Envoy resource namespacing #26037
Merged
Envoy resource namespacing #26037
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
jrajahalme
added
the
release-note/minor
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
|
/test |
jrajahalme
force-pushed
the
envoy-resource-namespacing
branch
6 times, most recently
from
f18a6dd
to
8393312
Compare
|
Dropped the secret original namespace commit from this PR as it was problematic. Will reintroduce it after this has merged. |
|
/test Job 'Cilium-PR-K8s-1.26-kernel-net-next' hit: #25958 (88.26% similarity) |
sayboras
approved these changes
Jun 13, 2023
|
/test-1.26-net-next |
|
/ci-ginkgo |
Parsed Envoy Listeners have qualified names, so explicit listener references must also be qualified for name comparison to work. Usually listener reference is implicit (== first listener in the CiliumEnvoyConfig) so this bug was not hit in practice. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Make ResourceQualifiedName gracefully return the given resource name, if it is already qualified, or if it is empty. Optionally also qualify resource names with a different namespace as a prefix to force namespacing where applicable. Passing through empty resource names without qualifying them is important so that a potentially invalid envoy config, where a required name is missing, remains invalid also after qualifying resource names. Currently, a CiliumEnvoyConfig may use backendServices in a different namespace, so resource namespacing can not be encorced on the referred backend services. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Qualify cluster names that are not already qualified. This helps avoid accidental resource name collision when multiple CiliumEnvoyConfigs are defined. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Validate also Listener resources after parsing them from CiliumEnvoyConfig. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Qualify Envoy Secret resource names and references with the namespace and CEC name when not already namespaced. This helps prevent accidental Secret resource name collisions between different CEC/CCEC resources when they use the same (unqualified) name locally. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
'SetNodeOnFirstMessageOnly: true' was missing from the XDS reference used for secrets, which causes larger than necessary XDS messages. Let Cilium agent fill in the XDS reference instead. Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
jrajahalme
force-pushed
the
envoy-resource-namespacing
branch
from
8393312
to
7476b65
Compare
|
/test |
jrajahalme
added
kind/feature
nathanjsweet
approved these changes
Jun 14, 2023
maintainer-s-little-helper
bot
added
the
ready-to-merge
19 tasks
nbusseneau
added
backport-pending/1.13
tklauser
added
backport-done/1.13
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Qualify cluster names that are not already qualified. This helps avoid
accidental resource name collision when multiple CiliumEnvoyConfigs are
defined.