-
Notifications
You must be signed in to change notification settings - Fork 318
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adds AuthenticationFilter Support to Kubernetes Provider #791
Conversation
3f76786
to
08e1109
Compare
Marking as Draft while I resolve the conformance test failure. |
Commit 2f01f4d removes the following changes from the initial commit:
Due to failed conformance test:
xref: #792 |
@@ -11,7 +11,8 @@ import ( | |||
gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2" | |||
gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1" | |||
|
|||
"github.com/envoyproxy/gateway/api/config/v1alpha1" | |||
egcfgv1a1 "github.com/envoyproxy/gateway/api/config/v1alpha1" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we combine these two into one ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't we keep them separate to simplify moving the Gateway API extensions, e.g. AuthenticationFilter, out of EG into a separate repo in the future? If we decide to remove the config
API group, I think that should be done in a separate PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
trying to highlight the fact that current dir structure is confusing - either we have api/extensions/v1alpha1
or just api/v1alpha1
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agreed. Per your request, I removed the security
group from the Request Authentication design. I'll add this to the community meeting agenda to get input from other maintainers.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
xref #809 to make a decision on API type grouping. IMO a separate PR should be submitted to resolve this issue.
4086819
to
8039e92
Compare
Codecov Report
@@ Coverage Diff @@
## main #791 +/- ##
==========================================
- Coverage 63.31% 62.95% -0.36%
==========================================
Files 46 46
Lines 6157 6257 +100
==========================================
+ Hits 3898 3939 +41
- Misses 2019 2070 +51
- Partials 240 248 +8
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
13b9626
to
4f479ec
Compare
Signed-off-by: danehans <daneyonhansen@gmail.com>
4f479ec
to
16b425d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM thanks !
Caused by merging envoyproxy#791 without rebasing envoyproxy#816 Signed-off-by: Arko Dasgupta <arko@tetrate.io>
* Fix package import for HTTPRouteFilterExtensionRef Caused by merging #791 without rebasing #816 Signed-off-by: Arko Dasgupta <arko@tetrate.io> * fix test was failing with below error ``` --- FAIL: TestProcessHTTPRoutes/httproute_with_one_authenticationfilter (0.00s) routes_test.go:221: Error Trace: /Users/arkodebdasgupta/go-workspace/src/github.com/envoyproxy/gateway/internal/provider/kubernetes/routes_test.go:221 Error: Received unexpected error: List on GroupVersionKind gateway.networking.k8s.io/v1beta1, Kind=HTTPRoute specifies selector on field gatewayHTTPRouteIndex, but no index with name gatewayHTTPRouteIndex has been registered for GroupVersionKind gateway.networking.k8s.io/v1beta1, Kind=HTTPRoute Test: TestProcessHTTPRoutes/httproute_with_one_authenticationfilter ``` Signed-off-by: Arko Dasgupta <arko@tetrate.io> Signed-off-by: Arko Dasgupta <arko@tetrate.io>
Adds AuthenticationFilter API support to the Kubernetes provider:
api/v1alpha1/authenticationfilter_types.go
: Adds missing Authentication -> AuthenticationFilter changes from Adds Request Authentication API #733.api/v1alpha1/zz_generated.deepcopy.go
: Regenerates DeepCopy methods due to AuthenticationFilter API changes.internal/envoygateway/scheme.go
: Adds thev1alpha1
, e.g. AuthenticationFilter, group to the scheme.internal/gatewayapi/helpers.go
: AddsValidateAuthenticationFilterRef()
helper function to validate AuthenticationFilter references from an HTTPRoute.internal/gatewayapi/helpers_test.go
: AddsValidateAuthenticationFilterRef()
unit tests.internal/gatewayapi/translator.go
: Adds AuthenticationFilter to the gatewayapi Resources type. AddsNewResources()
helper function.internal/gatewayapi/zz_generated.deepcopy.go
: Regenerates DeepCopy methods due to API changes.internal/provider/kubernetes/config/crd/kustomization.yaml
: Adds AuthenticationFilter CRD to the list of installed CRDs.internal/provider/kubernetes/config/rbac/role.yaml
: Generated bymake manifests
, updating EG RBAC for AuthenticationFilter.internal/provider/kubernetes/controller.go
: Add a watch for instances of AuthenticationFilter. Updates the resourceMappings type to map HTTPRoutes<>AuthenticationFilters. Adds AuthenticationFilters referenced by managed HTTPRoutes to the resourceTree.internal/provider/kubernetes/rbac.go
: Updates EG RBAC kubebuilder tags for managing instances of AuthenticationFilter.internal/provider/kubernetes/helpers.go
: Removes namespace check fromvalidateBackendRef()
. Now that [provider] refactoring kubernetes provider to single reconciler #702 adds full ReferenceGrant support, an HTTPRoute backend should be allowed to reference a Service in a different namespace if the necessary ReferenceGrant exists (xref).internal/provider/kubernetes/kubernetes_test.go
: Adds AuthenticationFilter test case to Kube provider integration tests.internal/provider/kubernetes/predicates.go
Adds predicate to filter AuthenticationFilter instancess from the controller's watch.internal/provider/kubernetes/routes.go
: UpdatesprocessHTTPRoutes()
to process AuthenticationFilters referenced by managed HTTPRoutes.internal/provider/kubernetes/routes_test.go
: Renamed fromroute_test.go
to matchroutes.go. Adds a unit test for
processHTTPRoutes()`.xref:#790
Signed-off-by: danehans daneyonhansen@gmail.com