Skip to content

feat(Istio): Add label selector exclusions for ServiceEntries#14328

Merged
ymesika merged 4 commits into
kgateway-dev:mainfrom
ymesika:serviceentry-exclusion-label-selectors
Jul 1, 2026
Merged

feat(Istio): Add label selector exclusions for ServiceEntries#14328
ymesika merged 4 commits into
kgateway-dev:mainfrom
ymesika:serviceentry-exclusion-label-selectors

Conversation

@ymesika

@ymesika ymesika commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Adds a controller setting for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using standard Kubernetes label selectors.

Example Helm configuration:

serviceEntriesExclusionLabelSelectors:
  - matchLabels:
      example.io/source: generated
      example.io/source-kind: ExternalService

Empty exclusion selector entries are rejected because they would match every ServiceEntry.

Change Type

/kind feature

Changelog

Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors.

Additional Notes

Copilot AI review requested due to automatic review settings June 30, 2026 14:03
@ymesika
ymesika requested a review from a team as a code owner June 30, 2026 14:03
@gateway-bot gateway-bot added kind/feature Categorizes issue or PR as related to a new feature. release-note labels Jun 30, 2026
Copilot AI reviewed Jun 30, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new controller/Helm setting to exclude Istio ServiceEntry resources from kgateway ServiceEntry backend and endpoint discovery using standard Kubernetes label selectors, with validation to prevent “match everything” selector entries.

Changes:

  • Introduces serviceEntriesExclusionLabelSelectors Helm value -> KGW_SERVICE_ENTRIES_EXCLUSION_LABEL_SELECTORS setting, and plumbs it into controller settings.
  • Adds shared selector parsing helpers (including exclusion-specific validation) and uses them for both namespace discovery selectors and ServiceEntry exclusion selectors.
  • Applies exclusion filtering in the ServiceEntry plugin’s input collection and adds unit tests; updates Helm golden manifests accordingly.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
api/settings/settings.go Adds ServiceEntriesExclusionLabelSelectors setting (env-backed) with default [].
api/settings/settings_test.go Extends settings envvar tests to cover the new setting.
install/helm/kgateway/values.yaml Documents and exposes serviceEntriesExclusionLabelSelectors chart value.
install/helm/kgateway/templates/deployment.yaml Injects KGW_SERVICE_ENTRIES_EXCLUSION_LABEL_SELECTORS into the controller Deployment env.
pkg/pluginsdk/collections/label_selectors.go New shared utilities for parsing JSON label selectors, validating exclusion selectors, and matching.
pkg/pluginsdk/collections/label_selectors_test.go Unit tests for selector parsing/matching and exclusion validation.
pkg/pluginsdk/collections/discovery.go Refactors namespace discovery selector parsing to use the shared helper.
pkg/pluginsdk/collections/collections.go Parses/validates ServiceEntry exclusion selectors once in CommonCollections when Istio integration is enabled.
pkg/kgateway/extensions2/plugins/serviceentry/plugin.go Adds plugin option plumbing for ServiceEntry exclusion selectors (defaults from settings/common collections).
pkg/kgateway/extensions2/plugins/serviceentry/collections.go Filters ServiceEntries collection prior to backend/endpoint derivation based on exclusion selectors.
pkg/kgateway/extensions2/plugins/serviceentry/exclusion_test.go Adds tests for selector-based ServiceEntry exclusion and verifies backend filtering behavior.
test/helm/testdata/kgateway/default.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/additional-labels.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/admin-bind-address.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-empty-pod-annotations.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-empty-tolerations-override.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-empty-topology-spread-constraints-override.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-null-pod-annotations.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-null-tolerations-fallback.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-null-topology-spread-constraints-fallback.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-overrides-replace-not-merge.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/controller-overrides-top-level-values.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/hpa-and-vpa.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/pdb-max-unavailable.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/pdb-min-available.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/priority-class-name.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/probes-full-override.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/prometheus-annotations-disabled.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/readiness-probe-override.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/replicas-null.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/replicas-zero.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/service-full-config.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/service-monitor-enabled.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/startup-probe-override.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/tolerations.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/topology-spread-constraints.golden Updates golden output to include the new env var with default [].
test/helm/testdata/kgateway/xds-tls-enabled.golden Updates golden output to include the new env var with default [].

Comment thread pkg/pluginsdk/collections/label_selectors.go
Comment thread pkg/pluginsdk/collections/label_selectors.go
Comment thread pkg/pluginsdk/collections/collections.go
@ymesika
ymesika force-pushed the serviceentry-exclusion-label-selectors branch from 0dee525 to b7cfc5e Compare July 1, 2026 13:43
@ymesika
ymesika enabled auto-merge July 1, 2026 13:49
@ymesika
ymesika added this pull request to the merge queue Jul 1, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 1, 2026
@ymesika
ymesika added this pull request to the merge queue Jul 1, 2026
Merged via the queue into kgateway-dev:main with commit ce571ba Jul 1, 2026
32 checks passed
@ymesika
ymesika deleted the serviceentry-exclusion-label-selectors branch July 1, 2026 14:59
@ymesika ymesika mentioned this pull request Jul 7, 2026
Merged
chandler-solo pushed a commit to chandler-solo/kgateway that referenced this pull request Jul 10, 2026
@ymesika
[2.3.x Backport] feat(Istio): Add label selector exclusions for Servi…
8ce4deb 
…ceEntries (kgateway-dev#14328) (kgateway-dev#14359)

Signed-off-by: Yossi Mesika <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@davidjumani davidjumani davidjumani approved these changes

Assignees

No one assigned

Labels

kind/feature Categorizes issue or PR as related to a new feature. release-note

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@ymesika @davidjumani @gateway-bot