Skip to content

Commit 10bae0b

Browse files
kate-osbornkate-osborn
authored
Implement ClientSettingsPolicy (#1940)
Problems: - As a Cluster Operator, I want to set defaults for client settings that will work for most applications so that most Application Developers will not have to tweak these settings. - As an Application Developer, I want to be able to configure client settings for my application based on its behavior or requirements. - As an Application Developer, I want to override the defaults for client settings set by the Cluster Operator because the defaults do not satisfy my application's requirements or behavior. Solution: Implement ClientSettingsPolicy API. - Cluster operators can create a ClientSettingsPolicy for a Gateway to set defaults for client settings that apply to all routes attached to that Gateway. - App devs can create ClientSettingsPolicies for their routes and specify client settings that override the defaults set by the cluster operator.
1 parent 9212c4b commit 10bae0b

File tree

92 files changed

+7708
-471
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+7708
-471
lines changed

‎apis/v1alpha1/clientsettingspolicy_types.go

+8-1
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,11 @@ type ClientSettingsPolicySpec struct {
4848

4949
// TargetRef identifies an API object to apply the policy to.
5050
// Object must be in the same namespace as the policy.
51+
// Support: Gateway, HTTPRoute, GRPCRoute.
5152
//
52-
// Support: Gateway, HTTPRoute
53+
// +kubebuilder:validation:XValidation:message="TargetRef Kind must be one of: Gateway, HTTPRoute, or GRPCRoute",rule="(self.kind=='Gateway' || self.kind=='HTTPRoute' || self.kind=='GRPCRoute')"
54+
// +kubebuilder:validation:XValidation:message="TargetRef Group must be gateway.networking.k8s.io.",rule="(self.group=='gateway.networking.k8s.io')"
55+
//nolint:lll
5356
TargetRef gatewayv1alpha2.LocalPolicyTargetReference `json:"targetRef"`
5457
}
5558

@@ -95,7 +98,11 @@ type ClientKeepAlive struct {
9598

9699
// Timeout defines the keep-alive timeouts for clients.
97100
//
101+
// +kubebuilder:validation:XValidation:message="header can only be specified if server is specified",rule="!(has(self.header) && !has(self.server))"
102+
//
103+
//
98104
// +optional
105+
//nolint:lll
99106
Timeout *ClientKeepAliveTimeout `json:"timeout,omitempty"`
100107
}
101108

‎apis/v1alpha1/policy_methods.go

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package v1alpha1
2+
3+
import (
4+
"sigs.k8s.io/gateway-api/apis/v1alpha2"
5+
)
6+
7+
// FIXME(kate-osborn): https://github.com/nginxinc/nginx-gateway-fabric/issues/1939.
8+
// Figure out a way to generate these methods for all our policies.
9+
// These methods implement the policies.Policy interface which extends client.Object to add the following methods.
10+
11+
func (p *ClientSettingsPolicy) GetTargetRef() v1alpha2.LocalPolicyTargetReference {
12+
return p.Spec.TargetRef
13+
}
14+
15+
func (p *ClientSettingsPolicy) GetPolicyStatus() v1alpha2.PolicyStatus {
16+
return p.Status
17+
}
18+
19+
func (p *ClientSettingsPolicy) SetPolicyStatus(status v1alpha2.PolicyStatus) {
20+
p.Status = status
21+
}

