Adds Initial Support for Infra IR Metadata

Signed-off-by: danehans <daneyonhansen@gmail.com>
envoyproxy · Sep 7, 2022 · 4ce5d79 · 4ce5d79
1 parent b0920a6
commit 4ce5d79
Show file tree

Hide file tree

Showing 33 changed files with 189 additions and 3 deletions.
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -70,6 +70,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...rnal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml b/...rnal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
@@ -62,6 +62,10 @@ xdsIR:
       port: 80
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...tewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml b/...tewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
@@ -62,6 +62,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...rnal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml b/...rnal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
@@ -60,6 +60,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
@@ -60,6 +60,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...ayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml b/...ayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
@@ -60,6 +60,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...estdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml b/...estdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
@@ -58,6 +58,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...tdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml b/...tdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
@@ -64,6 +64,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...a/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml b/...a/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
@@ -65,6 +65,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...estdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml b/...estdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
@@ -64,6 +64,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...tewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml b/...tewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
@@ -56,6 +56,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...ata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/...ata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -78,6 +78,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
@@ -57,6 +57,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -77,6 +77,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
@@ -80,6 +80,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml b/...api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
@@ -80,6 +80,10 @@ httpRoutes:
 xdsIR: {}
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -101,6 +101,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
@@ -70,6 +70,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...atewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/...atewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -95,6 +95,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
@@ -72,6 +72,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -80,6 +80,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -83,6 +83,10 @@ xdsIR:
               weight: 3
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...wayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/...wayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -72,6 +72,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -74,6 +74,10 @@ xdsIR:
           destinations: 
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/...-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -65,6 +65,10 @@ xdsIR:
         - "*.envoyproxy.io"
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -71,6 +71,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...pi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/...pi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -80,6 +80,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...ata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/...ata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -76,6 +76,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/...ttproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/...ttproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -87,6 +87,10 @@ xdsIR:
               weight: 1
 infraIR:
   proxy:
+    metadata:
+      labels:
+        gateway.envoyproxy.io/owning-gateway-name: gateway-1
+        gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
     name: envoy-gateway-class
     image: envoyproxy/envoy:v1.23-latest
     listeners:

diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
@@ -20,6 +20,13 @@ const (
 	KindHTTPRoute = "HTTPRoute"
 	KindService   = "Service"
 	KindSecret    = "Secret"
+
+	// OwningGatewayNameLabel is the owner reference label used for managed infra.
+	// The value should be the name of the Gateway used to CRUD the Service.
+	OwningGatewayNameLabel = "gateway.envoyproxy.io/owning-gateway-name"
+	// OwningGatewayNamespaceLabel is the owner reference label used for managed infra.
+	// The value should be the namespace of the Gateway used to CRUD the Service.
+	OwningGatewayNamespaceLabel = "gateway.envoyproxy.io/owning-gateway-namespace"
 )
 
 // Resources holds the Gateway API and related
@@ -98,6 +105,15 @@ func (t *Translator) Translate(resources *Resources) *TranslateResult {
 	infraIR := ir.NewInfra()
 	infraIR.Proxy.Name = string(t.GatewayClassName)
 
+	// Apply Infra IR metadata.
+	if resources != nil {
+		for i := range resources.Gateways {
+			if resources.Gateways[i] != nil {
+				infraIR.Proxy.Metadata.Labels = GatewayOwnerLabels(resources.Gateways[i])
+			}
+		}
+	}
+
 	// Get Gateways belonging to our GatewayClass.
 	gateways := t.GetRelevantGateways(resources.Gateways)
 
@@ -966,3 +982,11 @@ func irTLSConfig(tlsSecret *v1.Secret) *ir.TLSListenerConfig {
 		PrivateKey:        tlsSecret.Data[v1.TLSPrivateKeyKey],
 	}
 }
+
+// GatewayOwnerLabels returns owner labels for the provided Gateway.
+func GatewayOwnerLabels(gw *v1beta1.Gateway) map[string]string {
+	return map[string]string{
+		OwningGatewayNameLabel:      gw.Name,
+		OwningGatewayNamespaceLabel: gw.Namespace,
+	}
+}