HTTPRoute: Support Cross-Namespace Middleware Reference

[mruoss]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

Currently when defining middlewares through filters in HTTPRoute Kubernetes resources (i.e. using the Gateway API), we seem to be restricted to middlewares in the same Kubernetes namespace as the HTTPRoute resource as extensionRef seems to be a LocalObjectReference.

It would be nice to being able to reference middlewares from different namespaces, too.

[rtribotte]

Thanks @mruoss for this suggestion!

We are interested in your use case, could you please elaborate?

At first glance, the Gateway API spec does not cover this use case.
However, the spec may evolve in this regard, for example by introducing referenceGrant for localObjectReference.
As an extension point, with an implementation-specific level of support, we could also decide to allow cross-namespace references somehow.

Also, while we are interested in this issue, we will leave the status as kind/proposal to give the community time to let us know if they would like this idea.

We will reevaluate as people respond.

The conversation is timed to 6 months.

[reitermarkus]

We are interested in your use case, could you please elaborate?

The use case is the same as when using IngressRoute, which supports different namespaces.

For example, I have a only-allow-private-networks Middleware defined in my traefik-system namespace, which is currently used by all IngressRoutes for internal services which are in different namespaces. Otherwise, I'd have to duplicate the same middleware in every namespace.

It should be possible to support this by providing the full middleware name, e.g. traefik-system-only-allow-private-networks@kubernetescrd, since @ is not a valid character for middleware names anyways.

[travisgroth]

I just found this issue trying to figure out how to do this for the same use case. I have a defined middleware for authentication in my traefik namespace and would like to use it for multiple httproutes across my cluster. Without this feature, I would need to duplicate the middleware and supporting secrets into several namespaces, which feels like unnecessary toil.

At first glance, middleware across namespaces seems like a different concern than httproute backend across namespaces. In the case of a backend, you create a security issue if you allow cross-namespace targeting to bypass the owner's httproute - as this might be bypassing auth or other security middleware. I'm not sure consuming middleware across namespaces poses the same risk profile. The httproute owner in this case is explicitly opting to trust middleware from another namespace, which feels like a fair risk to allow them to take on.

[aadje]

A use case can be to have a single IPAllowList or BasicAuth Middleware deployed which can be used by HttpRoutes in different namespaces.

A workaround could be to use the Chain Middleware in an HttpRoute, which allows for referencing Middlewares in different namespaces.

[nmengin]

Hey there,

Thank you for the suggestion and the feedback.

Even if we are interested in this feature, the Gateway API hasn't allowed such behavior yet (only TLS certificates, HTTPRoute, and Services can be referenced from another namespace).

We prefer closing this proposal, we'll re-open it when the specification will allow this kind of reference.