Skip to content

Commit 34094d5

Browse files
sjbermansjberman
committed
CP/DP Split: fix label updates (#3370)
Problem: Updating labels/annotations on the Gateway did not propagate to some resources. Solution: Ensure that labels/annotations are set when updating resources.
1 parent b422854 commit 34094d5

File tree

8 files changed

+73
-51
lines changed

8 files changed

+73
-51
lines changed

‎build/Dockerfile.nginx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ WORKDIR /tmp
1212
RUN apk add --no-cache git make \
1313
&& git clone https://github.com/nginx/agent.git \
1414
&& cd agent \
15-
&& git checkout v3 \
15+
&& git checkout e745a3236e0f02a579461a5a435b3bcd410a686c \
1616
&& make build
1717

1818
FROM nginx:1.28.0-alpine-otel

‎build/Dockerfile.nginxplus‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ WORKDIR /tmp
1111
RUN apk add --no-cache git make \
1212
&& git clone https://github.com/nginx/agent.git \
1313
&& cd agent \
14-
&& git checkout v3 \
14+
&& git checkout e745a3236e0f02a579461a5a435b3bcd410a686c \
1515
&& make build
1616

1717
FROM alpine:3.21

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ require (
77
github.com/go-logr/logr v1.4.2
88
github.com/google/go-cmp v0.7.0
99
github.com/google/uuid v1.6.0
10-
github.com/nginx/agent/v3 v3.0.0-20250429163223-735f50381a9e
10+
github.com/nginx/agent/v3 v3.0.0-20250513105855-e745a3236e0f
1111
github.com/nginx/telemetry-exporter v0.1.4
1212
github.com/onsi/ginkgo/v2 v2.23.4
1313
github.com/onsi/gomega v1.37.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,8 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
133133
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
134134
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
135135
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
136-
github.com/nginx/agent/v3 v3.0.0-20250429163223-735f50381a9e h1:Cw/fGXymS9ytwusxE7TaySDovKH+yQuWRI0vLJ4rJxU=
137-
github.com/nginx/agent/v3 v3.0.0-20250429163223-735f50381a9e/go.mod h1:O/31aKtii/mpiZmFGMcTNDoLtKzwTyTXOBMSRkMaPvs=
136+
github.com/nginx/agent/v3 v3.0.0-20250513105855-e745a3236e0f h1:fSUAaR1AxmmbmGMRkvKGY2+LhuVpBp7tbBFLLgDMjNQ=
137+
github.com/nginx/agent/v3 v3.0.0-20250513105855-e745a3236e0f/go.mod h1:O/31aKtii/mpiZmFGMcTNDoLtKzwTyTXOBMSRkMaPvs=
138138
github.com/nginx/telemetry-exporter v0.1.4 h1:3ikgKlyz/O57oaBLkxCInMjr74AhGTKr9rHdRAkkl/w=
139139
github.com/nginx/telemetry-exporter v0.1.4/go.mod h1:bl6qmsxgk4a9D0X8R5E3sUNXN2iECPEK1JNbRLhN5C4=
140140
github.com/nginxinc/nginx-plus-go-client/v2 v2.0.1 h1:5VVK38bnELMDWnwfF6dSv57ResXh9AUzeDa72ENj94o=

‎internal/mode/static/provisioner/provisioner.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,7 @@ func (p *NginxProvisioner) provisionNginx(
260260
}
261261

262262
// if agent configmap was updated, then we'll need to restart the deployment
263-
if agentConfigMapUpdated && !deploymentCreated {
263+
if agentConfigMapUpdated && !deploymentCreated && deploymentObj != nil {
264264
updateCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
265265
defer cancel()
266266

‎internal/mode/static/provisioner/setter.go‎

Lines changed: 67 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
package provisioner
22

