Skip to content

Commit b62ba58

Browse files
shaun-nxshaun-nx
authored
Merge branch 'main' into tests/cel-observabilitypolicy
2 parents 5a27110 + af41450 commit b62ba58

File tree

8 files changed

+502
-40
lines changed

8 files changed

+502
-40
lines changed

‎go.mod‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require (
99
github.com/google/uuid v1.6.0
1010
github.com/nginx/agent/v3 v3.2.1
1111
github.com/nginx/telemetry-exporter v0.1.4
12-
github.com/onsi/ginkgo/v2 v2.23.4
12+
github.com/onsi/ginkgo/v2 v2.24.0
1313
github.com/onsi/gomega v1.38.0
1414
github.com/prometheus/client_golang v1.23.0
1515
github.com/spf13/cobra v1.9.1
@@ -32,6 +32,7 @@ require (
3232

3333
require (
3434
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.4-20250130201111-63bb56e20495.1 // indirect
35+
github.com/Masterminds/semver/v3 v3.3.1 // indirect
3536
github.com/beorn7/perks v1.0.1 // indirect
3637
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
3738
github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -70,14 +71,14 @@ require (
7071
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
7172
go.uber.org/automaxprocs v1.6.0 // indirect
7273
go.uber.org/multierr v1.11.0 // indirect
73-
golang.org/x/mod v0.26.0 // indirect
74-
golang.org/x/net v0.42.0 // indirect
74+
golang.org/x/mod v0.27.0 // indirect
75+
golang.org/x/net v0.43.0 // indirect
7576
golang.org/x/oauth2 v0.30.0 // indirect
7677
golang.org/x/sync v0.16.0 // indirect
77-
golang.org/x/sys v0.34.0 // indirect
78-
golang.org/x/term v0.33.0 // indirect
78+
golang.org/x/sys v0.35.0 // indirect
79+
golang.org/x/term v0.34.0 // indirect
7980
golang.org/x/time v0.9.0 // indirect
80-
golang.org/x/tools v0.35.0 // indirect
81+
golang.org/x/tools v0.36.0 // indirect
8182
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
8283
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
8384
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect

‎go.sum‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
44
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
55
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
66
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
7+
github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
8+
github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
79
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
810
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
911
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -143,8 +145,8 @@ github.com/nginx/telemetry-exporter v0.1.4 h1:3ikgKlyz/O57oaBLkxCInMjr74AhGTKr9r
143145
github.com/nginx/telemetry-exporter v0.1.4/go.mod h1:bl6qmsxgk4a9D0X8R5E3sUNXN2iECPEK1JNbRLhN5C4=
144146
github.com/nginxinc/nginx-plus-go-client/v2 v2.0.1 h1:5VVK38bnELMDWnwfF6dSv57ResXh9AUzeDa72ENj94o=
145147
github.com/nginxinc/nginx-plus-go-client/v2 v2.0.1/go.mod h1:He+1izxYxVVO5/C9ZTukwOpvkAx5eS19nRQgKXDhX5I=
146-
github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
147-
github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
148+
github.com/onsi/ginkgo/v2 v2.24.0 h1:obZz8LAnHicNdbBqvG3ytAFx8fgza+i1IDpBVcHT2YE=
149+
github.com/onsi/ginkgo/v2 v2.24.0/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk=
148150
github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=
149151
github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o=
150152
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -247,20 +249,20 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
247249
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
248250
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
249251
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
250-
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
251-
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
252+
golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
253+
golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
252254
golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac h1:l5+whBCLH3iH2ZNHYLbAe58bo7yrN4mVcnkHDYz5vvs=
253255
golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac/go.mod h1:hH+7mtFmImwwcMvScyxUhjuVHR3HGaDPMn9rMSUUbxo=
254256
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
255257
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
256-
golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
257-
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
258+
golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
259+
golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
258260
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
259261
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
260262
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
261263
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
262-
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
263-
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
264+
golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
265+
golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
264266
golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
265267
golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
266268
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -271,10 +273,10 @@ golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
271273
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
272274
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
273275
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
274-
golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
275-
golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
276-
golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
277-
golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
276+
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
277+
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
278+
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
279+
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
278280
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
279281
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
280282
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
@@ -285,8 +287,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
285287
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
286288
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
287289
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
288-
golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
289-
golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
290+
golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
291+
golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
290292
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
291293
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
292294
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎internal/controller/provisioner/objects.go‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,13 +152,28 @@ func (p *NginxProvisioner) buildNginxResourceObjects(
152152
ports[int32(listener.Port)] = struct{}{}
153153
}
154154

155-
service, err := buildNginxService(objectMeta, nProxyCfg, ports, selectorLabels)
155+
// Create separate copies of objectMeta for service and deployment to avoid shared map references
156+
serviceObjectMeta := metav1.ObjectMeta{
157+
Name: objectMeta.Name,
158+
Namespace: objectMeta.Namespace,
159+
Labels: maps.Clone(objectMeta.Labels),
160+
Annotations: maps.Clone(objectMeta.Annotations),
161+
}
162+
163+
deploymentObjectMeta := metav1.ObjectMeta{
164+
Name: objectMeta.Name,
165+
Namespace: objectMeta.Namespace,
166+
Labels: maps.Clone(objectMeta.Labels),
167+
Annotations: maps.Clone(objectMeta.Annotations),
168+
}
169+
170+
service, err := buildNginxService(serviceObjectMeta, nProxyCfg, ports, selectorLabels)
156171
if err != nil {
157172
errs = append(errs, err)
158173
}
159174

