Skip to content

Commit 871ffc1

Browse files
ciarams87ciarams87
committed
Add BackendTLS Policy support
1 parent f8601db commit 871ffc1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+2200
-142
lines changed

‎.github/workflows/conformance.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
matrix:
3131
k8s-version: ["1.23.17", "latest"]
3232
nginx-image: [nginx, nginx-plus]
33+
enable-experimental: [true, false]
3334
permissions:
3435
contents: write # needed for uploading release artifacts
3536
steps:
@@ -148,6 +149,7 @@ jobs:
148149
ngf_tag=${{ steps.ngf-meta.outputs.version }}
149150
if [ ${{ github.event_name }} == "schedule" ]; then export GW_API_VERSION=main; fi
150151
if [ ${{ startsWith(matrix.k8s-version, '1.23') || startsWith(matrix.k8s-version, '1.24') }} == "true" ]; then export INSTALL_WEBHOOK=true; fi
152+
if [ ${{ matrix.enable-experimental }} == "true" ]; then export ENABLE_EXPERIMENTAL=true; fi
151153
make install-ngf-local-no-build${{ matrix.nginx-image == 'nginx-plus' && '-with-plus' || ''}} PREFIX=${ngf_prefix} TAG=${ngf_tag}
152154
working-directory: ./conformance
153155

‎.gitleaksignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
68d1f6eb80d23c8650c11629459dd6a06c986ca1:internal/state/graph/graph_test.go:private-key:44
44
890fddb787ff3560b9b743647a36b649d498ae51:internal/state/graph/secret_test.go:private-key:35
55
890fddb787ff3560b9b743647a36b649d498ae51:internal/state/change_processor_test.go:private-key:211
6+
internal/mode/static/state/graph/config_maps_test.go:private-key:35

‎.yamllint.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ rules:
3232
ignore: |
3333
deploy/manifests/nginx-gateway.yaml
3434
deploy/manifests/crds
35+
examples/backend-tls/secure-app.yaml
3536
key-duplicates: enable
3637
key-ordering: disable
3738
line-length:

‎cmd/gateway/commands.go

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func createStaticModeCommand() *cobra.Command {
5656
leaderElectionDisableFlag = "leader-election-disable"
5757
leaderElectionLockNameFlag = "leader-election-lock-name"
5858
plusFlag = "nginx-plus"
59+
experimentalEnableFlag = "experimental-features-enable"
5960
)
6061

6162
// flag values
@@ -95,6 +96,8 @@ func createStaticModeCommand() *cobra.Command {
9596
}
9697

9798
plus bool
99+
100+
enableExperimental bool
98101
)
99102

100103
cmd := &cobra.Command{
@@ -169,9 +172,10 @@ func createStaticModeCommand() *cobra.Command {
169172
LockName: leaderElectionLockName.String(),
170173
Identity: podName,
171174
},
172-
Plus: plus,
173-
TelemetryReportPeriod: period,
174-
Version: version,
175+
Plus: plus,
176+
TelemetryReportPeriod: period,
177+
Version: version,
178+
EnableExperimentalFeatures: enableExperimental,
175179
}
176180

177181
if err := static.StartManager(conf); err != nil {
@@ -285,6 +289,14 @@ func createStaticModeCommand() *cobra.Command {
285289
"Use NGINX Plus",
286290
)
287291

292+
cmd.Flags().BoolVar(
293+
&enableExperimental,
294+
experimentalEnableFlag,
295+
false,
296+
"Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. "+
297+
"Requires the Gateway APIs installed from the experimental channel.",
298+
)
299+
288300
return cmd
289301
}
290302

‎conformance/Makefile

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ CRDS=../deploy/manifests/crds/
1515
STATIC_MANIFEST=provisioner/static-deployment.yaml
1616
PROVISIONER_MANIFEST=provisioner/provisioner.yaml
1717
INSTALL_WEBHOOK ?= false
18+
ENABLE_EXPERIMENTAL ?= false
1819
.DEFAULT_GOAL := help
1920

2021
.PHONY: help
@@ -37,7 +38,7 @@ create-kind-cluster: ## Create a kind cluster
3738

3839
.PHONY: update-ngf-manifest
3940
update-ngf-manifest: ## Update the NGF deployment manifest image names and imagePullPolicies
40-
cd .. && make generate-manifests HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE="--set nginxGateway.kind=skip" HELM_TEMPLATE_COMMON_ARGS="--set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never" && cd -
41+
cd .. && make generate-manifests HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE="--set nginxGateway.kind=skip" HELM_TEMPLATE_COMMON_ARGS="--set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never --set nginxGateway.experimentalFeatures.enable=$(ENABLE_EXPERIMENTAL)" && cd -
4142

4243
.PHONY: update-ngf-manifest-with-plus
4344
update-ngf-manifest-with-plus: ## Update the NGF deployment manifest image names and imagePullPolicies including nginx-plus
@@ -61,7 +62,7 @@ load-images-with-plus: ## Load NGF and NGINX Plus images on configured kind clus
6162