33
import (
4+
"maps"
5+
46
appsv1 "k8s.io/api/apps/v1"
57
corev1 "k8s.io/api/core/v1"
68
rbacv1 "k8s.io/api/rbac/v1"
9+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
710
"sigs.k8s.io/controller-runtime/pkg/client"
811
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
912
)
@@ -12,54 +15,103 @@ import (
1215
func objectSpecSetter(object client.Object) controllerutil.MutateFn {
1316
switch obj := object.(type) {
1417
case *appsv1.Deployment:
15-
return deploymentSpecSetter(obj, obj.Spec)
18+
return deploymentSpecSetter(obj, obj.Spec, obj.ObjectMeta)
1619
case *corev1.Service:
17-
return serviceSpecSetter(obj, obj.Spec)
20+
return serviceSpecSetter(obj, obj.Spec, obj.ObjectMeta)
1821
case *corev1.ServiceAccount:
19-
return func() error { return nil }
22+
return serviceAccountSpecSetter(obj, obj.ObjectMeta)
2023
case *corev1.ConfigMap:
21-
return configMapSpecSetter(obj, obj.Data)
24+
return configMapSpecSetter(obj, obj.Data, obj.ObjectMeta)
2225
case *corev1.Secret:
23-
return secretSpecSetter(obj, obj.Data)
26+
return secretSpecSetter(obj, obj.Data, obj.ObjectMeta)
2427
case *rbacv1.Role:
25-
return roleSpecSetter(obj, obj.Rules)
28+
return roleSpecSetter(obj, obj.Rules, obj.ObjectMeta)
2629
case *rbacv1.RoleBinding:
27-
return roleBindingSpecSetter(obj, obj.RoleRef, obj.Subjects)
30+
return roleBindingSpecSetter(obj, obj.RoleRef, obj.Subjects, obj.ObjectMeta)
2831
}
2932

3033
return nil
3134
}
3235

33-
func deploymentSpecSetter(deployment *appsv1.Deployment, spec appsv1.DeploymentSpec) controllerutil.MutateFn {
36+
func deploymentSpecSetter(
37+
deployment *appsv1.Deployment,
38+
spec appsv1.DeploymentSpec,
39+
objectMeta metav1.ObjectMeta,
40+
) controllerutil.MutateFn {
3441
return func() error {
42+
deployment.Labels = objectMeta.Labels
43+
deployment.Annotations = objectMeta.Annotations
3544
deployment.Spec = spec
3645
return nil
3746
}
3847
}
3948

40-
func serviceSpecSetter(service *corev1.Service, spec corev1.ServiceSpec) controllerutil.MutateFn {
49+
func serviceSpecSetter(
50+
service *corev1.Service,
51+
spec corev1.ServiceSpec,
52+
objectMeta metav1.ObjectMeta,
53+
) controllerutil.MutateFn {
4154
return func() error {
55+
service.Labels = objectMeta.Labels
56+
service.Annotations = objectMeta.Annotations
4257
service.Spec = spec
4358
return nil
4459
}
4560
}
4661

47-
func configMapSpecSetter(configMap *corev1.ConfigMap, data map[string]string) controllerutil.MutateFn {
62+
func serviceAccountSpecSetter(
63+
serviceAccount *corev1.ServiceAccount,
64+
objectMeta metav1.ObjectMeta,
65+
) controllerutil.MutateFn {
4866
return func() error {
67+
serviceAccount.Labels = objectMeta.Labels
68+
serviceAccount.Annotations = objectMeta.Annotations
69+
return nil
70+
}
71+
}
72+
73+
func configMapSpecSetter(
74+
configMap *corev1.ConfigMap,
75+
data map[string]string,
76+
objectMeta metav1.ObjectMeta,
77+
) controllerutil.MutateFn {
78+
return func() error {
79+
// this check ensures we don't trigger an unnecessary update to the agent ConfigMap
80+
// and trigger a Deployment restart
81+
if maps.Equal(configMap.Labels, objectMeta.Labels) &&
82+
maps.Equal(configMap.Annotations, objectMeta.Annotations) &&
83+
maps.Equal(configMap.Data, data) {
84+
return nil
85+
}
86+
87+
configMap.Labels = objectMeta.Labels
88+
configMap.Annotations = objectMeta.Annotations
4989
configMap.Data = data
5090
return nil
5191
}
5292
}
5393

54-
func secretSpecSetter(secret *corev1.Secret, data map[string][]byte) controllerutil.MutateFn {
94+
func secretSpecSetter(
95+
secret *corev1.Secret,
96+
data map[string][]byte,
97+
objectMeta metav1.ObjectMeta,
98+
) controllerutil.MutateFn {
5599
return func() error {
100+
secret.Labels = objectMeta.Labels
101+
secret.Annotations = objectMeta.Annotations
56102
secret.Data = data
57103
return nil
58104
}
59105
}
60106

