msg("A multiple ports Kubernetes Service cannot be used if unspecified backendRef.Port")
|
||||
continue
|
||||
}
|
||||
|
||||
var portSpec corev1.ServicePort
|
||||
var match bool
|
||||
|
||||
for _, p := range service.Spec.Ports {
|
||||
if backendRef.Port == nil || p.Port == int32(*backendRef.Port) {
|
||||
portSpec = p
|
||||
match = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !match {
|
||||
return nil, nil, errors.New("service port not found")
|
||||
}
|
||||
|
||||
endpoints, endpointsExists, endpointsErr := client.GetEndpoints(namespace, string(backendRef.Name))
|
||||
if endpointsErr != nil {
|
||||
return nil, nil, endpointsErr
|
||||
}
|
||||
|
||||
if !endpointsExists {
|
||||
return nil, nil, errors.New("endpoints not found")
|
||||
}
|
||||
|
||||
if len(endpoints.Subsets) == 0 {
|
||||
return nil, nil, errors.New("subset not found")
|
||||
}
|
||||
|
||||
var port int32
|
||||
var portStr string
|
||||
for _, subset := range endpoints.Subsets {
|
||||
for _, p := range subset.Ports {
|
||||
if portSpec.Name == p.Name {
|
||||
port = p.Port
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if port == 0 {
|
||||
return nil, nil, errors.New("cannot define a port")
|
||||
}
|
||||
|
||||
portStr = strconv.FormatInt(int64(port), 10)
|
||||
for _, addr := range subset.Addresses {
|
||||
svc.LoadBalancer.Servers = append(svc.LoadBalancer.Servers, dynamic.TCPServer{
|
||||
Address: net.JoinHostPort(addr.IP, portStr),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
serviceName := provider.Normalize(makeID(service.Namespace, service.Name) + "-" + portStr)
|
||||
services[serviceName] = &svc
|
||||
|
||||
wrrSvc.Weighted.Services = append(wrrSvc.Weighted.Services, dynamic.TCPWRRService{Name: serviceName, Weight: &weight})
|
||||
}
|
||||
|
||||
if len(wrrSvc.Weighted.Services) == 0 {
|
||||
return nil, nil, errors.New("no service has been created")
|
||||
}
|
||||
|
||||
return wrrSvc, services, nil
|
||||
}
|
||||
210
pkg/provider/kubernetes/gateway/tlsroute.go
Normal file
210
pkg/provider/kubernetes/gateway/tlsroute.go
Normal file
|
|
@ -0,0 +1,210 @@
|
|||
package gateway
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/rs/zerolog/log"
|
||||
"github.com/traefik/traefik/v3/pkg/config/dynamic"
|
||||
"github.com/traefik/traefik/v3/pkg/provider"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
ktypes "k8s.io/apimachinery/pkg/types"
|
||||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
|
||||
)
|
||||
|
||||
func (p *Provider) loadTLSRoutes(ctx context.Context, client Client, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
|
||||
logger := log.Ctx(ctx)
|
||||
routes, err := client.ListTLSRoutes()
|
||||
if err != nil {
|
||||
logger.Error().Err(err).Msgf("Get TLSRoutes: %s", err)
|
||||
}
|
||||
|
||||
for _, route := range routes {
|
||||
logger := log.Ctx(ctx).With().Str("tlsroute", route.Name).Str("namespace", route.Namespace).Logger()
|
||||
|
||||
var parentStatuses []gatev1alpha2.RouteParentStatus
|
||||
for _, parentRef := range route.Spec.ParentRefs {
|
||||
parentStatus := &gatev1alpha2.RouteParentStatus{
|
||||
ParentRef: parentRef,
|
||||
ControllerName: controllerName,
|
||||
Conditions: []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonAccepted),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
var attachedListeners bool
|
||||
for _, listener := range gatewayListeners {
|
||||
if !matchListener(listener, route.Namespace, parentRef) {
|
||||
continue
|
||||
}
|
||||
|
||||
if !allowRoute(listener, route.Namespace, kindTLSRoute) {
|
||||
continue
|
||||
}
|
||||
|
||||
hostnames, ok := findMatchingHostnames(listener.Hostname, route.Spec.Hostnames)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
listener.Status.AttachedRoutes++
|
||||
attachedListeners = true
|
||||
|
||||
resolveConditions := p.loadTLSRoute(client, listener, route, hostnames, conf)
|
||||
|
||||
// TODO: handle more accurately route conditions (in case of multiple listener matching).
