Route ParentRef field does not mention ReferencePolicy

[jpeach]

What happened:

The Namespace field of the ParentRef structure doesn't mention whether a ReferencePolicy is required for the controller to follow a cross-namespace reference.

What you expected to happen:

I would expect all cross-namespace references to check a ReferencePolicy.

[jpeach]

CommonRouteSpec says

For Gateways, that means the Gateway needs to allow attachment from Routes of this kind and namespace.

which I take to mean that ReferencePolicy is required. So this issue is just about making it clearer.

[robscott]

@jpeach I agree that this does need more clarification. My perspective here is that something in the target namespace needs to explicitly allow references to a resource from resources in other namespaces for them to be considered valid. In the case of ParentRef, when it refers to Gateway, a ReferencePolicy is not relevant because the Gateway itself can configure where Routes can be attached from. On the other hand, a ReferencePolicy would be relevant when attaching to some other parent resource that did not have that kind of built in capability.

[jpeach]

@robscott I completely forgot about the AllowedRoutes field in the Gateway. While it is probably a bit unfortunate that we have two similar mechanisms, thinking about consolidation would have to be in the next API version.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[youngnick]

/remove-lifecycle stale

I think that we should say that any resource that can act as a ParentRef must include something that acts like AllowedRoutes if it supports cross-namespace attachment. ReferencePolicy should be used for objects that don't have a direct Gateway API attachment formed, or that we can't change the spec of, like Secret and Service.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[youngnick]

/remove-lifecycle stale

The remaining action here is a some guidance to API designers (ie, us), that we should use a field like AllowedRoutes where we control the spec on both sides of the two-way handshake, and ReferencePolicy where we don't.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[youngnick]

/remove-lifecycle stale

I'll get this one done.

/assign