Skip to content

Commit e01dbf3

Browse files
shraddhabangshraddhabang
authored
[feat:gwapi] Add context-aware TargetGroupConfiguration and LoadBalancerConfiguration CRDs for Gateway API (kubernetes-sigs#4096)
* feat:gwapi Add context-aware TargetGroupConfiguration CRDs for services to map Gateway API routes * feat:gwapi Add context-aware TargetGroupConfiguration and LoadBalancerConfiguration CRDs for Gateway API
1 parent ee3fc7a commit e01dbf3

9 files changed

+2698
-1
lines changed

‎Makefile

+5-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ CRD_OPTIONS ?= "crd:crdVersions=v1"
1818
# Whether to override AWS SDK models. set to 'y' when we need to build against custom AWS SDK models.
1919
AWS_SDK_MODEL_OVERRIDE ?= "n"
2020

21+
# Move Gateway API CRDs from bases directory to gateway directory
22+
MOVE_GATEWAY_CRDS = mv config/crd/bases/gateway.k8s.aws_* config/crd/gateway/
23+
2124
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
2225
ifeq (,$(shell go env GOBIN))
2326
GOBIN=$(shell go env GOPATH)/bin
@@ -61,8 +64,9 @@ manifests: controller-gen kustomize
6164
yq eval '.metadata.name = "webhook"' -i config/webhook/manifests.yaml
6265

6366
crds: manifests
67+
$(MOVE_GATEWAY_CRDS)
6468
$(KUSTOMIZE) build config/crd > helm/aws-load-balancer-controller/crds/crds.yaml
65-
69+
$(KUSTOMIZE) build config/crd/gateway > config/crd/gateway/gateway-crds.yaml
6670

6771
# Run go fmt against code
6872
fmt:

‎apis/gateway/v1beta1/groupversion_info.go

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package v1beta1 contains API Schema definitions for the elbv2 v1beta1 API group
18+
// +kubebuilder:object:generate=true
19+
// +groupName=gateway.k8s.aws
20+
package v1beta1
21+
22+
import (
23+
"k8s.io/apimachinery/pkg/runtime/schema"
24+
"sigs.k8s.io/controller-runtime/pkg/scheme"
25+
)
26+
27+
var (
28+
// GroupVersion is group version used to register these objects
29+
GroupVersion = schema.GroupVersion{Group: "gateway.k8s.aws", Version: "v1beta1"}
30+
31+
// SchemeBuilder is used to add go types to the GroupVersionKind scheme
32+
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
33+
34+
// AddToScheme adds the types in this group-version to the given scheme.
35+
AddToScheme = SchemeBuilder.AddToScheme
36+
)