|
||||
for _, condition := range resolveConditions {
|
||||
parentStatus.Conditions = appendCondition(parentStatus.Conditions, condition)
|
||||
}
|
||||
}
|
||||
|
||||
if !attachedListeners {
|
||||
parentStatus.Conditions = []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionAccepted),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonNoMatchingParent),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
parentStatuses = append(parentStatuses, *parentStatus)
|
||||
}
|
||||
|
||||
routeStatus := gatev1alpha2.TLSRouteStatus{
|
||||
RouteStatus: gatev1alpha2.RouteStatus{
|
||||
Parents: parentStatuses,
|
||||
},
|
||||
}
|
||||
if err := client.UpdateTLSRouteStatus(ctx, ktypes.NamespacedName{Namespace: route.Namespace, Name: route.Name}, routeStatus); err != nil {
|
||||
logger.Error().
|
||||
Err(err).
|
||||
Msg("Unable to update TLSRoute status")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (p *Provider) loadTLSRoute(client Client, listener gatewayListener, route *gatev1alpha2.TLSRoute, hostnames []gatev1.Hostname, conf *dynamic.Configuration) []metav1.Condition {
|
||||
routeConditions := []metav1.Condition{
|
||||
{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionTrue,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteConditionResolvedRefs),
|
||||
},
|
||||
}
|
||||
|
||||
router := dynamic.TCPRouter{
|
||||
RuleSyntax: "v3",
|
||||
Rule: hostSNIRule(hostnames),
|
||||
EntryPoints: []string{listener.EPName},
|
||||
TLS: &dynamic.RouterTCPTLSConfig{
|
||||
Passthrough: listener.TLS.Mode != nil && *listener.TLS.Mode == gatev1.TLSModePassthrough,
|
||||
},
|
||||
}
|
||||
|
||||
// Adding the gateway desc and the entryPoint desc prevents overlapping of routers build from the same routes.
|
||||
routerName := route.Name + "-" + listener.GWName + "-" + listener.EPName
|
||||
routerKey := provider.Normalize(makeRouterKey(router.Rule, makeID(route.Namespace, routerName)))
|
||||
|
||||
var ruleServiceNames []string
|
||||
for i, routeRule := range route.Spec.Rules {
|
||||
if len(routeRule.BackendRefs) == 0 {
|
||||
// Should not happen due to validation.
|
||||
// https://github.com/kubernetes-sigs/gateway-api/blob/v0.4.0/apis/v1alpha2/tlsroute_types.go#L120
|
||||
continue
|
||||
}
|
||||
|
||||
wrrService, subServices, err := loadTCPServices(client, route.Namespace, routeRule.BackendRefs)
|
||||
if err != nil {
|
||||
// update "ResolvedRefs" status true with "InvalidBackendRefs" reason
|
||||
routeConditions = appendCondition(routeConditions, metav1.Condition{
|
||||
Type: string(gatev1.RouteConditionResolvedRefs),
|
||||
Status: metav1.ConditionFalse,
|
||||
ObservedGeneration: route.Generation,
|
||||
LastTransitionTime: metav1.Now(),
|
||||
Reason: string(gatev1.RouteReasonBackendNotFound),
|
||||
Message: fmt.Sprintf("Cannot load TLSRoute service %s/%s: %v", route.Namespace, route.Name, err),
|
||||
})
|
||||
continue
|
||||
}
|
||||
|
||||
for svcName, svc := range subServices {
|
||||
conf.TCP.Services[svcName] = svc
|
||||
}
|
||||
|
||||
serviceName := fmt.Sprintf("%s-wrr-%d", routerKey, i)
|
||||
conf.TCP.Services[serviceName] = wrrService
|
||||
|
||||
ruleServiceNames = append(ruleServiceNames, serviceName)
|
||||
}
|
||||
|
||||
if len(ruleServiceNames) == 1 {
|
||||
router.Service = ruleServiceNames[0]
|
||||
conf.TCP.Routers[routerKey] = &router
|
||||
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
routeServiceKey := routerKey + "-wrr"
|
||||