6263
.PHONY: prepare-ngf-dependencies
6364
prepare-ngf-dependencies: update-ngf-manifest ## Install NGF dependencies on configured kind cluster
64-
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
65+
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
6566
kubectl apply -f $(CRDS)
6667
kubectl apply -f $(NGF_MANIFEST)
6768

@@ -118,7 +119,7 @@ uninstall-ngf: uninstall-k8s-components undo-manifests-update ## Uninstall NGF o
118119
.PHONY: uninstall-k8s-components
119120
uninstall-k8s-components: ## Uninstall installed components on configured kind cluster
120121
-kubectl delete -f $(NGF_MANIFEST)
121-
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
122+
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
122123
kubectl delete clusterrole nginx-gateway-provisioner
123124
kubectl delete clusterrolebinding nginx-gateway-provisioner
124125

‎conformance/README.md

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -44,23 +44,24 @@ update-ngf-manifest Update the NGF deployment manifest image na
4444

4545
**Note:** The following variables are configurable when running the below `make` commands:
4646

47-
| Variable | Default | Description |
48-
|----------------------|---------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
49-
| CONFORMANCE_TAG | latest | The tag for the conformance test image |
50-
| CONFORMANCE_PREFIX | conformance-test-runner | The prefix for the conformance test image |
51-
| TAG | edge | The tag for the locally built NGF image |
52-
| PREFIX | nginx-gateway-fabric | The prefix for the locally built NGF image |
53-
| GW_API_VERSION | 1.0.0 | Tag for the Gateway API version to check out. Set to `main` to get the latest version |
54-
| KIND_IMAGE | Latest kind image, as defined in the tests/Dockerfile | The kind image to use |
55-
| KIND_KUBE_CONFIG | ~/.kube/kind/config | The location of the kubeconfig |
56-
| GATEWAY_CLASS | nginx | The gateway class that should be used for the tests |
57-
| SUPPORTED_FEATURES | HTTPRoute,HTTPRouteQueryParamMatching, HTTPRouteMethodMatching,HTTPRoutePortRedirect, HTTPRouteSchemeRedirect | The supported features that should be tested by the conformance tests. Ensure the list is comma separated with no spaces. |
58-
| EXEMPT_FEATURES | ReferenceGrant | The features that should not be tested by the conformance tests |
59-
| NGF_MANIFEST | ../deploy/manifests/nginx-gateway.yaml | The location of the NGF manifest |
60-
| SERVICE_MANIFEST | ../deploy/manifests/service/nodeport.yaml | The location of the NGF Service manifest |
61-
| STATIC_MANIFEST | provisioner/static-deployment.yaml | The location of the NGF static deployment manifest |
62-
| PROVISIONER_MANIFEST | provisioner/provisioner.yaml | The location of the NGF provisioner manifest |
63-
| INSTALL_WEBHOOK | false | Install the Gateway API Validating Webhook. Necessary for Kubernetes versions < 1.25. |
47+
| Variable | Default | Description |
48+
| -------------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
49+
| CONFORMANCE_TAG | latest | The tag for the conformance test image |
50+
| CONFORMANCE_PREFIX | conformance-test-runner | The prefix for the conformance test image |
51+
| TAG | edge | The tag for the locally built NGF image |
52+
| PREFIX | nginx-gateway-fabric | The prefix for the locally built NGF image |
53+
| GW_API_VERSION | 1.0.0 | Tag for the Gateway API version to check out. Set to `main` to get the latest version |
54+
| KIND_IMAGE | Latest kind image, as defined in the tests/Dockerfile | The kind image to use |
55+
| KIND_KUBE_CONFIG | ~/.kube/kind/config | The location of the kubeconfig |
56+
| GATEWAY_CLASS | nginx | The gateway class that should be used for the tests |
57+
| SUPPORTED_FEATURES | HTTPRoute,HTTPRouteQueryParamMatching, HTTPRouteMethodMatching,HTTPRoutePortRedirect, HTTPRouteSchemeRedirect | The supported features that should be tested by the conformance tests. Ensure the list is comma separated with no spaces. |
58+
| EXEMPT_FEATURES | ReferenceGrant | The features that should not be tested by the conformance tests |
59+
| NGF_MANIFEST | ../deploy/manifests/nginx-gateway.yaml | The location of the NGF manifest |
60+
| SERVICE_MANIFEST | ../deploy/manifests/service/nodeport.yaml | The location of the NGF Service manifest |
61+
| STATIC_MANIFEST | provisioner/static-deployment.yaml | The location of the NGF static deployment manifest |
62+
| PROVISIONER_MANIFEST | provisioner/provisioner.yaml | The location of the NGF provisioner manifest |
63+
| INSTALL_WEBHOOK | false | Install the Gateway API Validating Webhook. Necessary for Kubernetes versions < 1.25. |
64+
| ENABLE_EXPERIMENTAL | false | Enable experimental features. Installs the Gateway APIs from the experimental channel and enables any supported experimental features in NGF. |
6465