‎apis/gateway/v1beta1/loadbalancerconfig_types.go

+267
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
package v1beta1
2+
3+
import (
4+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
5+
)
6+
7+
// +kubebuilder:validation:Enum=internal;internet-facing
8+
// LoadBalancerScheme is the scheme of your LB
9+
//
10+
// * with `internal` scheme, the LB is only accessible within the VPC.
11+
// * with `internet-facing` scheme, the LB is accesible via the public internet.
12+
type LoadBalancerScheme string
13+
14+
const (
15+
LoadBalancerSchemeInternal LoadBalancerScheme = "internal"
16+
LoadBalancerSchemeInternetFacing LoadBalancerScheme = "internet-facing"
17+
)
18+
19+
// +kubebuilder:validation:Enum=ipv4;dualstack;dualstack-without-public-ipv4
20+
// LoadBalancerIpAddressType is the IP Address type of your LB.
21+
type LoadBalancerIpAddressType string
22+
23+
const (
24+
LoadBalancerIpAddressTypeIPv4 LoadBalancerIpAddressType = "ipv4"
25+
LoadBalancerIpAddressTypeDualstack LoadBalancerIpAddressType = "dualstack"
26+
LoadBalancerIpAddressTypeDualstackWithoutPublicIpv4 LoadBalancerIpAddressType = "dualstack-without-public-ipv4"
27+
)
28+
29+
// +kubebuilder:validation:Enum=on;off
30+
// EnablePrefixForIpv6SourceNatEnum defines the enum values for EnablePrefixForIpv6SourceNat
31+
type EnablePrefixForIpv6SourceNatEnum string
32+
33+
const (
34+
EnablePrefixForIpv6SourceNatEnumOn EnablePrefixForIpv6SourceNatEnum = "on"
35+
EnablePrefixForIpv6SourceNatEnumOff EnablePrefixForIpv6SourceNatEnum = "off"
36+
)
37+
38+
// LoadBalancerAttribute defines LB attribute.
39+
type LoadBalancerAttribute struct {
40+
// The key of the attribute.
41+
Key string `json:"key"`
42+
43+
// The value of the attribute.
44+
Value string `json:"value"`
45+
}
46+
47+
// ListenerAttribute defines listener attribute.
48+
type ListenerAttribute struct {
49+
// The key of the attribute.
50+
Key string `json:"key"`
51+
52+
// The value of the attribute.
53+
Value string `json:"value"`
54+
}
55+
56+
// Tag defines a AWS Tag on resources.
57+
type LoadBalancerTag struct {
58+
// The key of the tag.
59+
Key string `json:"key"`
60+
61+
// The value of the tag.
62+
Value string `json:"value"`
63+
}
64+
65+
// SubnetConfiguration defines the subnet settings for a Load Balancer.
66+
type SubnetConfiguration struct {
67+
// identifier name or id for the subnet
68+
Identifier string `json:"identifier"`
69+
70+
// eipAllocation the EIP name for this subnet.
71+
// +optional
72+
EIPAllocation *string `json:"eipAllocation,omitempty"`
73+
74+
// privateIPv4Allocation the private ipv4 address to assign to this subnet.
75+
// +optional
76+
PrivateIPv4Allocation *string `json:"privateIPv4Allocation,omitempty"`
77+
78+
// privateIPv6Allocation the private ipv6 address to assign to this subnet.
79+
// +optional
80+
PrivateIPv6Allocation *string `json:"privateIPv6Allocation,omitempty"`
81+
}
82+
83+
// +kubebuilder:validation:Enum=HTTP1Only;HTTP2Only;HTTP2Optional;HTTP2Preferred;None
84+
// ALPNPolicy defines the ALPN policy configuration for TLS listeners forwarding to TLS target groups
85+
// HTTP1Only Negotiate only HTTP/1.*. The ALPN preference list is http/1.1, http/1.0.
86+
// HTTP2Only Negotiate only HTTP/2. The ALPN preference list is h2.
87+
// HTTP2Optional Prefer HTTP/1.* over HTTP/2 (which can be useful for HTTP/2 testing). The ALPN preference list is http/1.1, http/1.0, h2.
88+
// HTTP2Preferred Prefer HTTP/2 over HTTP/1.*. The ALPN preference list is h2, http/1.1, http/1.0.
89+
// None Do not negotiate ALPN. This is the default.
90+
type ALPNPolicy string
91+
92+
// Supported ALPN policies
93+
const (
94+
ALPNPolicyNone ALPNPolicy = "None"
95+
ALPNPolicyHTTP1Only ALPNPolicy = "HTTP1Only"
96+
ALPNPolicyHTTP2Only ALPNPolicy = "HTTP2Only"
97+
ALPNPolicyHTTP2Optional ALPNPolicy = "HTTP2Optional"
98+
ALPNPolicyHTTP2Preferred ALPNPolicy = "HTTP2Preferred"
99+
)
100+
101+
// +kubebuilder:validation:Enum=on;off
