Skip to content
This repository was archived by the owner on Dec 2, 2025. It is now read-only.

Commit cb9895b

Browse files
zongzwzongzw
committed
Add secret reconciling support.
1 parent 113aeda commit cb9895b

File tree

11 files changed

+269
-115
lines changed

11 files changed

+269
-115
lines changed

‎deploy/0.prepare-certificates.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ spec:
99
selfSigned: {}
1010

1111
---
12+
1213
apiVersion: cert-manager.io/v1
1314
kind: Certificate
1415
metadata:
@@ -25,7 +26,9 @@ spec:
2526
name: selfsigned-issuer
2627
kind: ClusterIssuer
2728
group: cert-manager.io
29+
2830
---
31+
2932
apiVersion: cert-manager.io/v1
3033
kind: Issuer
3134
metadata:
@@ -36,6 +39,7 @@ spec:
3639
secretName: root-secret
3740

3841
---
42+
3943
apiVersion: cert-manager.io/v1
4044
kind: Certificate
4145
metadata:

‎internal/controllers/httproute_controller.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ func (r *HttpRouteReconciler) GetResObject() client.Object {
7878

7979
func handleDeletingHTTPRoute(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
8080
hr := pkg.ActiveSIGs.GetHTTPRoute(req.NamespacedName.String())
81-
gws := pkg.ActiveSIGs.GatewayRefsOf(hr)
81+
gws := pkg.ActiveSIGs.GatewayRefsOfHR(hr)
8282
drs := map[string]*deployer.DeployRequest{}
8383
for _, gw := range gws {
8484
if _, f := drs[string(gw.Spec.GatewayClassName)]; !f {
@@ -150,7 +150,7 @@ func handleUpsertingHTTPRoute(ctx context.Context, obj *gatewayv1beta1.HTTPRoute
150150
slog.Debugf("upserting " + reqnsn)
151151

152152
hr := pkg.ActiveSIGs.GetHTTPRoute(reqnsn)
153-
gws := pkg.ActiveSIGs.GatewayRefsOf(hr)
153+
gws := pkg.ActiveSIGs.GatewayRefsOfHR(hr)
154154
drs := map[string]*deployer.DeployRequest{}
155155

156156
for _, gw := range gws {
@@ -182,7 +182,7 @@ func handleUpsertingHTTPRoute(ctx context.Context, obj *gatewayv1beta1.HTTPRoute
182182

183183
// We still need to consider gateways that were previously associated but are no longer associated,
184184
// Or the previously associated gateways may be recognized as resource deletions.
185-
gws = pkg.UnifiedGateways(append(gws, pkg.ActiveSIGs.GatewayRefsOf(obj.DeepCopy())...))
185+
gws = pkg.UnifiedGateways(append(gws, pkg.ActiveSIGs.GatewayRefsOfHR(obj.DeepCopy())...))
186186

187187
for _, gw := range gws {
188188
if _, f := drs[string(gw.Spec.GatewayClassName)]; !f {

‎internal/controllers/referencegrant_controller.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,9 @@ func (r *ReferenceGrantReconciler) Reconcile(ctx context.Context, req ctrl.Reque
6060
pkg.ActiveSIGs.UnsetReferenceGrant(keyname)
6161
return fmt.Sprintf("deleting referencegrant %s", keyname)
6262
}); err != nil {
63-
return ctrl.Result{}, nil
64-
} else {
6563
return ctrl.Result{}, err
64+
} else {
65+
return ctrl.Result{}, nil
6666
}
6767
} else {
6868
return ctrl.Result{}, err

‎internal/controllers/secret_controller.go‎

Lines changed: 35 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,12 @@ package controllers
1818

1919
import (
2020
"context"
21+
"fmt"
2122
"time"
2223

2324
"github.com/f5devcentral/bigip-kubernetes-gateway/internal/pkg"
24-
"github.com/google/uuid"
2525
"github.com/f5devcentral/f5-bigip-rest-go/utils"
26+
"github.com/google/uuid"
2627
v1 "k8s.io/api/core/v1"
2728
ctrl "sigs.k8s.io/controller-runtime"
2829
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -48,17 +49,43 @@ func (r *SecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
4849
slog := utils.LogFromContext(lctx)
4950

5051
var obj v1.Secret
51-
slog.Infof("serect event: %s", req.NamespacedName)
52+
slog.Infof("secret event: %s", req.NamespacedName)
5253

