Skip to content

Commit f2521d5

Browse files
rikatzrikatz
committed
OCPBUGS-77457: Respect proxy configuration on gatewayapi provisioning
1 parent c2eae34 commit f2521d5

3 files changed

Lines changed: 90 additions & 20 deletions

File tree

‎pkg/operator/controller/gatewayclass/controller.go‎

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,15 @@ import (
55
"fmt"
66
"sync"
77

8-
logf "github.com/openshift/cluster-ingress-operator/pkg/log"
9-
operatorcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
10-
118
sailv1 "github.com/istio-ecosystem/sail-operator/api/v1"
9+
configv1 "github.com/openshift/api/config/v1"
1210
operatorsv1alpha1 "github.com/operator-framework/api/pkg/operators/v1alpha1"
13-
14-
"k8s.io/client-go/tools/record"
15-
16-
gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
17-
1811
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
12+
"k8s.io/apimachinery/pkg/api/errors"
1913
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2014
"k8s.io/apimachinery/pkg/types"
2115
utilerrors "k8s.io/apimachinery/pkg/util/errors"
22-
16+
"k8s.io/client-go/tools/record"
2317
"sigs.k8s.io/controller-runtime/pkg/cache"
2418
"sigs.k8s.io/controller-runtime/pkg/client"
2519
"sigs.k8s.io/controller-runtime/pkg/controller"
@@ -28,6 +22,10 @@ import (
2822
"sigs.k8s.io/controller-runtime/pkg/predicate"
2923
"sigs.k8s.io/controller-runtime/pkg/reconcile"
3024
"sigs.k8s.io/controller-runtime/pkg/source"
25+
gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
26+
27+
logf "github.com/openshift/cluster-ingress-operator/pkg/log"
28+
operatorcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
3129
)
3230

3331
const (
@@ -148,6 +146,11 @@ func NewUnmanaged(mgr manager.Manager, config Config) (controller.Controller, er
148146
return nil, err
149147
}
150148

149+
// Watch for Proxy configuration to set the right options on Istio resource
150+
if err := c.Watch(source.Kind[client.Object](operatorCache, &configv1.Proxy{}, reconciler.enqueueRequestForSomeGatewayClass())); err != nil {
151+
return nil, err
152+
}
153+
151154
gatewayClassController = c
152155
return c, nil
153156
}
@@ -232,6 +235,13 @@ func (r *reconciler) enqueueRequestForSomeGatewayClass() handler.EventHandler {
232235
func (r *reconciler) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {
233236
log.Info("reconciling", "request", request)
234237

238+
// We can ignore the error if it is not found. It means the configuration of proxy will
239+
// be null, and no proxy will be configured in this case
240+
var proxyConfig configv1.Proxy
241+
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, &proxyConfig); err != nil && !errors.IsNotFound(err) {
242+
return reconcile.Result{}, err
243+
}
244+
235245
var gatewayclass gatewayapiv1.GatewayClass
236246
if err := r.cache.Get(ctx, request.NamespacedName, &gatewayclass); err != nil {
237247
return reconcile.Result{}, err
@@ -260,7 +270,9 @@ func (r *reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
260270
if v, ok := gatewayclass.Annotations[istioVersionOverrideAnnotationKey]; ok {
261271
istioVersion = v
262272
}
263-
if _, _, err := r.ensureIstio(ctx, &gatewayclass, istioVersion); err != nil {
273+
if _, _, err := r.ensureIstio(ctx, &gatewayclass, istioVersion, &extraIstioConfig{
274+
proxyConfig: &proxyConfig,
275+
}); err != nil {
264276
errs = append(errs, err)
265277
} else {
266278
// The OSSM operator installs the istios.sailoperator.io CRD.

