feat: support SSL

internal/controller/gateway_controller.go

@@ -6,8 +6,12 @@ import (
 	"reflect"
 
 	"github.com/api7/api7-ingress-controller/internal/controller/config"
+	"github.com/api7/api7-ingress-controller/internal/controlplane"
+	"github.com/api7/api7-ingress-controller/internal/controlplane/translator"
 	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -23,9 +27,9 @@ import (
 // GatewayReconciler reconciles a Gateway object.
 type GatewayReconciler struct { //nolint:revive
 	client.Client
-	Scheme *runtime.Scheme
-
-	Log logr.Logger
+	Scheme             *runtime.Scheme
+	ControlPlaneClient controlplane.Controlplane
+	Log                logr.Logger
 }
 
 // SetupWithManager sets up the controller with the Manager.
@@ -49,7 +53,7 @@ func (r *GatewayReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	if err := r.Get(ctx, req.NamespacedName, gateway); err != nil {
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
-
+	ns := gateway.GetNamespace()
 	if !r.checkGatewayClass(gateway) {
 		return ctrl.Result{}, nil
 	}
@@ -74,13 +78,36 @@ func (r *GatewayReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	}
 
 	r.Log.Info("gateway has been accepted", "gateway", gateway.GetName())
+	type status struct {
+		status bool
+		msg    string
+	}
+	acceptStatus := status{
+		status: true,
+		msg:    acceptedMessage("gateway"),
+	}
+	tctx := &translator.TranslateContext{
+		Secrets: make(map[types.NamespacedName]*corev1.Secret),
+	}
+	if err := r.processListenerConfig(tctx, gateway.Spec.Listeners, ns); err != nil {
+		acceptStatus = status{
+			status: false,
+			msg:    err.Error(),
+		}
+	}
+	if err := r.ControlPlaneClient.Update(ctx, tctx, gateway); err != nil {
+		acceptStatus = status{
+			status: false,
+			msg:    err.Error(),
+		}
+	}
 
 	ListenerStatuses, err := getListenerStatus(ctx, r.Client, gateway)
 	if err != nil {
 		return ctrl.Result{}, err
 	}
 
-	accepted := SetGatewayConditionAccepted(gateway, true, acceptedMessage("gateway"))
+	accepted := SetGatewayConditionAccepted(gateway, acceptStatus.status, acceptStatus.msg)
 	Programmed := SetGatewayConditionProgrammed(gateway, conditionProgrammedStatus, conditionProgrammedMsg)
 	if accepted || Programmed || len(addrs) > 0 || len(ListenerStatuses) > 0 {
 		if len(addrs) > 0 {
@@ -183,3 +210,24 @@ func (r *GatewayReconciler) listGatewaysForHTTPRoute(_ context.Context, obj clie
 	}
 	return recs
 }
+
+func (r *GatewayReconciler) processListenerConfig(tctx *translator.TranslateContext, listeners []gatewayv1.Listener, ns string) error {
+	var terror error
+	for _, listener := range listeners {
+		secret := corev1.Secret{}
+		for _, ref := range listener.TLS.CertificateRefs {
+			if ref.Namespace != nil {
+				ns = string(*ref.Namespace)
+			}
+			if err := r.Get(context.Background(), client.ObjectKey{
+				Namespace: ns,
+				Name:      string(ref.Name),
+			}, &secret); err != nil {
+				terror = err
+				break
+			}
+			tctx.Secrets[types.NamespacedName{Namespace: ns, Name: string(ref.Name)}] = &secret
+		}
+	}
+	return terror
+}

internal/controlplane/controlplane.go

@@ -49,6 +49,8 @@ func (d *dashboardClient) Update(ctx context.Context, tctx *translator.Translate
 	switch obj := obj.(type) {
 	case *gatewayv1.HTTPRoute:
 		result, err = d.translator.TranslateGatewayHTTPRoute(tctx, obj.DeepCopy())
+	case *gatewayv1.Gateway:
+		result, err = d.translator.TranslateGateway(tctx, obj.DeepCopy())
 	}
 	if err != nil {
 		return err
@@ -65,6 +67,11 @@ func (d *dashboardClient) Update(ctx context.Context, tctx *translator.Translate
 			return err
 		}
 	}
+	for _, ssl := range result.SSL {
+		if _, err := d.c.Cluster(name).SSL().Update(ctx, ssl); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 

internal/controlplane/translator/gateway.go

@@ -1 +1,32 @@
 package translator
+
+import (
+	v1 "github.com/api7/api7-ingress-controller/api/dashboard/v1"
+	"github.com/google/uuid"
+	"k8s.io/apimachinery/pkg/types"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func (t *Translator) TranslateGateway(tctx *TranslateContext, obj *gatewayv1.Gateway) (*TranslateResult, error) {
+	result := &TranslateResult{}
+	for _, listener := range obj.Spec.Listeners {
+		tctx.GatewayTLSConfig = append(tctx.GatewayTLSConfig, *listener.TLS)
+		ssl := t.translateSecret(tctx, listener, obj.Name, obj.Namespace)
+		result.SSL = append(result.SSL, ssl)
+	}
+	return result, nil
+}
+
+func (t *Translator) translateSecret(tctx *TranslateContext, listener gatewayv1.Listener, name, ns string) *v1.Ssl {
+	if tctx.Secrets == nil {
+		return nil
+	}
+	sslObj := &v1.Ssl{}
+	sslObj.ID = uuid.NewString()
+	sslObj.Cert = string(tctx.Secrets[types.NamespacedName{Namespace: ns, Name: name}].Data["tls.crt"])
+	if listener.Hostname != nil {
+		sslObj.Snis = []string{string(*listener.Hostname)}
+	}
+	sslObj.Key = string(tctx.Secrets[types.NamespacedName{Namespace: ns, Name: name}].Data["tls.key"])
+	return sslObj
+}

internal/controlplane/translator/translator.go

@@ -2,6 +2,7 @@ package translator
 
 import (
 	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
 	"k8s.io/apimachinery/pkg/types"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -14,11 +15,14 @@ type Translator struct {
 }
 
 type TranslateContext struct {
-	BackendRefs    []gatewayv1.BackendRef
-	EndpointSlices map[types.NamespacedName][]discoveryv1.EndpointSlice
+	BackendRefs      []gatewayv1.BackendRef
+	EndpointSlices   map[types.NamespacedName][]discoveryv1.EndpointSlice
+	GatewayTLSConfig []gatewayv1.GatewayTLSConfig
+	Secrets          map[types.NamespacedName]*corev1.Secret
 }
 
 type TranslateResult struct {
 	Routes   []*v1.Route
 	Services []*v1.Service
+	SSL      []*v1.Ssl
 }