Skip to content

Commit a25c3c9

Browse files
arkodgarkodg
authored
improve targetRef selection for targetSelectors (#6917)
* improve targetRef selection for targetSelectors * only select refs in the same namespace as the policy Signed-off-by: Arko Dasgupta <[email protected]> * fix lint Signed-off-by: Arko Dasgupta <[email protected]> --------- Signed-off-by: Arko Dasgupta <[email protected]>
1 parent e4a3069 commit a25c3c9

9 files changed

+426
-15
lines changed

‎internal/gatewayapi/backendtrafficpolicy.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
7777
// TODO: This loop is similar to the one 'Process the policies targeting Gateways', we may want to
7878
// merge them into one if possible.
7979
for _, currPolicy := range backendTrafficPolicies {
80-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
80+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
8181
for _, currTarget := range targetRefs {
8282
if currTarget.Kind == resource.KindGateway {
8383
// Check if the gateway exists
@@ -104,7 +104,7 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
104104
// Process the policies targeting xRoutes
105105
for _, currPolicy := range backendTrafficPolicies {
106106
policyName := utils.NamespacedName(currPolicy)
107-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes)
107+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes, currPolicy.Namespace)
108108
for _, currTarget := range targetRefs {
109109
if currTarget.Kind != resource.KindGateway {
110110
policy, found := handledPolicies[policyName]
@@ -232,7 +232,7 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
232232
// Process the policies targeting Gateways
233233
for _, currPolicy := range backendTrafficPolicies {
234234
policyName := utils.NamespacedName(currPolicy)
235-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
235+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
236236
for _, currTarget := range targetRefs {
237237
if currTarget.Kind == resource.KindGateway {
238238
policy, found := handledPolicies[policyName]

‎internal/gatewayapi/clienttrafficpolicy.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ func (t *Translator) ProcessClientTrafficPolicies(
163163
// Policy with no section set (targeting all sections)
164164
for _, currPolicy := range clientTrafficPolicies {
165165
policyName := utils.NamespacedName(currPolicy)
166-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
166+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
167167
for _, currTarget := range targetRefs {
168168
if !hasSectionName(&currTarget) {
169169

‎internal/gatewayapi/envoyextensionpolicy.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
7575
// Process the policies targeting RouteRules
7676
for _, currPolicy := range envoyExtensionPolicies {
7777
policyName := utils.NamespacedName(currPolicy)
78-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes)
78+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes, currPolicy.Namespace)
7979
for _, currTarget := range targetRefs {
8080
if currTarget.Kind != resource.KindGateway && currTarget.SectionName != nil {
8181
policy, found := handledPolicies[policyName]
@@ -94,7 +94,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
9494
// Process the policies targeting xRoutes
9595
for _, currPolicy := range envoyExtensionPolicies {
9696
policyName := utils.NamespacedName(currPolicy)
97-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes)
97+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes, currPolicy.Namespace)
9898
for _, currTarget := range targetRefs {
9999
if currTarget.Kind != resource.KindGateway && currTarget.SectionName == nil {
100100
policy, found := handledPolicies[policyName]
@@ -113,7 +113,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
113113
// Process the policies targeting Listeners
114114
for _, currPolicy := range envoyExtensionPolicies {
115115
policyName := utils.NamespacedName(currPolicy)
116-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
116+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
117117
for _, currTarget := range targetRefs {
118118
if currTarget.Kind == resource.KindGateway && currTarget.SectionName != nil {
119119
policy, found := handledPolicies[policyName]
@@ -132,7 +132,7 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
132132
// Process the policies targeting Gateways
133133
for _, currPolicy := range envoyExtensionPolicies {
134134
policyName := utils.NamespacedName(currPolicy)
135-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
135+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
136136
for _, currTarget := range targetRefs {
137137
if currTarget.Kind == resource.KindGateway && currTarget.SectionName == nil {
138138
policy, found := handledPolicies[policyName]

‎internal/gatewayapi/extensionserverpolicy.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ func extractTargetRefs(policy *unstructured.Unstructured, gateways []*GatewayCon
103103
if err := json.Unmarshal(specAsJSON, &targetRefs); err != nil {
104104
return nil, fmt.Errorf("no targets found for the policy")
105105
}
106-
ret := getPolicyTargetRefs(targetRefs, gateways)
106+
ret := getPolicyTargetRefs(targetRefs, gateways, policy.GetNamespace())
107107
if len(ret) == 0 {
108108
return nil, fmt.Errorf("no targets found for the policy")
109109
}

‎internal/gatewayapi/helpers.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -557,7 +557,7 @@ func selectorFromTargetSelector(selector egv1a1.TargetSelector) labels.Selector
557557
return l
558558
}
559559

560-
func getPolicyTargetRefs[T client.Object](policy egv1a1.PolicyTargetReferences, potentialTargets []T) []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName {
560+
func getPolicyTargetRefs[T client.Object](policy egv1a1.PolicyTargetReferences, potentialTargets []T, policyNamespace string) []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName {
561561
dedup := sets.New[targetRefWithTimestamp]()
562562
for _, currSelector := range policy.TargetSelectors {
563563
labelSelector := selectorFromTargetSelector(currSelector)
@@ -568,6 +568,11 @@ func getPolicyTargetRefs[T client.Object](policy egv1a1.PolicyTargetReferences,
568568
continue
569569
}
570570

571+
// Skip objects not in the same namespace as the policy
572+
if obj.GetNamespace() != policyNamespace {
573+
continue
574+
}
575+
571576
if labelSelector.Matches(labels.Set(obj.GetLabels())) {
572577
dedup.Insert(targetRefWithTimestamp{
573578
CreationTimestamp: obj.GetCreationTimestamp(),

