feat: supports GatewayTLS policy attachment

charts/fsm/templates/fsm-rbac.yaml

@@ -132,13 +132,13 @@ rules:
 
   # PolicyAttachment
   - apiGroups: [ "gateway.flomesh.io" ]
-    resources: [ "ratelimitpolicies", "sessionstickypolicies", "loadbalancerpolicies", "circuitbreakingpolicies", "accesscontrolpolicies", "healthcheckpolicies", "faultinjectionpolicies", "upstreamtlspolicies", "retrypolicies" ]
+    resources: [ "ratelimitpolicies", "sessionstickypolicies", "loadbalancerpolicies", "circuitbreakingpolicies", "accesscontrolpolicies", "healthcheckpolicies", "faultinjectionpolicies", "upstreamtlspolicies", "retrypolicies", "gatewaytlspolicies" ]
     verbs: [ "get", "list", "watch", "create", "update", "patch", "delete" ]
   - apiGroups: [ "gateway.flomesh.io" ]
-    resources: [ "ratelimitpolicies/finalizers", "sessionstickypolicies/finalizers", "loadbalancerpolicies/finalizers", "circuitbreakingpolicies/finalizers", "accesscontrolpolicies/finalizers", "healthcheckpolicies/finalizers", "faultinjectionpolicies/finalizers", "upstreamtlspolicies/finalizers", "retrypolicies/finalizers" ]
+    resources: [ "ratelimitpolicies/finalizers", "sessionstickypolicies/finalizers", "loadbalancerpolicies/finalizers", "circuitbreakingpolicies/finalizers", "accesscontrolpolicies/finalizers", "healthcheckpolicies/finalizers", "faultinjectionpolicies/finalizers", "upstreamtlspolicies/finalizers", "retrypolicies/finalizers", "gatewaytlspolicies/finalizers"]
     verbs: [ "update" ]
   - apiGroups: [ "gateway.flomesh.io" ]
-    resources: [ "ratelimitpolicies/status", "sessionstickypolicies/status", "loadbalancerpolicies/status", "circuitbreakingpolicies/status", "accesscontrolpolicies/status", "healthcheckpolicies/status", "faultinjectionpolicies/status", "upstreamtlspolicies/status", "retrypolicies/status" ]
+    resources: [ "ratelimitpolicies/status", "sessionstickypolicies/status", "loadbalancerpolicies/status", "circuitbreakingpolicies/status", "accesscontrolpolicies/status", "healthcheckpolicies/status", "faultinjectionpolicies/status", "upstreamtlspolicies/status", "retrypolicies/status", "gatewaytlspolicies/status"]
     verbs: [ "get", "patch", "update" ]
 
   # Used for interacting with cert-manager CertificateRequest resources.

charts/gateway/templates/deployment.yaml

@@ -38,7 +38,7 @@ spec:
       initContainers:
       - name: wait-controller
         image: {{ .Values.fsm.curlImage }}
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: {{ .Values.fsm.image.pullPolicy }}
         command:
           - curl
           - {{ printf "http://fsm-controller.%s.svc.cluster.local:9091/health/ready" .Values.fsm.fsmNamespace }}

charts/namespaced-ingress/templates/deployment.yaml

@@ -38,7 +38,7 @@ spec:
       initContainers:
       - name: wait-controller
         image: {{ .Values.fsm.curlImage }}
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: {{ .Values.fsm.image.pullPolicy }}
         command:
           - curl
           - {{ printf "http://fsm-controller.%s.svc.cluster.local:9091/health/ready" .Values.fsm.fsmNamespace }}

cmd/cli/flb_disable.go

@@ -98,7 +98,7 @@ func (cmd *flbDisableCmd) run() error {
 		return err
 	}
 
-	fmt.Fprintf(cmd.out, "service-lb is disabled successfully\n")
+	fmt.Fprintf(cmd.out, "FLB is disabled successfully\n")
 
 	return nil
 }

cmd/cli/flb_enable.go

@@ -139,7 +139,7 @@ func (cmd *flbEnableCmd) run() error {
 	}
 
 	if mc.Spec.ServiceLB.Enabled {
-		fmt.Fprintf(cmd.out, "service-lb is enabled already, no action needed\n")
+		fmt.Fprintf(cmd.out, "FLB is enabled already, no action needed\n")
 		return nil
 	}
 

cmd/cli/mesh_upgrade.go

@@ -6,6 +6,9 @@ import (
 	"io"
 	"time"
 
+	"github.com/pkg/errors"
+	"sigs.k8s.io/yaml"
+
 	"github.com/spf13/cobra"
 	helm "helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/chart"
@@ -52,7 +55,8 @@ type meshUpgradeCmd struct {
 	meshName string
 	chart    *chart.Chart
 
