Skip to content

Commit 6d76ec6

Browse files
rostislavboborostislavbobo
authored
TLSRoute: Require hostnames and bump version to v1alpha3 (#3872)
* TLSRoute: Require hostnames * TLSRoute: Move to v1alpha3 TLSRoute: Update config crd TLSRoute: Update pkg TLSRoute: Update hack example * TLSRoute: Bring TLSRoute back to v1alpha2 * TLSRoute: Update conformance helpers * TLSRoute: Remove storageversion from v1alpha3 * TLSRoute: Update invalid example * TLSRoute: v1alpha3 example * TLSRoute: Make v1alpha3 storage
1 parent fb6aa5c commit 6d76ec6

File tree

28 files changed

+2090
-1
lines changed

28 files changed

+2090
-1
lines changed

‎apis/v1alpha2/tlsroute_types.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ import (
2424
// +kubebuilder:object:root=true
2525
// +kubebuilder:resource:categories=gateway-api
2626
// +kubebuilder:subresource:status
27-
// +kubebuilder:storageversion
2827
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
2928

3029
// The TLSRoute resource is similar to TCPRoute, but can be configured

‎apis/v1alpha3/shared_types.go

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
/*
2+
Copyright 2020 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha3
18+
19+
import v1 "sigs.k8s.io/gateway-api/apis/v1"
20+
21+
// CommonRouteSpec defines the common attributes that all Routes MUST include
22+
// within their spec.
23+
// +k8s:deepcopy-gen=false
24+
type CommonRouteSpec = v1.CommonRouteSpec
25+
26+
// BackendRef defines how a Route should forward a request to a Kubernetes
27+
// resource.
28+
//
29+
// Note that when a namespace different than the local namespace is specified, a
30+
// ReferenceGrant object is required in the referent namespace to allow that
31+
// namespace's owner to accept the reference. See the ReferenceGrant
32+
// documentation for details.
33+
// +k8s:deepcopy-gen=false
34+
type BackendRef = v1.BackendRef
35+
36+
// RouteStatus defines the common attributes that all Routes MUST include within
37+
// their status.
38+
// +k8s:deepcopy-gen=false
39+
type RouteStatus = v1.RouteStatus
40+
41+
// Hostname is the fully qualified domain name of a network host. This matches
42+
// the RFC 1123 definition of a hostname with 2 notable exceptions:
43+
//
44+
// 1. IPs are not allowed.
45+
// 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
46+
// label must appear by itself as the first label.
47+
//
48+
// Hostname can be "precise" which is a domain name without the terminating
49+
// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
50+
// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
51+
//
52+
// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
53+
// alphanumeric characters or '-', and must start and end with an alphanumeric
54+
// character. No other punctuation is allowed.
55+
//
56+
// +kubebuilder:validation:MinLength=1
57+
// +kubebuilder:validation:MaxLength=253
58+
// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
59+
type Hostname = v1.Hostname
60+
61+
// SectionName is the name of a section in a Kubernetes resource.
62+
//
63+
// In the following resources, SectionName is interpreted as the following:
64+
//
65+
// * Gateway: Listener name
66+
// * HTTPRoute: HTTPRouteRule name
67+
// * Service: Port name
68+
//
69+
// Section names can have a variety of forms, including RFC 1123 subdomains,
70+
// RFC 1123 labels, or RFC 1035 labels.
71+
//
72+
// This validation is based off of the corresponding Kubernetes validation:
73+
// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
74+
//
75+
// Valid values include:
76+
//
77+
// * "example"
78+
// * "foo-example"
79+
// * "example.com"
80+
// * "foo.example.com"
81+
//
82+
// Invalid values include:
83+
//
84+
// * "example.com/bar" - "/" is an invalid character
85+
//
86+
// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
87+
// +kubebuilder:validation:MinLength=1
88+
// +kubebuilder:validation:MaxLength=253
89+
type SectionName = v1.SectionName