5354
if err := r.Client.Get(ctx, req.NamespacedName, &obj); err != nil {
54-
if client.IgnoreNotFound(err) != nil {
55+
if client.IgnoreNotFound(err) == nil {
56+
// delete
57+
scrt := pkg.ActiveSIGs.GetSecret(req.NamespacedName.String())
58+
gws := pkg.ActiveSIGs.GatewayRefsOfSecret(scrt)
59+
names := []string{}
60+
for _, gw := range gws {
61+
names = append(names, utils.Keyname(gw.Namespace, gw.Name))
62+
}
63+
slog.Warnf("there are still gateways referring to secret '%s': %s "+
64+
"-- they are not impacted, however, next deployments would fail "+
65+
"because of missing the secret", req.NamespacedName, names)
66+
pkg.ActiveSIGs.UnsetSerect(req.NamespacedName.String())
67+
68+
return ctrl.Result{}, nil
69+
} else {
5570
return ctrl.Result{}, err
5671
}
57-
// Can not find Sercet, remove it from the local cache
58-
pkg.ActiveSIGs.UnsetSerect(req.NamespacedName.String())
72+
} else {
73+
// upsert
74+
apply := func() string {
75+
pkg.ActiveSIGs.SetSecret(obj.DeepCopy())
76+
return fmt.Sprintf("upserting secret %s", req.NamespacedName.String())
77+
}
78+
79+
scrt := obj.DeepCopy()
80+
gws := pkg.ActiveSIGs.GatewayRefsOfSecret(scrt)
81+
cls := []string{}
82+
for _, gw := range gws {
83+
cls = append(cls, string(gw.Spec.GatewayClassName))
84+
}
85+
if err := pkg.DeployForEvent(lctx, cls, apply); err != nil {
86+
return ctrl.Result{}, err
87+
}
88+
5989
return ctrl.Result{}, nil
6090
}
61-
// Find Secret, add it to the local cache.
62-
pkg.ActiveSIGs.SetSecret(obj.DeepCopy())
63-
return ctrl.Result{}, nil
6491
}

‎internal/controllers/v1_controller.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ import (
2323

2424
"github.com/f5devcentral/bigip-kubernetes-gateway/internal/k8s"
2525
"github.com/f5devcentral/bigip-kubernetes-gateway/internal/pkg"
26-
"github.com/google/uuid"
2726
"github.com/f5devcentral/f5-bigip-rest-go/deployer"
2827
"github.com/f5devcentral/f5-bigip-rest-go/utils"
28+
"github.com/google/uuid"
2929
ctrl "sigs.k8s.io/controller-runtime"
3030
"sigs.k8s.io/controller-runtime/pkg/client"
3131

@@ -99,8 +99,9 @@ func (r *EndpointsReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
9999
return ctrl.Result{}, err
100100
}
101101
} else {
102-
defer pkg.ActiveSIGs.SetEndpoints(&obj)
103-
return handleUpsertingEndpoints(lctx, &obj)
102+
eps := obj.DeepCopy()
103+
defer pkg.ActiveSIGs.SetEndpoints(eps)
104+
return handleUpsertingEndpoints(lctx, eps)
104105
}
105106
}
106107

@@ -121,8 +122,9 @@ func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
121122
return ctrl.Result{}, err
122123
}
123124
} else {
124-
defer pkg.ActiveSIGs.SetService(&obj)
125-
return handleUpsertingService(lctx, &obj)
125+
svc := obj.DeepCopy()
126+
defer pkg.ActiveSIGs.SetService(svc)
127+
return handleUpsertingService(lctx, svc)
126128
}
127129
}
128130

‎internal/pkg/cache.go‎

Lines changed: 89 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -253,16 +253,18 @@ func (c *SIGCache) _attachedGateways(gwc *gatewayv1beta1.GatewayClass) []*gatewa
253253
return gws
254254
}
255255

256-
func (c *SIGCache) GatewayRefsOf(hr *gatewayv1beta1.HTTPRoute) []*gatewayv1beta1.Gateway {
256+
func (c *SIGCache) GatewayRefsOfHR(hr *gatewayv1beta1.HTTPRoute) []*gatewayv1beta1.Gateway {
257257
defer utils.TimeItToPrometheus()()
258258

259259
c.mutex.RLock()
260260
defer c.mutex.RUnlock()
261261

262-
return c._gatewayRefsOf(hr)
262+
return c._gatewayRefsOfHR(hr)
263263
}
264264

265-
func (c *SIGCache) _gatewayRefsOf(hr *gatewayv1beta1.HTTPRoute) []*gatewayv1beta1.Gateway {
265+
func (c *SIGCache) _gatewayRefsOfHR(hr *gatewayv1beta1.HTTPRoute) []*gatewayv1beta1.Gateway {
266+
defer utils.TimeItToPrometheus()()
267+
266268
if hr == nil {
267269
return []*gatewayv1beta1.Gateway{}
268270
}
@@ -290,6 +292,87 @@ func (c *SIGCache) _gatewayRefsOf(hr *gatewayv1beta1.HTTPRoute) []*gatewayv1beta
290292
return gws
291293
}
292294