-	setOptions []string
+	setOptions []string // --set
+	valueFiles []string // -f/--values
 }
 
 func newMeshUpgradeCmd(config *helm.Configuration, out io.Writer) *cobra.Command {
@@ -84,6 +88,7 @@ func newMeshUpgradeCmd(config *helm.Configuration, out io.Writer) *cobra.Command
 	f.StringVar(&upg.meshName, "mesh-name", defaultMeshName, "Name of the mesh to upgrade")
 	f.StringVar(&chartPath, "fsm-chart-path", "", "path to fsm chart to override default chart")
 	f.StringArrayVar(&upg.setOptions, "set", nil, "Set arbitrary chart values (can specify multiple or separate values with commas: key1=val1,key2=val2)")
+	f.StringSliceVarP(&upg.valueFiles, "values", "f", []string{}, "Specify values in a YAML file (can specify multiple)")
 
 	return cmd
 }
@@ -97,11 +102,28 @@ func (u *meshUpgradeCmd) run(config *helm.Configuration) error {
 		}
 	}
 
-	// Add the overlay values to be updated to the current release's values map
-	values, err := u.resolveValues()
+	// values represents the overrides for the FSM chart's values.yaml file
+	setValues, err := u.resolveValues()
+	if err != nil {
+		return err
+	}
+	debug("setValues: %s", setValues)
+
+	fileValues, err := u.resoleValuesFromFiles()
 	if err != nil {
 		return err
 	}
+	debug("fileValues: %s", fileValues)
+
+	// --set takes precedence over --values/-f
+	values := mergeMaps(fileValues, setValues)
+	debug("values: %s", values)
+
+	// Add the overlay values to be updated to the current release's values map
+	//values, err := u.resolveValues()
+	//if err != nil {
+	//	return err
+	//}
 
 	upgradeClient := helm.NewUpgrade(config)
 	upgradeClient.Wait = true
@@ -124,3 +146,25 @@ func (u *meshUpgradeCmd) resolveValues() (map[string]interface{}, error) {
 	}
 	return vals, nil
 }
+
+func (u *meshUpgradeCmd) resoleValuesFromFiles() (map[string]interface{}, error) {
+	base := map[string]interface{}{}
+
+	// User specified a values files via -f/--values
+	for _, filePath := range u.valueFiles {
+		currentMap := map[string]interface{}{}
+
+		valueBytes, err := readFile(filePath)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := yaml.Unmarshal(valueBytes, &currentMap); err != nil {
+			return nil, errors.Wrapf(err, "failed to parse %s", filePath)
+		}
+		// Merge with the previous map
+		base = mergeMaps(base, currentMap)
+	}
+
+	return base, nil
+}

cmd/fsm-bootstrap/crds/gateway.flomesh.io_gatewaytlspolicies.yaml

@@ -0,0 +1,198 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.12.1
+  labels:
+    app.kubernetes.io/name: flomesh.io
+  name: gatewaytlspolicies.gateway.flomesh.io
+spec:
+  group: gateway.flomesh.io
+  names:
+    kind: GatewayTLSPolicy
+    listKind: GatewayTLSPolicyList
+    plural: gatewaytlspolicies
+    singular: gatewaytlspolicy
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: GatewayTLSPolicy is the Schema for the GatewayTLSPolicy API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: GatewayTLSPolicySpec defines the desired state of GatewayTLSPolicy
+            properties:
+              config:
+                description: DefaultConfig is the default Gateway TLS configuration
+                  for all ports
+                properties:
+                  mTLS:
+                    default: false
+                    description: MTLS defines if the gateway port should use mTLS
+                      or not
+                    type: boolean
+                type: object
+              ports:
+                description: Ports is the Gateway TLS configuration for ports
+                items:
+                  description: PortGatewayTLS defines the Gateway TLS configuration
+                    for a port
+                  properties:
+                    config:
+                      description: Config is the Gateway TLS configuration for the
+                        port
+                      properties:
+                        mTLS:
+                          default: false
+                          description: MTLS defines if the gateway port should use
+                            mTLS or not
+                          type: boolean
+                      type: object
+                    port:
+                      description: Port is the port number of the target service
+                      format: int32
+                      maximum: 65535
+                      minimum: 1
+                      type: integer
+                  required:
+                  - port
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-map-keys:
+                - port
+                x-kubernetes-list-type: map
+              targetRef:
+                description: TargetRef is the reference to the target resource to
+                  which the policy is applied
+                properties:
+                  group:
+                    description: Group is the group of the target resource.
+                    maxLength: 253
+                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  kind:
+                    description: Kind is kind of the target resource.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                    type: string
+                  name:
+                    description: Name is the name of the target resource.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace is the namespace of the referent. When
+                      unspecified, the local namespace is inferred. Even when policy
+                      targets a resource in a different namespace, it MUST only apply
+                      to traffic originating from the same namespace as the policy.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                    type: string
+                required:
+                - group
+                - kind
+                - name
+                type: object
+            required:
+            - targetRef
+            type: object
+          status:
+            description: GatewayTLSPolicyStatus defines the observed state of GatewayTLSPolicy
+            properties:
+              conditions:
+                description: Conditions describe the current conditions of the GatewayTLSPolicy.
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                maxItems: 8
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}