‎pkg/operator/controller/gatewayclass/controller_test.go‎

Lines changed: 43 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,18 @@ func Test_Reconcile(t *testing.T) {
5151
}
5252
}
5353

54-
istio := func(version string, gieEnabled bool) *sailv1.Istio {
54+
proxyConfig := func(http, https, noproxy string) *configv1.Proxy {
55+
return &configv1.Proxy{
56+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
57+
Status: configv1.ProxyStatus{
58+
HTTPProxy: http,
59+
HTTPSProxy: https,
60+
NoProxy: noproxy,
61+
},
62+
}
63+
}
64+
65+
istio := func(version string, gieEnabled bool, proxyconfig map[string]string) *sailv1.Istio {
5566
ret := &sailv1.Istio{
5667
ObjectMeta: metav1.ObjectMeta{
5768
Name: "openshift-gateway",
@@ -110,6 +121,7 @@ func Test_Reconcile(t *testing.T) {
110121
Mode: sailv1.ProxyConfigProxyHeadersMetadataExchangeModeInMesh,
111122
},
112123
},
124+
ProxyMetadata: proxyconfig,
113125
},
114126
IngressControllerMode: sailv1.MeshConfigIngressControllerModeOff,
115127
},
@@ -158,7 +170,7 @@ func Test_Reconcile(t *testing.T) {
158170
},
159171
expectCreate: []client.Object{
160172
subscription("redhat-operators", "stable", "servicemeshoperator3.v3.0.1"),
161-
istio("v1.24.4", false),
173+
istio("v1.24.4", false, nil),
162174
},
163175
expectUpdate: []client.Object{},
164176
expectDelete: []client.Object{},
@@ -183,7 +195,7 @@ func Test_Reconcile(t *testing.T) {
183195
},
184196
expectCreate: []client.Object{
185197
subscription("redhat-operators", "stable", "servicemeshoperator3.v3.0.1"),
186-
istio("v1.24.4", true),
198+
istio("v1.24.4", true, nil),
187199
},
188200
expectUpdate: []client.Object{},
189201
expectDelete: []client.Object{},
@@ -208,7 +220,7 @@ func Test_Reconcile(t *testing.T) {
208220
},
209221
expectCreate: []client.Object{
210222
subscription("redhat-operators", "stable", "servicemeshoperator3.v3.0.1"),
211-
istio("v1.24.4", true),
223+
istio("v1.24.4", true, nil),
212224
},
213225
expectUpdate: []client.Object{},
214226
expectDelete: []client.Object{},
@@ -231,7 +243,7 @@ func Test_Reconcile(t *testing.T) {
231243
},
232244
expectCreate: []client.Object{
233245
subscription("redhat-operators", "stable", "servicemeshoperator3.v3.0.1"),
234-
istio("v1.24-latest", false),
246+
istio("v1.24-latest", false, nil),
235247
},
236248
expectUpdate: []client.Object{},
237249
expectDelete: []client.Object{},
@@ -257,7 +269,32 @@ func Test_Reconcile(t *testing.T) {
257269
},
258270
expectCreate: []client.Object{
259271
subscription("foo", "bar", "baz"),
260-
istio("quux", false),
272+
istio("quux", false, nil),
273+
},
274+
expectUpdate: []client.Object{},
275+
expectDelete: []client.Object{},
276+
},
277+
{
278+
name: "Minimal gatewayclass with httproxy override",
279+
request: req("openshift-default"),
280+
existingObjects: []runtime.Object{
281+
&gatewayapiv1.GatewayClass{
282+
ObjectMeta: metav1.ObjectMeta{
283+
Name: "openshift-default",
284+
},
285+
Spec: gatewayapiv1.GatewayClassSpec{
286+
ControllerName: gatewayapiv1.GatewayController("openshift.io/gateway-controller/v1"),
287+
},
288+
},
289+
proxyConfig("http://some.proxy.tld:8080", "https://another.proxy.tld", ".cluster.local,.ec2.internal,.svc,10.0.0.0/16,10.128.0.0/14"),
290+
},
291+
expectCreate: []client.Object{
292+
subscription("redhat-operators", "stable", "servicemeshoperator3.v3.0.1"),
293+
istio("v1.24.4", false, map[string]string{
294+
"HTTP_PROXY": "http://some.proxy.tld:8080",
295+
"HTTPS_PROXY": "https://another.proxy.tld",
296+
"NO_PROXY": ".cluster.local,.ec2.internal,.svc,10.0.0.0/16,10.128.0.0/14",
297+
}),
261298
},
262299
expectUpdate: []client.Object{},
263300
expectDelete: []client.Object{},

‎pkg/operator/controller/gatewayclass/istio.go‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
sailv1 "github.com/istio-ecosystem/sail-operator/api/v1"
1212

