-
Notifications
You must be signed in to change notification settings - Fork 52
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'origin/main' into multi-cluster-doc-imp…
…rove # Conflicts: # docs/guides/getstarted.md # docs/guides/multi-sn.md
- Loading branch information
Showing
63 changed files
with
4,108 additions
and
1,183 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| package controllers | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/api/meta" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/types" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/builder" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/handler" | ||
| "sigs.k8s.io/controller-runtime/pkg/predicate" | ||
| gwv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2" | ||
|
|
||
| anv1alpha1 "github.com/aws/aws-application-networking-k8s/pkg/apis/applicationnetworking/v1alpha1" | ||
| "github.com/aws/aws-application-networking-k8s/pkg/k8s" | ||
| "github.com/aws/aws-application-networking-k8s/pkg/k8s/policyhelper" | ||
| "github.com/aws/aws-application-networking-k8s/pkg/utils/gwlog" | ||
| ) | ||
|
|
||
| type TargetGroupPolicyController struct { | ||
| log gwlog.Logger | ||
| client client.Client | ||
| } | ||
|
|
||
| func RegisterTargetGroupPolicyController(log gwlog.Logger, mgr ctrl.Manager) error { | ||
| controller := &TargetGroupPolicyController{ | ||
| log: log, | ||
| client: mgr.GetClient(), | ||
| } | ||
| mapfn := targetGroupPolicyMapFunc(mgr.GetClient(), log) | ||
| return ctrl.NewControllerManagedBy(mgr). | ||
| For(&anv1alpha1.TargetGroupPolicy{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})). | ||
| Watches(&corev1.Service{}, handler.EnqueueRequestsFromMapFunc(mapfn)). | ||
| Complete(controller) | ||
| } | ||
|
|
||
| func (c *TargetGroupPolicyController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { | ||
| tgPolicy := &anv1alpha1.TargetGroupPolicy{} | ||
| err := c.client.Get(ctx, req.NamespacedName, tgPolicy) | ||
| if err != nil { | ||
| return ctrl.Result{}, client.IgnoreNotFound(err) | ||
| } | ||
| c.log.Infow("reconcile target group policy", "req", req, "targetRef", tgPolicy.Spec.TargetRef) | ||
|
|
||
| validationErr := c.validateSpec(ctx, tgPolicy) | ||
| reason := validationErrToStatusReason(validationErr) | ||
| msg := "" | ||
| if validationErr != nil { | ||
| msg = validationErr.Error() | ||
| } | ||
| c.updatePolicyCondition(tgPolicy, reason, msg) | ||
| err = c.client.Status().Update(ctx, tgPolicy) | ||
| if err != nil { | ||
| return ctrl.Result{}, err | ||
| } | ||
|
|
||
| c.log.Infow("reconciled target group policy", | ||
| "req", req, | ||
| "targetRef", tgPolicy.Spec.TargetRef, | ||
| ) | ||
| return ctrl.Result{}, nil | ||
| } | ||
|
|
||
| func (c *TargetGroupPolicyController) validateSpec(ctx context.Context, tgPolicy *anv1alpha1.TargetGroupPolicy) error { | ||
| tr := tgPolicy.Spec.TargetRef | ||
| if tr.Group != corev1.GroupName { | ||
| return fmt.Errorf("%w: %s", GroupNameError, tr.Group) | ||
| } | ||
| if string(tr.Kind) != "Service" { | ||
| return fmt.Errorf("%w: %s", KindError, tr.Kind) | ||
| } | ||
| tgref := types.NamespacedName{ | ||
| Namespace: tgPolicy.Namespace, | ||
| Name: string(tgPolicy.Spec.TargetRef.Name), | ||
| } | ||
| valid, err := policyhelper.GetValidPolicy(ctx, c.client, tgref, tgPolicy) | ||
| if err != nil { | ||
| return nil | ||
| } | ||
| if valid != nil && valid.GetNamespacedName() != tgPolicy.GetNamespacedName() { | ||
| return fmt.Errorf("%w, with policy %s", TargetRefConflict, valid.GetName()) | ||
| } | ||
| refExists, err := c.targetRefExists(ctx, tgPolicy) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if !refExists { | ||
| return fmt.Errorf("%w: %s", TargetRefNotFound, tr.Name) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (c *TargetGroupPolicyController) targetRefExists(ctx context.Context, tgPolicy *anv1alpha1.TargetGroupPolicy) (bool, error) { | ||
| tr := tgPolicy.Spec.TargetRef | ||
| var obj client.Object | ||
| switch tr.Kind { | ||
| case "Service": | ||
| obj = &corev1.Service{} | ||
| default: | ||
| panic("unexpected targetRef Kind=" + tr.Kind) | ||
| } | ||
| return k8s.ObjExists(ctx, c.client, types.NamespacedName{ | ||
| Namespace: tgPolicy.Namespace, | ||
| Name: string(tr.Name), | ||
| }, obj) | ||
| } | ||
|
|
||
| func (c *TargetGroupPolicyController) updatePolicyCondition(tgPolicy *anv1alpha1.TargetGroupPolicy, reason gwv1alpha2.PolicyConditionReason, msg string) { | ||
| status := metav1.ConditionTrue | ||
| if reason != gwv1alpha2.PolicyReasonAccepted { | ||
| status = metav1.ConditionFalse | ||
| } | ||
| cnd := metav1.Condition{ | ||
| Type: string(gwv1alpha2.PolicyConditionAccepted), | ||
| Status: status, | ||
| Reason: string(reason), | ||
| Message: msg, | ||
| } | ||
