Skip to content

Commit

Permalink
GatewayAPI supports to setting the number of trusted loadbalancer hops
Browse files Browse the repository at this point in the history 
Signed-off-by: chaunceyjiang <chaunceyjiang@gmail.com>
  • Loading branch information
@chaunceyjiang
chaunceyjiang committed Feb 22, 2024
1 parent 399beb7 commit 2c7753c
Show file tree
Hide file tree
Showing 17 changed files with 77 additions and 65 deletions.
1 change: 1 addition & 0 deletions Documentation/cmdref/cilium-operator-alibabacloud.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Documentation/cmdref/cilium-operator-aws.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Documentation/cmdref/cilium-operator-azure.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Documentation/cmdref/cilium-operator-generic.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Documentation/cmdref/cilium-operator.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions operator/cmd/flags.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,9 @@ func InitGlobalFlags(cmd *cobra.Command, vp *viper.Viper) {
flags.Uint32(operatorOption.IngressDefaultXffNumTrustedHops, 0, "The number of additional ingress proxy hops from the right side of the HTTP header to trust when determining the origin client's IP address.")
option.BindEnv(vp, operatorOption.IngressDefaultXffNumTrustedHops)

flags.Uint32(operatorOption.GatewayAPIDefaultXffNumTrustedHops, 0, "The number of additional GatewayAPI proxy hops from the right side of the HTTP header to trust when determining the origin client's IP address.")
option.BindEnv(vp, operatorOption.GatewayAPIDefaultXffNumTrustedHops)

flags.String(operatorOption.PodRestartSelector, "k8s-app=kube-dns", "cilium-operator will delete/restart any pods with these labels if the pod is not managed by Cilium. If this option is empty, then all pods may be restarted")
option.BindEnv(vp, operatorOption.PodRestartSelector)

Expand Down
9 changes: 9 additions & 0 deletions operator/option/config.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,9 @@ const (
// IngressDefaultXffNumTrustedHops is the default XffNumTrustedHops value for Ingress.
IngressDefaultXffNumTrustedHops = "ingress-default-xff-num-trusted-hops"

// GatewayAPIDefaultXffNumTrustedHops is the default XffNumTrustedHops value for GatewayAPI.
GatewayAPIDefaultXffNumTrustedHops = "gateway-api-default-xff-num-trusted-hops"

// PodRestartSelector specify the labels contained in the pod that needs to be restarted before the node can be de-stained
// default values: k8s-app=kube-dns
PodRestartSelector = "pod-restart-selector"
Expand Down Expand Up @@ -450,6 +453,11 @@ type OperatorConfig struct {
// The default is zero if this option is not specified.
IngressProxyXffNumTrustedHops uint32

// GatewayAPIProxyXffNumTrustedHops The number of additional GatewayAPI proxy hops from the right side of the
// HTTP header to trust when determining the origin client's IP address.
// The default is zero if this option is not specified.
GatewayAPIProxyXffNumTrustedHops uint32

// PodRestartSelector specify the labels contained in the pod that needs to be restarted before the node can be de-stained
PodRestartSelector string
}
Expand Down Expand Up @@ -484,6 +492,7 @@ func (c *OperatorConfig) Populate(vp *viper.Viper) {
c.SetCiliumNodeTaints = vp.GetBool(SetCiliumNodeTaints)
c.SetCiliumIsUpCondition = vp.GetBool(SetCiliumIsUpCondition)
c.IngressProxyXffNumTrustedHops = vp.GetUint32(IngressDefaultXffNumTrustedHops)
c.GatewayAPIProxyXffNumTrustedHops = vp.GetUint32(GatewayAPIDefaultXffNumTrustedHops)
c.PodRestartSelector = vp.GetString(PodRestartSelector)

c.CiliumK8sNamespace = vp.GetString(CiliumK8sNamespace)
Expand Down
2 changes: 1 addition & 1 deletion operator/pkg/gateway-api/cell.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ func initGatewayAPIController(params gatewayAPIParams) error {
return err
}

cecTranslator := translation.NewCECTranslator(params.Config.GatewayAPISecretsNamespace, params.Config.EnableGatewayAPIProxyProtocol, true, operatorOption.Config.ProxyIdleTimeoutSeconds)
cecTranslator := translation.NewCECTranslator(params.Config.GatewayAPISecretsNamespace, params.Config.EnableGatewayAPIProxyProtocol, true, operatorOption.Config.ProxyIdleTimeoutSeconds, operatorOption.Config.GatewayAPIProxyXffNumTrustedHops)
gatewayAPITranslator := gatewayApiTranslation.NewTranslator(cecTranslator)

if err := registerReconcilers(
Expand Down
2 changes: 1 addition & 1 deletion operator/pkg/gateway-api/gateway_reconcile_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,7 @@ func Test_gatewayReconciler_Reconcile(t *testing.T) {
WithStatusSubresource(&gatewayv1.Gateway{}).
Build()

cecTranslator := translation.NewCECTranslator("", false, true, 60)
cecTranslator := translation.NewCECTranslator("", false, true, 60, 0)
gatewayAPITranslator := gatewayApiTranslation.NewTranslator(cecTranslator)

r := &gatewayReconciler{
Expand Down
2 changes: 1 addition & 1 deletion operator/pkg/ingress/cell.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ func registerReconciler(params ingressParams) error {
return nil
}

cecTranslator := translation.NewCECTranslator(params.Config.IngressSecretsNamespace, params.Config.EnableIngressProxyProtocol, false, operatorOption.Config.ProxyIdleTimeoutSeconds)
cecTranslator := translation.NewCECTranslator(params.Config.IngressSecretsNamespace, params.Config.EnableIngressProxyProtocol, false, operatorOption.Config.ProxyIdleTimeoutSeconds, operatorOption.Config.IngressProxyXffNumTrustedHops)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(
Expand Down
30 changes: 15 additions & 15 deletions operator/pkg/ingress/ingress_reconcile_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -113,7 +113,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -169,7 +169,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -213,7 +213,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -283,7 +283,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -350,7 +350,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -404,7 +404,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -486,7 +486,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -558,7 +558,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -614,7 +614,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -654,7 +654,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -695,7 +695,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{"test.acme.io/"}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -780,7 +780,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -845,7 +845,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down Expand Up @@ -887,7 +887,7 @@ func TestReconcile(t *testing.T) {
).
Build()

cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout)
cecTranslator := translation.NewCECTranslator(testCiliumSecretsNamespace, testUseProxyProtocol, false, testDefaultTimeout, 0)
dedicatedIngressTranslator := ingressTranslation.NewDedicatedIngressTranslator(cecTranslator)

reconciler := newIngressReconciler(logger, fakeClient, cecTranslator, dedicatedIngressTranslator, testCiliumNamespace, []string{}, testDefaultLoadbalancingServiceName, "dedicated", testDefaultSecretNamespace, testDefaultSecretName, false)
Expand Down

0 comments on commit 2c7753c

Please sign in to comment.