Skip to content

Commit 7596bf7

Browse files
ciarams87ciarams87
authored
feat: Add BackendTLS Policy support (#1487)
* Add BackendTLS Policy support
1 parent f8601db commit 7596bf7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+4297
-206
lines changed

‎.github/workflows/conformance.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
matrix:
3131
k8s-version: ["1.23.17", "latest"]
3232
nginx-image: [nginx, nginx-plus]
33+
enable-experimental: [true, false]
3334
permissions:
3435
contents: write # needed for uploading release artifacts
3536
steps:
@@ -148,6 +149,7 @@ jobs:
148149
ngf_tag=${{ steps.ngf-meta.outputs.version }}
149150
if [ ${{ github.event_name }} == "schedule" ]; then export GW_API_VERSION=main; fi
150151
if [ ${{ startsWith(matrix.k8s-version, '1.23') || startsWith(matrix.k8s-version, '1.24') }} == "true" ]; then export INSTALL_WEBHOOK=true; fi
152+
if [ ${{ matrix.enable-experimental }} == "true" ]; then export ENABLE_EXPERIMENTAL=true; fi
151153
make install-ngf-local-no-build${{ matrix.nginx-image == 'nginx-plus' && '-with-plus' || ''}} PREFIX=${ngf_prefix} TAG=${ngf_tag}
152154
working-directory: ./conformance
153155

‎.gitleaksignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
68d1f6eb80d23c8650c11629459dd6a06c986ca1:internal/state/graph/graph_test.go:private-key:44
44
890fddb787ff3560b9b743647a36b649d498ae51:internal/state/graph/secret_test.go:private-key:35
55
890fddb787ff3560b9b743647a36b649d498ae51:internal/state/change_processor_test.go:private-key:211
6+
internal/mode/static/state/graph/config_maps_test.go:private-key:35

‎Makefile

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,18 +81,17 @@ generate-crds: ## Generate CRDs and Go types using kubebuilder
8181
go run sigs.k8s.io/controller-tools/cmd/controller-gen object paths=./apis/...
8282

8383
.PHONY: generate-manifests
84-
generate-manifests: generate-manifests-plus ## Generate manifests using Helm.
84+
generate-manifests: ## Generate manifests using Helm.
8585
cp $(CHART_DIR)/crds/* $(MANIFEST_DIR)/crds/
8686
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-gateway.yaml
87+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway.yaml
88+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginxGateway.gwAPIExperimentalFeatures.enable=true -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-gateway-experimental.yaml
89+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginxGateway.gwAPIExperimentalFeatures.enable=true --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway-experimental.yaml
8790
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set metrics.enable=false -n nginx-gateway -s templates/deployment.yaml > conformance/provisioner/static-deployment.yaml
8891
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer.yaml
8992
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.annotations.'service\.beta\.kubernetes\.io\/aws-load-balancer-type'="nlb" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer-aws-nlb.yaml
9093
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.type=NodePort --set service.externalTrafficPolicy="" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/nodeport.yaml
9194

92-
.PHONY: generate-manifests-plus
93-
generate-manifests-plus: ## Generate manifests using Helm for NGINX Plus.
94-
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway.yaml
95-
9695
.PHONY: crds-release-file
9796
crds-release-file: ## Generate combined crds file for releases
9897
scripts/combine-crds.sh

‎cmd/gateway/commands.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func createStaticModeCommand() *cobra.Command {
5656
leaderElectionDisableFlag = "leader-election-disable"
5757
leaderElectionLockNameFlag = "leader-election-lock-name"
5858
plusFlag = "nginx-plus"
59+
gwAPIExperimentalFlag = "gateway-api-experimental-features"
5960
)
6061

6162
// flag values
@@ -95,6 +96,8 @@ func createStaticModeCommand() *cobra.Command {
9596
}
9697

9798
plus bool
99+
100+
gwExperimentalFeatures bool
98101
)
99102

100103
cmd := &cobra.Command{
@@ -172,6 +175,7 @@ func createStaticModeCommand() *cobra.Command {
172175
Plus: plus,
173176
TelemetryReportPeriod: period,
174177
Version: version,
178+
ExperimentalFeatures: gwExperimentalFeatures,
175179
}
176180