102+
type AdvertiseTrustStoreCaNamesEnum string
103+
104+
// Enum values for AdvertiseTrustStoreCaNamesEnum
105+
const (
106+
AdvertiseTrustStoreCaNamesEnumOn AdvertiseTrustStoreCaNamesEnum = "on"
107+
AdvertiseTrustStoreCaNamesEnumOff AdvertiseTrustStoreCaNamesEnum = "off"
108+
)
109+
110+
// +kubebuilder:validation:Enum=off;passthrough;verify
111+
// MutualAuthenticationMode mTLS mode for mutual TLS authentication config for listener
112+
type MutualAuthenticationMode string
113+
114+
// Supported mTLS modes
115+
const (
116+
MutualAuthenticationOffMode MutualAuthenticationMode = "off"
117+
MutualAuthenticationPassthroughMode MutualAuthenticationMode = "passthrough"
118+
MutualAuthenticationVerifyMode MutualAuthenticationMode = "verify"
119+
)
120+
121+
// Information about the mutual authentication attributes of a listener.
122+
type MutualAuthenticationAttributes struct {
123+
124+
// Indicates whether trust store CA certificate names are advertised.
125+
// +optional
126+
AdvertiseTrustStoreCaNames *AdvertiseTrustStoreCaNamesEnum `json:"advertiseTrustStoreCaNames,omitempty"`
127+
128+
// Indicates whether expired client certificates are ignored.
129+
// +optional
130+
IgnoreClientCertificateExpiry *bool `json:"ignoreClientCertificateExpiry,omitempty"`
131+
132+
// The client certificate handling method. Options are off , passthrough or verify
133+
Mode MutualAuthenticationMode `json:"mode"`
134+
135+
// The Name or ARN of the trust store.
136+
// +optional
137+
TrustStore *string `json:"trustStore,omitempty"`
138+
}
139+
140+
// +kubebuilder:validation:Pattern="^(HTTP|HTTPS|TLS|TCP|UDP)?:(6553[0-5]|655[0-2]\\d|65[0-4]\\d{2}|6[0-4]\\d{3}|[1-5]\\d{4}|[1-9]\\d{0,3})?$"
141+
type ProtocolPort string
142+
type ListenerConfiguration struct {
143+
// protocolPort is identifier for the listener on load balancer. It should be of the form PROTOCOL:PORT
144+
ProtocolPort ProtocolPort `json:"protocolPort"`
145+
146+
// TODO: Add validation in admission webhook to make it required for secure protocols
147+
// defaultCertificate the cert arn to be used by default.
148+
DefaultCertificate *string `json:"defaultCertificate,omitempty"`
149+
150+
// certificates is the list of other certificates to add to the listener.
151+
// +optional
152+
Certificates []*string `json:"certificates,omitempty"`
153+
154+
// sslPolicy is the security policy that defines which protocols and ciphers are supported for secure listeners [HTTPS or TLS listener].
155+
SslPolicy *string `json:"sslPolicy,omitempty"`
156+
157+
// alpnPolicy an optional string that allows you to configure ALPN policies on your Load Balancer
158+
// +optional
159+
ALPNPolicy *ALPNPolicy `json:"alpnPolicy,omitempty"`
160+
161+
// mutualAuthentication defines the mutual authentication configuration information.
162+
// +optional
163+
MutualAuthentication *MutualAuthenticationAttributes `json:"mutualAuthentication,omitempty"`
164+
165+
// listenerAttributes defines the attributes for the listener
166+
// +optional
167+
ListenerAttributes []ListenerAttribute `json:"listenerAttributes,omitempty"`
168+
}
169+
170+
// LoadBalancerConfigurationSpec defines the desired state of LoadBalancerConfiguration
171+
type LoadBalancerConfigurationSpec struct {
172+
// +kubebuilder:validation:MinLength=1
173+
// +kubebuilder:validation:MaxLength=32
174+
// loadBalancerName defines the name of the LB to provision. If unspecified, it will be automatically generated.
175+
// +optional
176+
LoadBalancerName *string `json:"loadBalancerName,omitempty"`
177+
178+
// scheme defines the type of LB to provision. If unspecified, it will be automatically inferred.
179+
// +optional
180+
Scheme *LoadBalancerScheme `json:"scheme,omitempty"`
181+
182+
// loadBalancerIPType defines what kind of load balancer to provision (ipv4, dual stack)
183+
// +optional
184+
IpAddressType *LoadBalancerIpAddressType `json:"ipAddressType,omitempty"`
185+
186+