| meta.SetStatusCondition(&tgPolicy.Status.Conditions, cnd) | ||
| } | ||
|
|
||
| func targetGroupPolicyMapFunc(c client.Client, log gwlog.Logger) handler.MapFunc { | ||
| return func(ctx context.Context, obj client.Object) []ctrl.Request { | ||
| requests := []ctrl.Request{} | ||
| policies := &anv1alpha1.TargetGroupPolicyList{} | ||
| err := c.List(ctx, policies, &client.ListOptions{Namespace: obj.GetNamespace()}) | ||
| if err != nil { | ||
| log.Error(err) | ||
| return requests | ||
| } | ||
| for _, policy := range policies.Items { | ||
| if obj.GetName() == string(policy.Spec.TargetRef.Name) { | ||
| requests = append(requests, ctrl.Request{NamespacedName: policy.GetNamespacedName()}) | ||
| } | ||
| } | ||
| return requests | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| # API Reference | ||
|
|
||
| This page contains the API field specification for Gateway API. | ||
| This page contains the API specification for Custom Resource Definitions supported by the Application Networking K8s Controller. | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| # Gateway API Reference | ||
|
|
||
| ## Introduction | ||
|
|
||
| `Gateway` allows you to configure network traffic through AWS Gateway API Controller. | ||
| When a Gateway is defined with `amazon-vpc-lattice` GatewayClass, the controller will watch for the gateway | ||
| and the resources under them, creating required resources under Amazon VPC Lattice. | ||
|
|
||
| Internally, a Gateway points to a VPC Lattice [service network](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-networks.html). | ||
| Service networks are identified by Gateway name (without namespace) - for example, a Gateway named `my-gateway` | ||
| will point to a VPC Lattice service network `my-gateway`. If multiple Gateways share the same name, all of them | ||
| will point to the same service network. | ||
|
|
||
| VPC Lattice service networks must be managed separately, as it is a broader concept that can cover resources | ||
| outside the Kubernetes cluster. To create and manage a service network, you can either: | ||
|
|
||
| - Specify `DEFAULT_SERVICE_NETWORK` configuration option on the controller. This will make the controller | ||
| to create a service network with such name, and associate the cluster VPC to it for you. This is suitable | ||
| for simple use cases with single service network. | ||
| - Manage service networks outside the cluster, using AWS Console, CDK, CloudFormation, etc. This is recommended | ||
| for more advanced use cases that cover multiple clusters and VPCs. | ||
|
|
||
| Gateways with `amazon-vpc-lattice` GatewayClass do not create a single entrypoint to bind Listeners and Routes | ||
| under them. Instead, each Route will have its own domain name assigned. To see an example of how domain names | ||
| are assigned, please refer to our [Getting Started Guide](../guides/getstarted.md). | ||
|
|
||
| ### Supported GatewayClass | ||
| - `amazon-vpc-lattice` | ||
| This is the default GatewayClass for managing traffic using Amazon VPC Lattice. | ||
|
|
||
| ### Limitations | ||
| - GatewayAddress status does not represent all accessible endpoints belong to a Gateway. | ||
| Instead, you should check annotations of each Route. | ||
| - Only `Terminate` is supported for TLS mode. TLSRoute is currently not supported. | ||
| - TLS certificate cannot be provided through `certificateRefs` field by `Secret` resource. | ||
| Instead, you can create an ACM certificate and put its ARN to the `options` field. | ||
|
|
||
| ## Example Configuration | ||
|
|
||
| Here is a sample configuration that demonstrates how to set up a `Gateway`: | ||
|
|
||
| ```yaml | ||
| apiVersion: gateway.networking.k8s.io/v1beta1 | ||
| kind: Gateway | ||
| metadata: | ||
| name: my-hotel | ||
| spec: | ||
| gatewayClassName: amazon-vpc-lattice | ||
| listeners: | ||
| - name: http | ||
| protocol: HTTP | ||
| port: 80 | ||
| - name: https | ||
| protocol: HTTPS | ||
| port: 443 | ||
| tls: | ||
| mode: Terminate | ||
| certificateRefs: | ||
| - name: unused | ||
| options: | ||
| application-networking.k8s.aws/certificate-arn: <certificate-arn> | ||
| ``` | ||
| The created Gateway will point to a VPC Lattice service network named `my-hotel`. Routes under this Gateway can have | ||
| either `http` or `https` listener as a parent based on their desired protocol to use. | ||
|
|
||
| --- | ||
|
|
||
| This `Gateway` documentation provides a detailed introduction, feature set, and a basic example of how to configure | ||
| and use the resource within AWS Gateway API Controller project. For in-depth details and specifications, you can refer to the | ||
| official [Gateway API documentation](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Gateway). |
Oops, something went wrong.