295+
func (c *SIGCache) GatewayRefsOfSecret(scrt *v1.Secret) []*gatewayv1beta1.Gateway {
296+
defer utils.TimeItToPrometheus()()
297+
298+
c.mutex.RLock()
299+
defer c.mutex.RUnlock()
300+
301+
if scrt == nil {
302+
return []*gatewayv1beta1.Gateway{}
303+
}
304+
gws := []*gatewayv1beta1.Gateway{}
305+
306+
for _, gw := range c.Gateway {
307+
for _, listener := range gw.Spec.Listeners {
308+
found := false
309+
if listener.Protocol == gatewayv1beta1.HTTPSProtocolType && listener.TLS != nil &&
310+
(listener.TLS.Mode == nil || *listener.TLS.Mode == gatewayv1beta1.TLSModeTerminate) {
311+
for _, ref := range listener.TLS.CertificateRefs {
312+
ns := gw.Namespace
313+
if ref.Namespace != nil {
314+
ns = string(*ref.Namespace)
315+
}
316+
if !c._canRefer(gw, scrt) {
317+
continue
318+
}
319+
if err := validateSecretType(ref.Group, ref.Kind); err == nil {
320+
if ns == scrt.Namespace && ref.Name == gatewayv1beta1.ObjectName(scrt.Name) {
321+
gws = append(gws, gw)
322+
found = true
323+
break
324+
}
325+
}
326+
}
327+
}
328+
if found {
329+
break
330+
}
331+
}
332+
}
333+
334+
return gws
335+
}
336+
337+
func (c *SIGCache) AttachedSecrets(gw *gatewayv1beta1.Gateway) (map[string][]*v1.Secret, error) {
338+
defer utils.TimeItToPrometheus()()
339+
340+
c.mutex.RLock()
341+
defer c.mutex.RUnlock()
342+
343+
rlt := map[string][]*v1.Secret{}
344+
if gw == nil {
345+
return rlt, nil
346+
}
347+
348+
for _, listener := range gw.Spec.Listeners {
349+
lsname := gwListenerName(gw, &listener)
350+
if _, ok := rlt[lsname]; !ok {
351+
rlt[lsname] = []*v1.Secret{}
352+
}
353+
if listener.Protocol == gatewayv1beta1.HTTPSProtocolType && listener.TLS != nil &&
354+
(listener.TLS.Mode == nil || *listener.TLS.Mode == gatewayv1beta1.TLSModeTerminate) {
355+
for _, ref := range listener.TLS.CertificateRefs {
356+
ns := gw.Namespace
357+
if ref.Namespace != nil {
358+
ns = string(*ref.Namespace)
359+
}
360+
n := utils.Keyname(ns, string(ref.Name))
361+
scrt := c.Secret[n]
362+
if scrt != nil && c._canRefer(gw, scrt) {
363+
if err := validateSecretType(ref.Group, ref.Kind); err != nil {
364+
return rlt, err
365+
}
366+
rlt[lsname] = append(rlt[lsname], scrt)
367+
} else {
368+
return rlt, fmt.Errorf("secret %s not exist or cannnot refer to", n)
369+
}
370+
}
371+
}
372+
}
373+
return rlt, nil
374+
}
375+
293376
func (c *SIGCache) AttachedHTTPRoutes(gw *gatewayv1beta1.Gateway) []*gatewayv1beta1.HTTPRoute {
294377
defer utils.TimeItToPrometheus()()
295378

@@ -481,7 +564,7 @@ func (c *SIGCache) GetNeighborGateways(gw *gatewayv1beta1.Gateway) []*gatewayv1b
481564
gwmap := map[string]*gatewayv1beta1.Gateway{}
482565
hrs := c._attachedHTTPRoutes(gw)
483566
for _, hr := range hrs {
484-
gws := c._gatewayRefsOf(hr)
567+
gws := c._gatewayRefsOfHR(hr)
485568
for _, ng := range gws {
486569
kn := utils.Keyname(ng.Namespace, ng.Name)
487570
if _, f := gwmap[kn]; !f {
@@ -510,7 +593,7 @@ func (c *SIGCache) GetRootGateways(svcs []*v1.Service) []*gatewayv1beta1.Gateway
510593
for _, svc := range svcs {
511594
hrs := c._HTTPRoutesRefsOf(svc)
512595
for _, hr := range hrs {
513-
gws := c._gatewayRefsOf(hr)
596+
gws := c._gatewayRefsOfHR(hr)
514597
for _, gw := range gws {
515598
gwmap[utils.Keyname(gw.Namespace, gw.Name)] = gw
516599
}
@@ -532,7 +615,7 @@ func (c *SIGCache) RGImpactedGatewayClasses(rg *gatewayv1beta1.ReferenceGrant) [
532615
hrs := c._rgImpactedHTTPRoutes(rg)
533616
gws := c._rgImpactedGateways(rg)
534617
for _, hr := range hrs {
535-
gws = append(gws, c._gatewayRefsOf(hr)...)
618+
gws = append(gws, c._gatewayRefsOfHR(hr)...)
536619
}
537620
gws = UnifiedGateways(gws)
538621
return ClassNamesOfGateways(gws)

0 commit comments

Comments
 (0)