// enablePrefixForIpv6SourceNat indicates whether to use an IPv6 prefix from each subnet for source NAT for Network Load Balancers with UDP listeners.
187+
// +optional
188+
EnablePrefixForIpv6SourceNat *EnablePrefixForIpv6SourceNatEnum `json:"enablePrefixForIpv6SourceNat,omitempty"`
189+
190+
// enforceSecurityGroupInboundRulesOnPrivateLinkTraffic Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through Amazon Web Services PrivateLink.
191+
// +optional
192+
EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic *string `json:"enforceSecurityGroupInboundRulesOnPrivateLinkTraffic,omitempty"`
193+
194+
// customerOwnedIpv4Pool is the ID of the customer-owned address for Application Load Balancers on Outposts pool.
195+
// +optional
196+
CustomerOwnedIpv4Pool *string `json:"customerOwnedIpv4Pool,omitempty"`
197+
198+
// loadBalancerSubnets is an optional list of subnet configurations to be used in the LB
199+
// +optional
200+
LoadBalancerSubnets *[]SubnetConfiguration `json:"loadBalancerSubnets,omitempty"`
201+
202+
// listenerConfigurations is an optional list of configurations for each listener on LB
203+
// +optional
204+
ListenerConfigurations *[]ListenerConfiguration `json:"listenerConfigurations,omitempty"`
205+
206+
// securityGroups an optional list of security group ids or names to apply to the LB
207+
// +optional
208+
SecurityGroups *[]string `json:"securityGroups,omitempty"`
209+
210+
// securityGroupPrefixes an optional list of prefixes that are allowed to access the LB.
211+
// +optional
212+
SecurityGroupPrefixes *[]string `json:"securityGroupPrefixes,omitempty"`
213+
214+
// sourceRanges an optional list of CIDRs that are allowed to access the LB.
215+
// +optional
216+
SourceRanges *[]string `json:"sourceRanges,omitempty"`
217+
218+
// vpcId is the ID of the VPC for the load balancer.
219+
// +optional
220+
VpcId *string `json:"vpcId,omitempty"`
221+
222+
// LoadBalancerAttributes defines the attribute of LB
223+
// +optional
224+
LoadBalancerAttributes []LoadBalancerAttribute `json:"loadBalancerAttributes,omitempty"`
225+
226+
// Tags defines list of Tags on LB.
227+
// +optional
228+
Tags []LoadBalancerTag `json:"tags,omitempty"`
229+
}
230+
231+
// TODO -- these can be used to set what generation the gateway is currently on to track progress on reconcile.
232+
233+
// LoadBalancerConfigurationStatus defines the observed state of TargetGroupBinding
234+
type LoadBalancerConfigurationStatus struct {
235+
// The generation of the Gateway Configuration attached to the Gateway object.
236+
// +optional
237+
ObservedGatewayConfigurationGeneration *int64 `json:"observedGatewayConfigurationGeneration,omitempty"`
238+
// The generation of the Gateway Configuration attached to the GatewayClass object.
239+
// +optional
240+
ObservedGatewayClassConfigurationGeneration *int64 `json:"observedGatewayClassConfigurationGeneration,omitempty"`
241+
}
242+
243+
// +kubebuilder:object:root=true
244+
// +kubebuilder:subresource:status
245+
// +kubebuilder:storageversion
246+
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
247+
// LoadBalancerConfiguration is the Schema for the LoadBalancerConfiguration API
248+
type LoadBalancerConfiguration struct {
249+
metav1.TypeMeta `json:",inline"`
250+
metav1.ObjectMeta `json:"metadata,omitempty"`
251+
252+
Spec LoadBalancerConfigurationSpec `json:"spec,omitempty"`
253+
Status LoadBalancerConfigurationStatus `json:"status,omitempty"`
254+
}
255+
256+
// +kubebuilder:object:root=true
257+
258+
// LoadBalancerConfigurationList contains a list of LoadBalancerConfiguration
259+
type LoadBalancerConfigurationList struct {
260+
metav1.TypeMeta `json:",inline"`
261+
metav1.ListMeta `json:"metadata,omitempty"`
262+
Items []LoadBalancerConfiguration `json:"items"`
263+
}
264+
265+
func init() {
266+
SchemeBuilder.Register(&LoadBalancerConfiguration{}, &LoadBalancerConfigurationList{})
267+
}

0 commit comments

Comments
 (0)