13+
configv1 "github.com/openshift/api/config/v1"
1314
"github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
1415

1516
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -23,10 +24,14 @@ import (
2324
// cluster-critical priority class in a pod's spec.priorityClassName.
2425
const systemClusterCriticalPriorityClassName = "system-cluster-critical"
2526

27+
type extraIstioConfig struct {
28+
proxyConfig *configv1.Proxy
29+
}
30+
2631
// ensureIstio attempts to ensure that an Istio CR is present and returns a
2732
// Boolean indicating whether it exists, the CR if it exists, and an error
2833
// value.
29-
func (r *reconciler) ensureIstio(ctx context.Context, gatewayclass *gatewayapiv1.GatewayClass, istioVersion string) (bool, *sailv1.Istio, error) {
34+
func (r *reconciler) ensureIstio(ctx context.Context, gatewayclass *gatewayapiv1.GatewayClass, istioVersion string, extraConfig *extraIstioConfig) (bool, *sailv1.Istio, error) {
3035
name := controller.IstioName(r.config.OperandNamespace)
3136
have, current, err := r.currentIstio(ctx, name)
3237
if err != nil {
@@ -45,7 +50,7 @@ func (r *reconciler) ensureIstio(ctx context.Context, gatewayclass *gatewayapiv1
4550
return have, current, err
4651
}
4752

48-
desired := desiredIstio(name, ownerRef, istioVersion, enableInferenceExtension)
53+
desired := desiredIstio(name, ownerRef, istioVersion, enableInferenceExtension, extraConfig)
4954

5055
switch {
5156
case !have:
@@ -96,7 +101,7 @@ func (r *reconciler) crdExists(ctx context.Context, crdName string) (bool, error
96101
}
97102

98103
// desiredIstio returns the desired Istio CR.
99-
func desiredIstio(name types.NamespacedName, ownerRef metav1.OwnerReference, istioVersion string, enableInferenceExtension bool) *sailv1.Istio {
104+
func desiredIstio(name types.NamespacedName, ownerRef metav1.OwnerReference, istioVersion string, enableInferenceExtension bool, extraConfig *extraIstioConfig) *sailv1.Istio {
100105
pilotContainerEnv := map[string]string{
101106
// Enable Gateway API.
102107
"PILOT_ENABLE_GATEWAY_API": "true",
@@ -148,7 +153,8 @@ func desiredIstio(name types.NamespacedName, ownerRef metav1.OwnerReference, ist
148153
if enableInferenceExtension {
149154
pilotContainerEnv["ENABLE_GATEWAY_API_INFERENCE_EXTENSION"] = "true"
150155
}
151-
return &sailv1.Istio{
156+
157+
istio := &sailv1.Istio{
152158
ObjectMeta: metav1.ObjectMeta{
153159
Namespace: name.Namespace,
154160
Name: name.Name,
@@ -207,6 +213,21 @@ func desiredIstio(name types.NamespacedName, ownerRef metav1.OwnerReference, ist
207213
Version: istioVersion,
208214
},
209215
}
216+
217+
if extraConfig != nil && extraConfig.proxyConfig != nil {
218+
proxycfg := extraConfig.proxyConfig.Status
219+
if proxycfg.HTTPProxy != "" || proxycfg.HTTPSProxy != "" || proxycfg.NoProxy != "" {
220+
if istio.Spec.Values.MeshConfig.DefaultConfig.ProxyMetadata == nil {
221+
istio.Spec.Values.MeshConfig.DefaultConfig.ProxyMetadata = make(map[string]string)
222+
}
223+
istio.Spec.Values.MeshConfig.DefaultConfig.ProxyMetadata["HTTP_PROXY"] = proxycfg.HTTPProxy
224+
istio.Spec.Values.MeshConfig.DefaultConfig.ProxyMetadata["HTTPS_PROXY"] = proxycfg.HTTPSProxy
225+
istio.Spec.Values.MeshConfig.DefaultConfig.ProxyMetadata["NO_PROXY"] = proxycfg.NoProxy
226+
227+
}
228+
}
229+
230+
return istio
210231
}
211232

212233
// currentIstio returns the current istio CR.

0 commit comments

Comments
 (0)