Add Support for Tolerations

.changelog/426.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+Add support for tolerations to Consul API Gateway Controller and GatewayClassConfig
+```

.github/workflows/conformance.yml

@@ -49,6 +49,11 @@ jobs:
             consul-image: "hashicorppreview/consul:1.14-dev"
             envoy-image: "envoyproxy/envoy:v1.22-latest"
             consul-k8s-version: "v0.49.0"
+          - name: "DELETE ME- TEST WITH BRANCH"
+            api-gateway-image: "hashicorppreview/consul-api-gateway:0.5-dev"
+            consul-image: "hashicorppreview/consul:1.14-dev"
+            envoy-image: "envoyproxy/envoy:v1.22-latest"
+            consul-k8s-version: "consul-api-gateway-add-tolerations-support"
       fail-fast: true
     name: "${{ matrix.cluster-type }} - ${{ matrix.config.name }}"
     concurrency:

config/crd/bases/api-gateway.consul.hashicorp.com_gatewayclassconfigs.yaml

@@ -149,6 +149,47 @@ spec:
                 - NodePort
                 - LoadBalancer
                 type: string
+              tolerations:
+                description: 'Toleration allow the scheduler to schedule nodes with
+                  matching tains More Info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/'
+                items:
+                  description: The pod this Toleration is attached to tolerates any
+                    taint that matches the triple <key,value,effect> using the matching
+                    operator <operator>.
+                  properties:
+                    effect:
+                      description: Effect indicates the taint effect to match. Empty
+                        means match all taint effects. When specified, allowed values
+                        are NoSchedule, PreferNoSchedule and NoExecute.
+                      type: string
+                    key:
+                      description: Key is the taint key that the toleration applies
+                        to. Empty means match all taint keys. If the key is empty,
+                        operator must be Exists; this combination means to match all
+                        values and all keys.
+                      type: string
+                    operator:
+                      description: Operator represents a key's relationship to the
+                        value. Valid operators are Exists and Equal. Defaults to Equal.
+                        Exists is equivalent to wildcard for value, so that a pod
+                        can tolerate all taints of a particular category.
+                      type: string
+                    tolerationSeconds:
+                      description: TolerationSeconds represents the period of time
+                        the toleration (which must be of effect NoExecute, otherwise
+                        this field is ignored) tolerates the taint. By default, it
+                        is not set, which means tolerate the taint forever (do not
+                        evict). Zero and negative values will be treated as 0 (evict
+                        immediately) by the system.
+                      format: int64
+                      type: integer
+                    value:
+                      description: Value is the taint value the toleration matches
+                        to. If the operator is Exists, the value should be empty,
+                        otherwise just a regular string.
+                      type: string
+                  type: object
+                type: array
               useHostPorts:
                 description: If this is set, then the Envoy container ports are mapped
                   to host ports.

internal/k8s/builder/gateway.go

@@ -199,6 +199,7 @@ func (b *GatewayDeploymentBuilder) podSpec() corev1.PodSpec {
 			},
 		},
 		NodeSelector:       b.gwConfig.Spec.NodeSelector,
+		Tolerations:        b.gwConfig.Spec.Tolerations,
 		ServiceAccountName: orDefault(b.gwConfig.Spec.ConsulSpec.AuthSpec.Account, defaultServiceAccount),
 		// the init container copies the binary into the
 		// next envoy container so we can decouple the envoy

internal/k8s/builder/testdata/static-mapping.deployment.golden.yaml

@@ -115,6 +115,11 @@ spec:
       nodeSelector:
         ingress-ready: "true"
       serviceAccountName: consul-api-gateway
+      tolerations:
+      - effect: NoSchedule
+        key: key1
+        operator: Equal
+        value: value1
       volumes:
       - emptyDir: {}
         name: bootstrap

internal/k8s/builder/testdata/static-mapping.yaml

@@ -18,6 +18,11 @@ spec:
     envoy: "envoy:1"
   nodeSelector:
     "ingress-ready": "true"
+  tolerations:
+    - key: "key1"
+      operator: "Equal"
+      value: "value1"
+      effect: "NoSchedule"
 ---
 apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: GatewayClass

pkg/apis/v1alpha1/types.go

@@ -39,6 +39,9 @@ type GatewayClassConfigSpec struct {
 	// Selector which must match a node's labels for the pod to be scheduled on that node.
 	// More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+	//Toleration allow the scheduler to schedule nodes with matching tains
+	// More Info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 	// If this is set, then the Envoy container ports are mapped
 	// to host ports.
 	UseHostPorts bool `json:"useHostPorts,omitempty"`