177181
if err := static.StartManager(conf); err != nil {
@@ -285,6 +289,14 @@ func createStaticModeCommand() *cobra.Command {
285289
"Use NGINX Plus",
286290
)
287291

292+
cmd.Flags().BoolVar(
293+
&gwExperimentalFeatures,
294+
gwAPIExperimentalFlag,
295+
false,
296+
"Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. "+
297+
"Requires the Gateway APIs installed from the experimental channel.",
298+
)
299+
288300
return cmd
289301
}
290302

‎conformance/Makefile

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ CRDS=../deploy/manifests/crds/
1515
STATIC_MANIFEST=provisioner/static-deployment.yaml
1616
PROVISIONER_MANIFEST=provisioner/provisioner.yaml
1717
INSTALL_WEBHOOK ?= false
18+
ENABLE_EXPERIMENTAL ?= false
1819
.DEFAULT_GOAL := help
1920

2021
.PHONY: help
@@ -37,7 +38,7 @@ create-kind-cluster: ## Create a kind cluster
3738

3839
.PHONY: update-ngf-manifest
3940
update-ngf-manifest: ## Update the NGF deployment manifest image names and imagePullPolicies
40-
cd .. && make generate-manifests HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE="--set nginxGateway.kind=skip" HELM_TEMPLATE_COMMON_ARGS="--set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never" && cd -
41+
cd .. && make generate-manifests HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE="--set nginxGateway.kind=skip" HELM_TEMPLATE_COMMON_ARGS="--set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never --set nginxGateway.experimentalFeatures.enable=$(ENABLE_EXPERIMENTAL)" && cd -
4142

4243
.PHONY: update-ngf-manifest-with-plus
4344
update-ngf-manifest-with-plus: ## Update the NGF deployment manifest image names and imagePullPolicies including nginx-plus
@@ -61,7 +62,7 @@ load-images-with-plus: ## Load NGF and NGINX Plus images on configured kind clus
6162

6263
.PHONY: prepare-ngf-dependencies
6364
prepare-ngf-dependencies: update-ngf-manifest ## Install NGF dependencies on configured kind cluster
64-
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
65+
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
6566
kubectl apply -f $(CRDS)
6667
kubectl apply -f $(NGF_MANIFEST)
6768

@@ -118,7 +119,7 @@ uninstall-ngf: uninstall-k8s-components undo-manifests-update ## Uninstall NGF o
118119
.PHONY: uninstall-k8s-components
119120
uninstall-k8s-components: ## Uninstall installed components on configured kind cluster
120121
-kubectl delete -f $(NGF_MANIFEST)
121-
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
122+
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
122123
kubectl delete clusterrole nginx-gateway-provisioner
123124
kubectl delete clusterrolebinding nginx-gateway-provisioner
124125

‎conformance/README.md

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -44,23 +44,24 @@ update-ngf-manifest Update the NGF deployment manifest image na
4444

4545
**Note:** The following variables are configurable when running the below `make` commands:
4646