‎internal/gatewayapi/helpers_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -581,7 +581,7 @@ func TestGetPolicyTargetRefs(t *testing.T) {
581581

582582
for _, tc := range testCases {
583583
t.Run(tc.name, func(t *testing.T) {
584-
results := getPolicyTargetRefs(tc.policy, tc.targets)
584+
results := getPolicyTargetRefs(tc.policy, tc.targets, "default")
585585
require.ElementsMatch(t, results, tc.results)
586586
})
587587
}

‎internal/gatewayapi/securitypolicy.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
9191
// Process the policies targeting RouteRules
9292
for _, currPolicy := range securityPolicies {
9393
policyName := utils.NamespacedName(currPolicy)
94-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes)
94+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes, currPolicy.Namespace)
9595
for _, currTarget := range targetRefs {
9696
if currTarget.Kind != resource.KindGateway && currTarget.SectionName != nil {
9797
policy, found := handledPolicies[policyName]
@@ -109,7 +109,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
109109
// Process the policies targeting xRoutes
110110
for _, currPolicy := range securityPolicies {
111111
policyName := utils.NamespacedName(currPolicy)
112-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes)
112+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, routes, currPolicy.Namespace)
113113
for _, currTarget := range targetRefs {
114114
if currTarget.Kind != resource.KindGateway && currTarget.SectionName == nil {
115115
policy, found := handledPolicies[policyName]
@@ -127,7 +127,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
127127
// Process the policies targeting Listeners
128128
for _, currPolicy := range securityPolicies {
129129
policyName := utils.NamespacedName(currPolicy)
130-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
130+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
131131
for _, currTarget := range targetRefs {
132132
if currTarget.Kind == resource.KindGateway && currTarget.SectionName != nil {
133133
policy, found := handledPolicies[policyName]
@@ -145,7 +145,7 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
145145
// Process the policies targeting Gateways
146146
for _, currPolicy := range securityPolicies {
147147
policyName := utils.NamespacedName(currPolicy)
148-
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways)
148+
targetRefs := getPolicyTargetRefs(currPolicy.Spec.PolicyTargetReferences, gateways, currPolicy.Namespace)
149149
for _, currTarget := range targetRefs {
150150
if currTarget.Kind == resource.KindGateway && currTarget.SectionName == nil {
151151
policy, found := handledPolicies[policyName]

‎internal/gatewayapi/testdata/backendtrafficpolicy-multiple-targets-targetselector.in.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
namespace: envoy-gateway
6+
name: gateway-1
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- name: http
11+
protocol: HTTP
12+
port: 80
13+
allowedRoutes:
14+
namespaces:
15+
from: All
16+
httpRoutes:
17+
- apiVersion: gateway.networking.k8s.io/v1
18+
kind: HTTPRoute
19+
metadata:
20+
namespace: default
21+
name: httproute
22+
labels:
23+
app: web-service
24+
spec:
25+
hostnames:
26+
- gateway.envoyproxy.io
27+
parentRefs:
28+
- namespace: envoy-gateway
29+
name: gateway-1
30+
sectionName: http
31+
rules:
32+
- matches:
33+
- path:
34+
value: "/"
35+
backendRefs:
36+
- name: service-1
37+
port: 8080
38+
- apiVersion: gateway.networking.k8s.io/v1
39+
kind: HTTPRoute
40+
metadata:
41+
namespace: envoy-gateway
42+
name: httproute
43+
labels:
44+
app: web-service
45+
spec:
46+
hostnames:
47+
- gateway.envoyproxy.io
48+
parentRefs:
49+
- namespace: envoy-gateway
50+
name: gateway-1
51+
sectionName: http
52+
rules:
53+
- matches:
54+
- path:
55+
value: "/"
56+
backendRefs:
57+
- name: service-2
58+
namespace: envoy-gateway
59+
port: 8080
60+
backendTrafficPolicies:
61+
- apiVersion: gateway.envoyproxy.io/v1alpha1
62+
kind: BackendTrafficPolicy
63+
metadata:
64+
namespace: envoy-gateway
65+
name: policy-for-route-in-envoy-gateway-ns
66+
spec:
67+
targetSelectors:
68+
- group: gateway.networking.k8s.io
69+
kind: HTTPRoute
70+
matchLabels:
71+
app: web-service
72+
useClientProtocol: true
73+
services:
74+
- apiVersion: v1
75+
kind: Service
76+
metadata:
77+
namespace: default
78+
name: service-1
79+
spec:
80+
ports:
81+
- port: 8080
82+
name: http
83+
protocol: TCP
84+
- apiVersion: v1
85+
kind: Service
86+
metadata:
87+
namespace: envoy-gateway
88+
name: service-2
89+
spec:
90+
ports:
91+
- port: 8080
92+
name: http
93+
protocol: TCP
94+
endpointSlices:
95+
- apiVersion: discovery.k8s.io/v1
96+
kind: EndpointSlice
97+
metadata:
98+
name: endpointslice-service-1
99+
namespace: default
100+
labels:
101+
kubernetes.io/service-name: service-1
102+
addressType: IPv4
103+
ports:
104+
- name: http
105+
protocol: TCP
106+
port: 8080
107+
endpoints:
108+
- addresses:
109+
- 8.8.8.8
110+
conditions:
111+
ready: true
112+
- apiVersion: discovery.k8s.io/v1
113+
kind: EndpointSlice
114+
metadata:
115+
name: endpointslice-service-2
116+
namespace: envoy-gateway
117+
labels:
118+
kubernetes.io/service-name: service-2
119+
addressType: IPv4
120+
ports:
121+
- name: http
122+
protocol: TCP
123+
port: 8080
124+
endpoints:
125+
- addresses:
126+
- 8.8.8.8
127+
conditions:
128+
ready: true

0 commit comments

Comments
 (0)