61-
func roleSpecSetter(role *rbacv1.Role, rules []rbacv1.PolicyRule) controllerutil.MutateFn {
107+
func roleSpecSetter(
108+
role *rbacv1.Role,
109+
rules []rbacv1.PolicyRule,
110+
objectMeta metav1.ObjectMeta,
111+
) controllerutil.MutateFn {
62112
return func() error {
113+
role.Labels = objectMeta.Labels
114+
role.Annotations = objectMeta.Annotations
63115
role.Rules = rules
64116
return nil
65117
}
@@ -69,8 +121,11 @@ func roleBindingSpecSetter(
69121
roleBinding *rbacv1.RoleBinding,
70122
roleRef rbacv1.RoleRef,
71123
subjects []rbacv1.Subject,
124+
objectMeta metav1.ObjectMeta,
72125
) controllerutil.MutateFn {
73126
return func() error {
127+
roleBinding.Labels = objectMeta.Labels
128+
roleBinding.Annotations = objectMeta.Annotations
74129
roleBinding.RoleRef = roleRef
75130
roleBinding.Subjects = subjects
76131
return nil

‎internal/mode/static/provisioner/templates.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ allowed_directories:
4545
- /usr/share/nginx
4646
- /var/run/nginx
4747
features:
48-
- connection
4948
- configuration
5049
- certificates
5150
{{- if .EnableMetrics }}

‎internal/mode/static/state/conditions/conditions.go‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,6 @@ const (
5353
// invalid. Used with ResolvedRefs (false).
5454
RouteReasonInvalidFilter v1.RouteConditionReason = "InvalidFilter"
5555

56-
// GatewayReasonGatewayConflict indicates there are multiple Gateway resources to choose from,
57-
// and we ignored the resource in question and picked another Gateway as the winner.
58-
// This reason is used with GatewayConditionAccepted (false).
59-
GatewayReasonGatewayConflict v1.GatewayConditionReason = "GatewayConflict"
60-
61-
// GatewayMessageGatewayConflict is a message that describes GatewayReasonGatewayConflict.
62-
GatewayMessageGatewayConflict = "The resource is ignored due to a conflicting Gateway resource"
63-
6456
// GatewayReasonUnsupportedValue is used with GatewayConditionAccepted (false) when a value of a field in a Gateway
6557
// is invalid or not supported.
6658
GatewayReasonUnsupportedValue v1.GatewayConditionReason = "UnsupportedValue"
@@ -574,19 +566,6 @@ func NewGatewayAccepted() conditions.Condition {
574566
}
575567
}
576568

577-
// NewGatewayConflict returns Conditions that indicate the Gateway has a conflict with another Gateway.
578-
func NewGatewayConflict() []conditions.Condition {
579-
return []conditions.Condition{
580-
{
581-
Type: string(v1.GatewayConditionAccepted),
582-
Status: metav1.ConditionFalse,
583-
Reason: string(GatewayReasonGatewayConflict),
584-
Message: GatewayMessageGatewayConflict,
585-
},
586-
NewGatewayConflictNotProgrammed(),
587-
}
588-
}
589-
590569
// NewGatewayAcceptedListenersNotValid returns a Condition that indicates the Gateway is accepted,
591570
// but has at least one listener that is invalid.
592571
func NewGatewayAcceptedListenersNotValid() conditions.Condition {
@@ -668,17 +647,6 @@ func NewGatewayNotProgrammedInvalid(msg string) conditions.Condition {
668647
}
669648
}
670649

671-
// NewGatewayConflictNotProgrammed returns a custom Programmed Condition that indicates the Gateway has a
672-
// conflict with another Gateway.
673-
func NewGatewayConflictNotProgrammed() conditions.Condition {
674-
return conditions.Condition{
675-
Type: string(v1.GatewayConditionProgrammed),
676-
Status: metav1.ConditionFalse,
677-
Reason: string(GatewayReasonGatewayConflict),
678-
Message: GatewayMessageGatewayConflict,
679-
}
680-
}
681-
682650
// NewNginxGatewayValid returns a Condition that indicates that the NginxGateway config is valid.
683651
func NewNginxGatewayValid() conditions.Condition {
684652
return conditions.Condition{

0 commit comments

Comments
 (0)