6566
### Step 1 - Create a kind Cluster
6667

@@ -85,6 +86,12 @@ make create-kind-cluster KIND_IMAGE=kindest/node:v1.27.3
8586
```
8687

8788
> Otherwise, the latest stable version will be used by default.
89+
> Additionally, if you want to run conformance tests with experimental features enabled, set the following
90+
> environment variable before deploying NGF:
91+
92+
```bash
93+
export ENABLE_EXPERIMENTAL=true
94+
```
8895

8996
#### *Option 1* Build and install NGINX Gateway Fabric from local to configured kind cluster
9097

‎conformance/scripts/install-gateway.sh

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,31 @@ if [ -z $2 ]; then
1010
exit 1
1111
fi
1212

13+
if [ -z $3 ]; then
14+
echo "enable experimental argument not set; exiting"
15+
exit 1
16+
fi
17+
1318
if [ $1 == "main" ]; then
1419
temp_dir=$(mktemp -d)
1520
cd ${temp_dir}
1621
curl -s https://codeload.github.com/kubernetes-sigs/gateway-api/tar.gz/main | tar -xz --strip=2 gateway-api-main/config
17-
kubectl apply -f crd/standard
22+
if [ $3 == "true" ]; then
23+
kubectl apply -f crd/experimental
24+
else
25+
kubectl apply -f crd/standard
26+
fi
1827
if [ $2 == "true" ]; then
1928
kubectl apply -f webhook
2029
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system
2130
fi
2231
rm -rf ${temp_dir}
2332
else
24-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
33+
if [ $3 == "true" ]; then
34+
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/experimental-install.yaml
35+
else
36+
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
37+
fi
2538
if [ $2 == "true" ]; then
2639
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/webhook-install.yaml
2740
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system

‎conformance/scripts/uninstall-gateway.sh

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,35 @@ if [ -z $1 ]; then
55
exit 1
66
fi
77

8+
if [ -z $2 ]; then
9+
echo "install webhook argument not set; exiting"
10+
exit 1
11+
fi
12+
13+
if [ -z $3 ]; then
14+
echo "enable experimental argument not set; exiting"
15+
exit 1
16+
fi
17+
818
if [ $1 == "main" ]; then
919
temp_dir=$(mktemp -d)
1020
cd ${temp_dir}
1121
curl -s https://codeload.github.com/kubernetes-sigs/gateway-api/tar.gz/main | tar -xz --strip=2 gateway-api-main/config
12-
kubectl delete -f crd/standard
22+
if [ $3 == "true" ]; then
23+
kubectl delete -f crd/experimental
24+
else
25+
kubectl delete -f crd/standard
26+
fi
1327
if [ $2 == "true" ]; then
1428
kubectl delete -f webhook
1529
fi
1630
rm -rf ${temp_dir}
1731
else
18-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
32+
if [ $3 == "true" ]; then
33+
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/experimental-install.yaml
34+
else
35+
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
36+
fi
1937
if [ $2 == "true" ]; then
2038
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/webhook-install.yaml
2139
fi

‎deploy/helm-chart/templates/deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ spec:
5252
{{- else }}
5353
- --leader-election-disable
5454
{{- end }}
55+
{{- if .Values.nginxGateway.experimentalFeatures.enable }}
56+
- --experimental-features-enable
57+
{{- end }}
5558
env:
5659
- name: POD_IP
5760
valueFrom:

‎deploy/helm-chart/templates/rbac.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ rules:
3232
- namespaces
3333
- services
3434
- secrets
35+
- configmaps
3536
verbs:
3637
- list
3738
- watch
@@ -76,6 +77,7 @@ rules:
7677
- gateways
7778
- httproutes
7879
- referencegrants
80+
- backendtlspolicies
7981
verbs:
8082
- list
8183
- watch

‎deploy/helm-chart/values.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ nginxGateway:
5151
## extraVolumeMounts are the additional volume mounts for the nginx-gateway container.
5252
extraVolumeMounts: []
5353

54+
experimentalFeatures:
55+
## Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. Requires the Gateway
56+
## APIs installed from the experimental channel.
57+
enable: false
58+
5459
nginx:
5560
## The NGINX image to use
5661
image:

‎deploy/manifests/nginx-gateway.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ rules:
3232
- namespaces
3333
- services
3434
- secrets
35+
- configmaps
3536
verbs:
3637
- list
3738
- watch
@@ -76,6 +77,7 @@ rules:
7677
- gateways
7778
- httproutes
7879
- referencegrants
80+
- backendtlspolicies
7981
verbs:
8082
- list
8183
- watch

0 commit comments

Comments
 (0)