‎apis/v1alpha3/tlsroute_types.go

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/*
2+
Copyright 2020 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha3
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
22+
"sigs.k8s.io/gateway-api/apis/v1alpha2"
23+
)
24+
25+
// +genclient
26+
// +kubebuilder:object:root=true
27+
// +kubebuilder:resource:categories=gateway-api
28+
// +kubebuilder:subresource:status
29+
// +kubebuilder:storageversion
30+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
31+
32+
// The TLSRoute resource is similar to TCPRoute, but can be configured
33+
// to match against TLS-specific metadata. This allows more flexibility
34+
// in matching streams for a given TLS listener.
35+
//
36+
// If you need to forward traffic to a single target for a TLS listener, you
37+
// could choose to use a TCPRoute with a TLS listener.
38+
type TLSRoute struct {
39+
metav1.TypeMeta `json:",inline"`
40+
metav1.ObjectMeta `json:"metadata,omitempty"`
41+
42+
// Spec defines the desired state of TLSRoute.
43+
Spec TLSRouteSpec `json:"spec"`
44+
45+
// Status defines the current state of TLSRoute.
46+
Status v1alpha2.TLSRouteStatus `json:"status,omitempty"`
47+
}
48+
49+
// TLSRouteSpec defines the desired state of a TLSRoute resource.
50+
type TLSRouteSpec struct {
51+
CommonRouteSpec `json:",inline"`
52+
53+
// Hostnames defines a set of SNI hostnames that should match against the
54+
// SNI attribute of TLS ClientHello message in TLS handshake. This matches
55+
// the RFC 1123 definition of a hostname with 2 notable exceptions:
56+
//
57+
// 1. IPs are not allowed in SNI hostnames per RFC 6066.
58+
// 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
59+
// label must appear by itself as the first label.
60+
//
61+
// If a hostname is specified by both the Listener and TLSRoute, there
62+
// must be at least one intersecting hostname for the TLSRoute to be
63+
// attached to the Listener. For example:
64+
//
65+
// * A Listener with `test.example.com` as the hostname matches TLSRoutes
66+
// that have either not specified any hostnames, or have specified at
67+
// least one of `test.example.com` or `*.example.com`.
68+
// * A Listener with `*.example.com` as the hostname matches TLSRoutes
69+
// that have either not specified any hostnames or have specified at least
70+
// one hostname that matches the Listener hostname. For example,
71+
// `test.example.com` and `*.example.com` would both match. On the other
72+
// hand, `example.com` and `test.example.net` would not match.
73+
//
74+
// If both the Listener and TLSRoute have specified hostnames, any
75+
// TLSRoute hostnames that do not match the Listener hostname MUST be
76+
// ignored. For example, if a Listener specified `*.example.com`, and the
77+
// TLSRoute specified `test.example.com` and `test.example.net`,
78+
// `test.example.net` must not be considered for a match.
79+
//
80+
// If both the Listener and TLSRoute have specified hostnames, and none
81+
// match with the criteria above, then the TLSRoute is not accepted. The
82+
// implementation must raise an 'Accepted' Condition with a status of
83+
// `False` in the corresponding RouteParentStatus.
84+
//
85+
// Support: Core
86+
//
87+
// +kubebuilder:validation:MinItems=1
88+
// +kubebuilder:validation:MaxItems=16
89+
Hostnames []Hostname `json:"hostnames,omitempty"`
90+
91+
// Rules are a list of TLS matchers and actions.
92+
//
93+
// +kubebuilder:validation:MinItems=1
94+
// +kubebuilder:validation:MaxItems=16
95+
// <gateway:experimental:validation:XValidation:message="Rule name must be unique within the route",rule="self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name) && l1.name == l2.name))">
96+
Rules []v1alpha2.TLSRouteRule `json:"rules"`
97+
}
98+
99+
// +kubebuilder:object:root=true
100+
101+
// TLSRouteList contains a list of TLSRoute
102+
type TLSRouteList struct {
103+
metav1.TypeMeta `json:",inline"`
104+
metav1.ListMeta `json:"metadata,omitempty"`
105+
Items []TLSRoute `json:"items"`
106+
}

‎apis/v1alpha3/zz_generated.deepcopy.go

Lines changed: 87 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha3/zz_generated.register.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)