‎charts/nginx-gateway-fabric/templates/deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,8 @@ spec:
124124
mountPath: /etc/nginx/secrets
125125
- name: nginx-run
126126
mountPath: /var/run/nginx
127+
- name: nginx-includes
128+
mountPath: /etc/nginx/includes
127129
{{- with .Values.nginxGateway.extraVolumeMounts -}}
128130
{{ toYaml . | nindent 8 }}
129131
{{- end }}
@@ -161,6 +163,8 @@ spec:
161163
mountPath: /var/cache/nginx
162164
- name: nginx-lib
163165
mountPath: /var/lib/nginx
166+
- name: nginx-includes
167+
mountPath: /etc/nginx/includes
164168
{{- with .Values.nginx.extraVolumeMounts -}}
165169
{{ toYaml . | nindent 8 }}
166170
{{- end }}
@@ -195,6 +199,8 @@ spec:
195199
emptyDir: {}
196200
- name: nginx-lib
197201
emptyDir: {}
202+
- name: nginx-includes
203+
emptyDir: {}
198204
{{- with .Values.extraVolumes -}}
199205
{{ toYaml . | nindent 6 }}
200206
{{- end }}

‎charts/nginx-gateway-fabric/templates/rbac.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -121,13 +121,15 @@ rules:
121121
- gateway.nginx.org
122122
resources:
123123
- nginxproxies
124+
- clientsettingspolicies
124125
verbs:
125126
- list
126127
- watch
127128
- apiGroups:
128129
- gateway.nginx.org
129130
resources:
130131
- nginxgateways/status
132+
- clientsettingspolicies/status
131133
verbs:
132134
- update
133135
{{- if .Values.nginxGateway.leaderElection.enable }}

‎config/crd/bases/gateway.nginx.org_clientsettingspolicies.yaml

+10-3
Original file line numberDiff line numberDiff line change
@@ -108,14 +108,15 @@ spec:
108108
pattern: ^\d{1,4}(ms|s)?$
109109
type: string
110110
type: object
111+
x-kubernetes-validations:
112+
- message: header can only be specified if server is specified
113+
rule: '!(has(self.header) && !has(self.server))'
111114
type: object
112115
targetRef:
113116
description: |-
114117
TargetRef identifies an API object to apply the policy to.
115118
Object must be in the same namespace as the policy.
116-
117-
118-
Support: Gateway, HTTPRoute
119+
Support: Gateway, HTTPRoute, GRPCRoute.
119120
properties:
120121
group:
121122
description: Group is the group of the target resource.
@@ -138,6 +139,12 @@ spec:
138139
- kind
139140
- name
140141
type: object
142+
x-kubernetes-validations:
143+
- message: 'TargetRef Kind must be one of: Gateway, HTTPRoute, or
144+
GRPCRoute'
145+
rule: (self.kind=='Gateway' || self.kind=='HTTPRoute' || self.kind=='GRPCRoute')
146+
- message: TargetRef Group must be gateway.networking.k8s.io.
147+
rule: (self.group=='gateway.networking.k8s.io')
141148
required:
142149
- targetRef
143150
type: object

‎conformance/provisioner/static-deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ spec:
7676
mountPath: /etc/nginx/secrets
7777
- name: nginx-run
7878
mountPath: /var/run/nginx
79+
- name: nginx-includes
80+
mountPath: /etc/nginx/includes
7981
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
8082
imagePullPolicy: Always
8183
name: nginx
@@ -106,6 +108,8 @@ spec:
106108
mountPath: /var/cache/nginx
107109
- name: nginx-lib
108110
mountPath: /var/lib/nginx
111+
- name: nginx-includes
112+
mountPath: /etc/nginx/includes
109113
terminationGracePeriodSeconds: 30
110114
serviceAccountName: nginx-gateway
111115
shareProcessNamespace: true
@@ -125,3 +129,5 @@ spec:
125129
emptyDir: {}
126130
- name: nginx-lib
127131
emptyDir: {}
132+
- name: nginx-includes
133+
emptyDir: {}