routeService := &dynamic.TCPService{Weighted: &dynamic.TCPWeightedRoundRobin{}}
|
||||
|
||||
for _, name := range ruleServiceNames {
|
||||
service := dynamic.TCPWRRService{Name: name}
|
||||
service.SetDefaults()
|
||||
|
||||
routeService.Weighted.Services = append(routeService.Weighted.Services, service)
|
||||
}
|
||||
|
||||
conf.TCP.Services[routeServiceKey] = routeService
|
||||
|
||||
router.Service = routeServiceKey
|
||||
conf.TCP.Routers[routerKey] = &router
|
||||
|
||||
return routeConditions
|
||||
}
|
||||
|
||||
func hostSNIRule(hostnames []gatev1.Hostname) string {
|
||||
rules := make([]string, 0, len(hostnames))
|
||||
uniqHostnames := map[gatev1.Hostname]struct{}{}
|
||||
|
||||
for _, hostname := range hostnames {
|
||||
if len(hostname) == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
if _, exists := uniqHostnames[hostname]; exists {
|
||||
continue
|
||||
}
|
||||
|
||||
host := string(hostname)
|
||||
uniqHostnames[hostname] = struct{}{}
|
||||
|
||||
wildcard := strings.Count(host, "*")
|
||||
if wildcard == 0 {
|
||||
rules = append(rules, fmt.Sprintf("HostSNI(`%s`)", host))
|
||||
continue
|
||||
}
|
||||
|
||||
host = strings.Replace(regexp.QuoteMeta(host), `\*\.`, `[a-z0-9-\.]+\.`, 1)
|
||||
rules = append(rules, fmt.Sprintf("HostSNIRegexp(`^%s$`)", host))
|
||||
}
|
||||
|
||||
if len(hostnames) == 0 || len(rules) == 0 {
|
||||
return "HostSNI(`*`)"
|
||||
}
|
||||
|
||||
return strings.Join(rules, " || ")
|
||||
}
|
||||
66
pkg/provider/kubernetes/gateway/tlsroute_test.go
Normal file
66
pkg/provider/kubernetes/gateway/tlsroute_test.go
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
package gateway
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
gatev1 "sigs.k8s.io/gateway-api/apis/v1"
|
||||
)
|
||||
|
||||
func Test_hostSNIRule(t *testing.T) {
|
||||
testCases := []struct {
|
||||
desc string
|
||||
hostnames []gatev1.Hostname
|
||||
expectedRule string
|
||||
expectError bool
|
||||
}{
|
||||
{
|
||||
desc: "Empty",
|
||||
expectedRule: "HostSNI(`*`)",
|
||||
},
|
||||
{
|
||||
desc: "Empty hostname",
|
||||
hostnames: []gatev1.Hostname{""},
|
||||
expectedRule: "HostSNI(`*`)",
|
||||
},
|
||||
{
|
||||
desc: "Supported wildcard",
|
||||
hostnames: []gatev1.Hostname{"*.foo"},
|
||||
expectedRule: "HostSNIRegexp(`^[a-z0-9-\\.]+\\.foo$`)",
|
||||
},
|
||||
{
|
||||
desc: "Some empty hostnames",
|
||||
hostnames: []gatev1.Hostname{"foo", "", "bar"},
|
||||
expectedRule: "HostSNI(`foo`) || HostSNI(`bar`)",
|
||||
},
|
||||
{
|
||||
desc: "Valid hostname",
|
||||
hostnames: []gatev1.Hostname{"foo"},
|
||||
expectedRule: "HostSNI(`foo`)",
|
||||
},
|
||||
{
|
||||
desc: "Multiple valid hostnames",
|
||||
hostnames: []gatev1.Hostname{"foo", "bar"},
|
||||
expectedRule: "HostSNI(`foo`) || HostSNI(`bar`)",
|
||||
},
|
||||
{
|
||||
desc: "Multiple valid hostnames with wildcard",
|
||||
hostnames: []gatev1.Hostname{"bar.foo", "foo.foo", "*.foo"},
|
||||
expectedRule: "HostSNI(`bar.foo`) || HostSNI(`foo.foo`) || HostSNIRegexp(`^[a-z0-9-\\.]+\\.foo$`)",
|
||||
},
|
||||
{
|
||||
desc: "Multiple overlapping hostnames",
|
||||
hostnames: []gatev1.Hostname{"foo", "bar", "foo", "baz"},
|
||||
expectedRule: "HostSNI(`foo`) || HostSNI(`bar`) || HostSNI(`baz`)",
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range testCases {
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
rule := hostSNIRule(test.hostnames)
|
||||
assert.Equal(t, test.expectedRule, rule)
|
||||
})
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue