Introduce GatewayControllerMode

Co-authored-by: Daniel Grimm <dgrimm@redhat.com> Signed-off-by: Yann Liu <yannliu@redhat.com>
maistra · May 21, 2024 · ea070ca · ea070ca
1 parent 5e381e6
commit ea070ca
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/pilot/pkg/bootstrap/server.go b/pilot/pkg/bootstrap/server.go
@@ -1123,7 +1123,7 @@ func (s *Server) initControllers(args *PilotArgs) error {
 
 	s.initSDSServer()
 
-	if features.EnableEnhancedResourceScoping {
+	if features.EnableEnhancedResourceScoping || features.EnableGatewayControllerMode {
 		// setup namespace filter
 		args.RegistryOptions.KubeOptions.DiscoveryNamespacesFilter = s.multiclusterController.DiscoveryNamespacesFilter
 	}

diff --git a/pilot/pkg/features/pilot.go b/pilot/pkg/features/pilot.go
@@ -706,6 +706,10 @@ var (
 			"generated root certificate.").Get()
 
 	EnableFederation = env.RegisterBoolVar("PILOT_ENABLE_FEDERATION", false, "").Get()
+
+	EnableGatewayControllerMode = env.Register("PILOT_ENABLE_GATEWAY_CONTROLLER_MODE", false,
+		"If enabled, istiod will watch Gateway API and k8s resources in every namespace, but Istio resources will be limited to "+
+			"namespaces that match the meshConfig.discoverySelectors").Get()
 )
 
 // UnsafeFeaturesEnabled returns true if any unsafe features are enabled.

diff --git a/pilot/pkg/serviceregistry/kube/controller/controller.go b/pilot/pkg/serviceregistry/kube/controller/controller.go
@@ -276,6 +276,10 @@ func NewController(kubeClient kubelib.Client, options Options) *Controller {
 			)
 		}
 
+		// don't use discoveryFilters if in gw-controller mode. always watch all namespaces
+		if features.EnableGatewayControllerMode {
+			c.opts.DiscoveryNamespacesFilter = namespace.NewDiscoveryNamespacesFilter(c.namespaces, []*metav1.LabelSelector{})
+		}
 		if c.opts.DiscoveryNamespacesFilter == nil {
 			c.opts.DiscoveryNamespacesFilter = namespace.NewDiscoveryNamespacesFilter(c.namespaces, options.MeshWatcher.Mesh().DiscoverySelectors)
 		}