‎deploy/crds.yaml

+10-3
Original file line numberDiff line numberDiff line change
@@ -107,14 +107,15 @@ spec:
107107
pattern: ^\d{1,4}(ms|s)?$
108108
type: string
109109
type: object
110+
x-kubernetes-validations:
111+
- message: header can only be specified if server is specified
112+
rule: '!(has(self.header) && !has(self.server))'
110113
type: object
111114
targetRef:
112115
description: |-
113116
TargetRef identifies an API object to apply the policy to.
114117
Object must be in the same namespace as the policy.
115-
116-
117-
Support: Gateway, HTTPRoute
118+
Support: Gateway, HTTPRoute, GRPCRoute.
118119
properties:
119120
group:
120121
description: Group is the group of the target resource.
@@ -137,6 +138,12 @@ spec:
137138
- kind
138139
- name
139140
type: object
141+
x-kubernetes-validations:
142+
- message: 'TargetRef Kind must be one of: Gateway, HTTPRoute, or
143+
GRPCRoute'
144+
rule: (self.kind=='Gateway' || self.kind=='HTTPRoute' || self.kind=='GRPCRoute')
145+
- message: TargetRef Group must be gateway.networking.k8s.io.
146+
rule: (self.group=='gateway.networking.k8s.io')
140147
required:
141148
- targetRef
142149
type: object

‎deploy/manifests/nginx-gateway-experimental.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -103,13 +103,15 @@ rules:
103103
- gateway.nginx.org
104104
resources:
105105
- nginxproxies
106+
- clientsettingspolicies
106107
verbs:
107108
- list
108109
- watch
109110
- apiGroups:
110111
- gateway.nginx.org
111112
resources:
112113
- nginxgateways/status
114+
- clientsettingspolicies/status
113115
verbs:
114116
- update
115117
- apiGroups:
@@ -228,6 +230,8 @@ spec:
228230
mountPath: /etc/nginx/secrets
229231
- name: nginx-run
230232
mountPath: /var/run/nginx
233+
- name: nginx-includes
234+
mountPath: /etc/nginx/includes
231235
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
232236
imagePullPolicy: Always
233237
name: nginx
@@ -258,6 +262,8 @@ spec:
258262
mountPath: /var/cache/nginx
259263
- name: nginx-lib
260264
mountPath: /var/lib/nginx
265+
- name: nginx-includes
266+
mountPath: /etc/nginx/includes
261267
terminationGracePeriodSeconds: 30
262268
serviceAccountName: nginx-gateway
263269
shareProcessNamespace: true
@@ -277,6 +283,8 @@ spec:
277283
emptyDir: {}
278284
- name: nginx-lib
279285
emptyDir: {}
286+
- name: nginx-includes
287+
emptyDir: {}
280288
---
281289
# Source: nginx-gateway-fabric/templates/gatewayclass.yaml
282290
apiVersion: gateway.networking.k8s.io/v1

‎deploy/manifests/nginx-gateway.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -100,13 +100,15 @@ rules:
100100
- gateway.nginx.org
101101
resources:
102102
- nginxproxies
103+
- clientsettingspolicies
103104
verbs:
104105
- list
105106
- watch
106107
- apiGroups:
107108
- gateway.nginx.org
108109
resources:
109110
- nginxgateways/status
111+
- clientsettingspolicies/status
110112
verbs:
111113
- update
112114
- apiGroups:
@@ -224,6 +226,8 @@ spec:
224226
mountPath: /etc/nginx/secrets
225227
- name: nginx-run
226228
mountPath: /var/run/nginx
229+
- name: nginx-includes
230+
mountPath: /etc/nginx/includes
227231
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
228232
imagePullPolicy: Always
229233
name: nginx
@@ -254,6 +258,8 @@ spec:
254258
mountPath: /var/cache/nginx
255259
- name: nginx-lib
256260
mountPath: /var/lib/nginx
261+
- name: nginx-includes
262+
mountPath: /etc/nginx/includes
257263
terminationGracePeriodSeconds: 30
258264
serviceAccountName: nginx-gateway
259265
shareProcessNamespace: true
@@ -273,6 +279,8 @@ spec:
273279
emptyDir: {}
274280
- name: nginx-lib
275281
emptyDir: {}
282+
- name: nginx-includes
283+
emptyDir: {}
276284
---
277285
# Source: nginx-gateway-fabric/templates/gatewayclass.yaml
278286
apiVersion: gateway.networking.k8s.io/v1