160175
deployment, err := p.buildNginxDeployment(
161-
objectMeta,
176+
deploymentObjectMeta,
162177
nProxyCfg,
163178
ngxIncludesConfigMapName,
164179
ngxAgentConfigMapName,

‎internal/controller/provisioner/objects_test.go‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1696,4 +1696,62 @@ func TestBuildNginxResourceObjects_Patches(t *testing.T) {
16961696
}
16971697
g.Expect(svc).ToNot(BeNil())
16981698
g.Expect(svc.Labels).ToNot(HaveKey("patched")) // Should not have patch-related labels
1699+
1700+
// Test that Service patches don't affect Deployment labels and vice versa (cross-contamination)
1701+
nProxyCfg = &graph.EffectiveNginxProxy{
1702+
Kubernetes: &ngfAPIv1alpha2.KubernetesSpec{
1703+
Service: &ngfAPIv1alpha2.ServiceSpec{
1704+
Patches: []ngfAPIv1alpha2.Patch{
1705+
{
1706+
Type: helpers.GetPointer(ngfAPIv1alpha2.PatchTypeStrategicMerge),
1707+
Value: &apiextv1.JSON{
1708+
Raw: []byte(`{"metadata":{"labels":{"service-only":"true"}}}`),
1709+
},
1710+
},
1711+
},
1712+
},
1713+
Deployment: &ngfAPIv1alpha2.DeploymentSpec{
1714+
Patches: []ngfAPIv1alpha2.Patch{
1715+
{
1716+
Type: helpers.GetPointer(ngfAPIv1alpha2.PatchTypeStrategicMerge),
1717+
Value: &apiextv1.JSON{
1718+
Raw: []byte(`{"metadata":{"labels":{"deployment-only":"true"}}}`),
1719+
},
1720+
},
1721+
},
1722+
},
1723+
},
1724+
}
1725+
1726+
objects, err = provisioner.buildNginxResourceObjects("gw-nginx", gateway, nProxyCfg)
1727+
g.Expect(err).ToNot(HaveOccurred())
1728+
g.Expect(objects).To(HaveLen(6))
1729+
1730+
// Find and validate service - should only have service-specific labels
1731+
svc = nil
1732+
for _, obj := range objects {
1733+
if s, ok := obj.(*corev1.Service); ok {
1734+
svc = s
1735+
break
1736+
}
1737+
}
1738+
g.Expect(svc).ToNot(BeNil())
1739+
g.Expect(svc.Labels).To(HaveKeyWithValue("service-only", "true"))
1740+
g.Expect(svc.Labels).ToNot(HaveKey("deployment-only"))
1741+
1742+
// Find and validate deployment - should only have deployment-specific labels
1743+
dep = nil
1744+
for _, obj := range objects {
1745+
if d, ok := obj.(*appsv1.Deployment); ok {
1746+
dep = d
1747+
break
1748+
}
1749+
}
1750+
g.Expect(dep).ToNot(BeNil())
1751+
g.Expect(dep.Labels).To(HaveKeyWithValue("deployment-only", "true"))
1752+
g.Expect(dep.Labels).ToNot(HaveKey("service-only"))
1753+
1754+
// Both should still have the common base labels
1755+
g.Expect(svc.Labels).To(HaveKeyWithValue("app", "nginx"))
1756+
g.Expect(dep.Labels).To(HaveKeyWithValue("app", "nginx"))
16991757
}

‎tests/cel/common.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,15 @@ const (
2222
grpcRouteKind = "GRPCRoute"
2323
tcpRouteKind = "TCPRoute"
2424
invalidKind = "InvalidKind"
25+
serviceKind = "Service"
2526
)
2627

2728
const (
2829
gatewayGroup = "gateway.networking.k8s.io"
2930
invalidGroup = "invalid.networking.k8s.io"
3031
discoveryGroup = "discovery.k8s.io/v1"
32+
coreGroup = "core"
33+
emptyGroup = ""
3134
)
3235

3336
// ClientSettingsPolicy validation errors.
@@ -49,6 +52,12 @@ const (
4952
expectedTargetRefMustBeHTTPRouteOrGrpcRouteError = `TargetRef Kind must be: HTTPRoute or GRPCRoute`
5053
expectedTargetRefKindAndNameComboMustBeUnique = `TargetRef Kind and Name combination must be unique`
5154
expectedStrategyMustBeOfTypeRatio = `ratio can only be specified if strategy is of type ratio`
55+
56+
// UpstreamSettingsPolicy validation errors.
57+
const (
58+
expectedTargetRefKindServiceError = `TargetRefs Kind must be: Service`
59+
expectedTargetRefGroupCoreError = `TargetRefs Group must be core`
60+
expectedTargetRefNameUniqueError = `TargetRef Name must be unique`
5261
)
5362

5463
const (

0 commit comments

Comments
 (0)