47-
| Variable | Default | Description |
48-
|----------------------|---------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
49-
| CONFORMANCE_TAG | latest | The tag for the conformance test image |
50-
| CONFORMANCE_PREFIX | conformance-test-runner | The prefix for the conformance test image |
51-
| TAG | edge | The tag for the locally built NGF image |
52-
| PREFIX | nginx-gateway-fabric | The prefix for the locally built NGF image |
53-
| GW_API_VERSION | 1.0.0 | Tag for the Gateway API version to check out. Set to `main` to get the latest version |
54-
| KIND_IMAGE | Latest kind image, as defined in the tests/Dockerfile | The kind image to use |
55-
| KIND_KUBE_CONFIG | ~/.kube/kind/config | The location of the kubeconfig |
56-
| GATEWAY_CLASS | nginx | The gateway class that should be used for the tests |
57-
| SUPPORTED_FEATURES | HTTPRoute,HTTPRouteQueryParamMatching, HTTPRouteMethodMatching,HTTPRoutePortRedirect, HTTPRouteSchemeRedirect | The supported features that should be tested by the conformance tests. Ensure the list is comma separated with no spaces. |
58-
| EXEMPT_FEATURES | ReferenceGrant | The features that should not be tested by the conformance tests |
59-
| NGF_MANIFEST | ../deploy/manifests/nginx-gateway.yaml | The location of the NGF manifest |
60-
| SERVICE_MANIFEST | ../deploy/manifests/service/nodeport.yaml | The location of the NGF Service manifest |
61-
| STATIC_MANIFEST | provisioner/static-deployment.yaml | The location of the NGF static deployment manifest |
62-
| PROVISIONER_MANIFEST | provisioner/provisioner.yaml | The location of the NGF provisioner manifest |
63-
| INSTALL_WEBHOOK | false | Install the Gateway API Validating Webhook. Necessary for Kubernetes versions < 1.25. |
47+
| Variable | Default | Description |
48+
| -------------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
49+
| CONFORMANCE_TAG | latest | The tag for the conformance test image |
50+
| CONFORMANCE_PREFIX | conformance-test-runner | The prefix for the conformance test image |
51+
| TAG | edge | The tag for the locally built NGF image |
52+
| PREFIX | nginx-gateway-fabric | The prefix for the locally built NGF image |
53+
| GW_API_VERSION | 1.0.0 | Tag for the Gateway API version to check out. Set to `main` to get the latest version |
54+
| KIND_IMAGE | Latest kind image, as defined in the tests/Dockerfile | The kind image to use |
55+
| KIND_KUBE_CONFIG | ~/.kube/kind/config | The location of the kubeconfig |
56+
| GATEWAY_CLASS | nginx | The gateway class that should be used for the tests |
57+
| SUPPORTED_FEATURES | HTTPRoute,HTTPRouteQueryParamMatching, HTTPRouteMethodMatching,HTTPRoutePortRedirect, HTTPRouteSchemeRedirect | The supported features that should be tested by the conformance tests. Ensure the list is comma separated with no spaces. |
58+
| EXEMPT_FEATURES | ReferenceGrant | The features that should not be tested by the conformance tests |
59+
| NGF_MANIFEST | ../deploy/manifests/nginx-gateway.yaml | The location of the NGF manifest |
60+
| SERVICE_MANIFEST | ../deploy/manifests/service/nodeport.yaml | The location of the NGF Service manifest |
61+
| STATIC_MANIFEST | provisioner/static-deployment.yaml | The location of the NGF static deployment manifest |
62+
| PROVISIONER_MANIFEST | provisioner/provisioner.yaml | The location of the NGF provisioner manifest |
63+
| INSTALL_WEBHOOK | false | Install the Gateway API Validating Webhook. Necessary for Kubernetes versions < 1.25. |
64+
| ENABLE_EXPERIMENTAL | false | Enable experimental features. Installs the Gateway APIs from the experimental channel and enables any supported experimental features in NGF. |
6465

6566
### Step 1 - Create a kind Cluster
6667

@@ -85,6 +86,12 @@ make create-kind-cluster KIND_IMAGE=kindest/node:v1.27.3
8586
```
8687

8788
> Otherwise, the latest stable version will be used by default.
89+
> Additionally, if you want to run conformance tests with experimental features enabled, set the following
90+
> environment variable before deploying NGF:
91+
92+
```bash
93+
export ENABLE_EXPERIMENTAL=true
94+
```
8895

8996
#### *Option 1* Build and install NGINX Gateway Fabric from local to configured kind cluster
9097

‎conformance/scripts/install-gateway.sh

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,22 @@ if [ $1 == "main" ]; then
1414
temp_dir=$(mktemp -d)
1515
cd ${temp_dir}
1616
curl -s https://codeload.github.com/kubernetes-sigs/gateway-api/tar.gz/main | tar -xz --strip=2 gateway-api-main/config
17-
kubectl apply -f crd/standard
17+
if [ $3 == "true" ]; then
18+
kubectl apply -f crd/experimental
19+
else
20+
kubectl apply -f crd/standard
21+
fi
1822
if [ $2 == "true" ]; then
1923
kubectl apply -f webhook
2024
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system
2125
fi
2226
rm -rf ${temp_dir}
2327
else
24-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
28+
if [ $3 == "true" ]; then
29+
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/experimental-install.yaml
30+
else
31+
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
32+
fi
2533
if [ $2 == "true" ]; then
2634
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/webhook-install.yaml
2735
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system

0 commit comments

Comments
 (0)