‎deploy/manifests/nginx-plus-gateway-experimental.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,15 @@ rules:
109109
- gateway.nginx.org
110110
resources:
111111
- nginxproxies
112+
- clientsettingspolicies
112113
verbs:
113114
- list
114115
- watch
115116
- apiGroups:
116117
- gateway.nginx.org
117118
resources:
118119
- nginxgateways/status
120+
- clientsettingspolicies/status
119121
verbs:
120122
- update
121123
- apiGroups:
@@ -235,6 +237,8 @@ spec:
235237
mountPath: /etc/nginx/secrets
236238
- name: nginx-run
237239
mountPath: /var/run/nginx
240+
- name: nginx-includes
241+
mountPath: /etc/nginx/includes
238242
- image: nginx-gateway-fabric/nginx-plus:edge
239243
imagePullPolicy: Always
240244
name: nginx
@@ -265,6 +269,8 @@ spec:
265269
mountPath: /var/cache/nginx
266270
- name: nginx-lib
267271
mountPath: /var/lib/nginx
272+
- name: nginx-includes
273+
mountPath: /etc/nginx/includes
268274
terminationGracePeriodSeconds: 30
269275
serviceAccountName: nginx-gateway
270276
shareProcessNamespace: true
@@ -284,6 +290,8 @@ spec:
284290
emptyDir: {}
285291
- name: nginx-lib
286292
emptyDir: {}
293+
- name: nginx-includes
294+
emptyDir: {}
287295
---
288296
# Source: nginx-gateway-fabric/templates/gatewayclass.yaml
289297
apiVersion: gateway.networking.k8s.io/v1

‎deploy/manifests/nginx-plus-gateway.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -106,13 +106,15 @@ rules:
106106
- gateway.nginx.org
107107
resources:
108108
- nginxproxies
109+
- clientsettingspolicies
109110
verbs:
110111
- list
111112
- watch
112113
- apiGroups:
113114
- gateway.nginx.org
114115
resources:
115116
- nginxgateways/status
117+
- clientsettingspolicies/status
116118
verbs:
117119
- update
118120
- apiGroups:
@@ -231,6 +233,8 @@ spec:
231233
mountPath: /etc/nginx/secrets
232234
- name: nginx-run
233235
mountPath: /var/run/nginx
236+
- name: nginx-includes
237+
mountPath: /etc/nginx/includes
234238
- image: nginx-gateway-fabric/nginx-plus:edge
235239
imagePullPolicy: Always
236240
name: nginx
@@ -261,6 +265,8 @@ spec:
261265
mountPath: /var/cache/nginx
262266
- name: nginx-lib
263267
mountPath: /var/lib/nginx
268+
- name: nginx-includes
269+
mountPath: /etc/nginx/includes
264270
terminationGracePeriodSeconds: 30
265271
serviceAccountName: nginx-gateway
266272
shareProcessNamespace: true
@@ -280,6 +286,8 @@ spec:
280286
emptyDir: {}
281287
- name: nginx-lib
282288
emptyDir: {}
289+
- name: nginx-includes
290+
emptyDir: {}
283291
---
284292
# Source: nginx-gateway-fabric/templates/gatewayclass.yaml
285293
apiVersion: gateway.networking.k8s.io/v1

‎docs/proposals/client-settings.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Enhancement Proposal-1632: Client Settings Policy
22

33
- Issue: https://github.com/nginxinc/nginx-gateway-fabric/issues/1632
4-
- Status: Implementable
4+
- Status: Completed
55

66
## Summary
77

‎examples/client-settings-policy/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Client Settings Policy
2+
3+
This directory contains YAML files of ClientSettingsPolicies.

0 commit comments

Comments
 (0)