Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gateway-api: Skip reconciliation for non-matching controller routes #25549

Merged
merged 1 commit into from
May 25, 2023

Conversation

sayboras
Copy link
Member

@sayboras sayboras commented May 19, 2023

This commit is to make sure that only gateways matching cilium pre-defined controller are re-queued for reconciliation.

Testing was done with the below spec, the expected behavior is no-op as the controllerName of GatewayClass of Gateway of underlying HTTPRoute is not same as pre-defined cilium controller name value (e.g. io.cilium-gateway-controller)

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: cilium
spec:
  controllerName: io.cilium/gateway-controller-non-matching
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  gatewayClassName: cilium
  listeners:
  - protocol: HTTP
    port: 80
    name: prod-web-gw
    allowedRoutes:
      namespaces:
        from: Same
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-app-1
spec:
  parentRefs:
  - name: my-gateway
    namespace: default
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /details
    backendRefs:
    - name: details
      port: 9080

Status of resources

# Ignore Gateway as it's not matching controller name in cilium
$ kg gateway my-gateway -o json | jqs
{
  "conditions": [
    {
      "lastTransitionTime": "1970-01-01T00:00:00Z",
      "message": "Waiting for controller",
      "reason": "NotReconciled",
      "status": "Unknown",
      "type": "Accepted"
    }
  ]
}

# Ignore HTTP Route as it's under cilium controller
$ kg httproute http-app-1 -o json | jqs
null

```

@maintainer-s-little-helper maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 19, 2023
@sayboras sayboras added release-note/bug This PR fixes an issue in a previous release of Cilium. needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch labels May 19, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 19, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot added this to Needs backport from main in 1.13.3 May 19, 2023
@sayboras sayboras marked this pull request as ready for review May 19, 2023 10:43
@sayboras sayboras requested a review from a team as a code owner May 19, 2023 10:43
@sayboras sayboras requested a review from youngnick May 19, 2023 10:43
@sayboras sayboras force-pushed the tam/gateway-http-requeue branch 3 times, most recently from 6eb88a1 to 9fff818 Compare May 19, 2023 11:52
@sayboras sayboras marked this pull request as draft May 19, 2023 12:22
@sayboras sayboras force-pushed the tam/gateway-http-requeue branch 3 times, most recently from b38e9fe to fc32d36 Compare May 20, 2023 10:41
@sayboras sayboras marked this pull request as ready for review May 20, 2023 10:56
Copy link
Contributor

@youngnick youngnick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small nit about log levels, but aside from that LGTM.

operator/pkg/gateway-api/gateway.go Outdated Show resolved Hide resolved
This commit is to make sure that only gateways matching cilium
pre-defined controller are re-queued for reconciliation.

Similar logic is applied for HTTPRoute as well i.e. ignore HTTPRoute if
there is no parent matching cilium controller

Testing was done with the below spec, the expected behavior is no-op
as the controllerName of GatewayClass of Gateway of underlying HTTPRoute
is not same as pre-defined cilium controller name value (e.g.
io.cilium-gateway-controller)

```yaml
apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: cilium
spec:
  controllerName: io.cilium/gateway-controller-non-matching
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  gatewayClassName: cilium
  listeners:
  - protocol: HTTP
    port: 80
    name: prod-web-gw
    allowedRoutes:
      namespaces:
        from: Same
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-app-1
spec:
  parentRefs:
  - name: my-gateway
    namespace: default
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /details
    backendRefs:
    - name: details
      port: 9080
```

Reported-by: Karsten Nielsen <karsten.nielsen@ingka.ikea.com>
Signed-off-by: Tam Mach <tam.mach@cilium.io>
@sayboras
Copy link
Member Author

sayboras commented May 23, 2023

/test

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathConfig High-scale IPcache Test ingress policy enforcement

Failure Output

FAIL: Expected command: kubectl exec -n kube-system cilium-fxwd5 -- bpftool map update pinned /sys/fs/bpf/tc/globals/cilium_world_cidrs4 key 0 0 0 0 0 0 0 0 value 1 

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/85/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

@sayboras
Copy link
Member Author

/test-runtime

@sayboras
Copy link
Member Author

sayboras commented May 24, 2023

/test-1.26-net-next

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathConfig High-scale IPcache Test ingress policy enforcement

Failure Output

FAIL: Expected command: kubectl exec -n kube-system cilium-qhvwq -- bpftool map update pinned /sys/fs/bpf/tc/globals/cilium_world_cidrs4 key 0 0 0 0 0 0 0 0 value 1 

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/133/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

@sayboras
Copy link
Member Author

sayboras commented May 24, 2023

/mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next

👍 created #25652

@sayboras
Copy link
Member Author

Required review is in, hitting a flake for high-scale ipcache tracked in #25652. Marking this ready to merge.

@sayboras sayboras added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label May 24, 2023
@squeed squeed merged commit 707a61a into cilium:main May 25, 2023
57 of 58 checks passed
@sayboras sayboras mentioned this pull request May 28, 2023
10 tasks
@sayboras sayboras added backport-pending/1.13 The backport for Cilium 1.13.x for this PR is in progress. and removed backport-pending/1.13 The backport for Cilium 1.13.x for this PR is in progress. labels May 28, 2023
@sayboras sayboras added backport-done/1.13 The backport for Cilium 1.13.x for this PR is done. and removed needs-backport/1.13 This PR / issue needs backporting to the v1.13 branch labels Jun 2, 2023
@maintainer-s-little-helper maintainer-s-little-helper bot moved this from Needs backport from main to Backport done to v1.13 in 1.13.3 Jun 2, 2023
@sayboras sayboras deleted the tam/gateway-http-requeue branch June 20, 2023 09:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-done/1.13 The backport for Cilium 1.13.x for this PR is done. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/bug This PR fixes an issue in a previous release of Cilium.
Projects
No open projects
1.13.3
Backport done to v1.13
Development

Successfully merging this pull request may close these issues.

None yet

3 participants