Skip to content

Commit 395bbf0

Browse files
miledxzmiledxz
committed
Update minimum k8s version to 1.25 (nginx#1885)
Bump the minimum version to 1.25 and remove all references to older versions and the webhook.
1 parent 8311361 commit 395bbf0

File tree

15 files changed

+20
-214
lines changed

15 files changed

+20
-214
lines changed

‎.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
id: vars
4343
run: |
4444
echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
45-
echo "min_k8s_version=1.23.17" >> $GITHUB_OUTPUT
45+
echo "min_k8s_version=1.25.16" >> $GITHUB_OUTPUT
4646
4747
- name: Check if go.mod and go.sum are up to date
4848
run: go mod tidy && git diff --exit-code -- go.mod go.sum

‎.github/workflows/conformance.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,6 @@ jobs:
126126
ngf_prefix=ghcr.io/nginxinc/nginx-gateway-fabric
127127
ngf_tag=${{ steps.ngf-meta.outputs.version }}
128128
if [ ${{ github.event_name }} == "schedule" ]; then export GW_API_VERSION=main; fi
129-
if [ ${{ startsWith(inputs.k8s-version, '1.23') || startsWith(inputs.k8s-version, '1.24') }} == "true" ]; then export INSTALL_WEBHOOK=true; fi
130129
if [ ${{ inputs.enable-experimental }} == "true" ]; then export ENABLE_EXPERIMENTAL=true; fi
131130
make install-ngf-local-no-build${{ inputs.image == 'plus' && '-with-plus' || ''}} PREFIX=${ngf_prefix} TAG=${ngf_tag}
132131
working-directory: ./conformance

‎Makefile

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ TELEMETRY_ENDPOINT=# if empty, NGF will report telemetry in its logs at debug le
1616
TELEMETRY_ENDPOINT_INSECURE = false
1717

1818
GW_API_VERSION = 1.0.0
19-
INSTALL_WEBHOOK = false
2019
NODE_VERSION = $(shell cat .nvmrc)
2120

2221
# go build flags - should not be overridden by the user
@@ -193,12 +192,12 @@ install-ngf-local-build-with-plus: build-images-with-plus load-images-with-plus
193192

194193
.PHONY: helm-install-local
195194
helm-install-local: ## Helm install NGF on configured kind cluster with local images. To build, load, and install with helm run make install-ngf-local-build.
196-
./conformance/scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
195+
./conformance/scripts/install-gateway.sh $(GW_API_VERSION)
197196
helm install dev $(CHART_DIR) --create-namespace --wait --set service.type=NodePort --set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never -n nginx-gateway
198197

199198
.PHONY: helm-install-local-with-plus
200199
helm-install-local-with-plus: ## Helm install NGF with NGINX Plus on configured kind cluster with local images. To build, load, and install with helm run make install-ngf-local-build-with-plus.
201-
./conformance/scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
200+
./conformance/scripts/install-gateway.sh $(GW_API_VERSION)
202201
helm install dev $(CHART_DIR) --create-namespace --wait --set service.type=NodePort --set nginxGateway.image.repository=$(PREFIX) --set nginxGateway.image.tag=$(TAG) --set nginxGateway.image.pullPolicy=Never --set nginx.image.repository=$(NGINX_PLUS_PREFIX) --set nginx.image.tag=$(TAG) --set nginx.image.pullPolicy=Never --set nginx.plus=true -n nginx-gateway
203202

204203
# Debug Targets

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ The following table lists the software versions NGINX Gateway Fabric supports.
6666

6767
| NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus |
6868
| -------------------- | ----------- | ---------- | --------- | ---------- |
69-
| Edge | 1.0.0 | 1.23+ | 1.25.4 | R31 |
69+
| Edge | 1.0.0 | 1.25+ | 1.25.5 | R31 |
7070
| 1.2.0 | 1.0.0 | 1.23+ | 1.25.4 | R31 |
7171
| 1.1.0 | 1.0.0 | 1.23+ | 1.25.3 | n/a |
7272
| 1.0.0 | 0.8.1 | 1.23+ | 1.25.2 | n/a |

‎charts/nginx-gateway-fabric/README.md

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -43,18 +43,6 @@ This chart deploys the NGINX Gateway Fabric in your Kubernetes cluster.
4343
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
4444
```
4545

46-
If you are running on Kubernetes 1.23 or 1.24, you also need to install the validating webhook. To do so, run:
47-
48-
```shell
49-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
50-
```
51-
52-
> **Important**
53-
>
54-
> The validating webhook is not needed if you are running Kubernetes 1.25+. Validation is done using CEL on the
55-
> CRDs. See the [resource validation doc](https://docs.nginx.com/nginx-gateway-fabric/overview/resource-validation/)
56-
> for more information.
57-
5846
## Installing the Chart
5947

6048
### Installing the Chart from the OCI Registry
@@ -143,19 +131,6 @@ To upgrade the Gateway CRDs from [the Gateway API repo](https://github.com/kuber
143131
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
144132
```
145133

146-
If you are running on Kubernetes 1.23 or 1.24, you also need to update the validating webhook. To do so, run:
147-
148-
```shell
149-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
150-
```
151-
152-
If you are running on Kubernetes 1.25 or newer and have the validating webhook installed, you should remove the
153-
webhook. To do so, run:
154-
155-
```shell
156-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
157-
```
158-
159134
### Upgrading the CRDs
160135

161136
Helm does not upgrade the NGINX Gateway Fabric CRDs during a release upgrade. Before you upgrade a release, you
@@ -266,12 +241,6 @@ To delete the Gateway API CRDs from [the Gateway API repo](https://github.com/ku
266241
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
267242
```
268243

269-
If you are running on Kubernetes 1.23 or 1.24, you also need to delete the validating webhook. To do so, run:
270-
271-
```shell
272-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
273-
```
274-
275244
## Configuration
276245

277246
The following tables lists the configurable parameters of the NGINX Gateway Fabric chart and their default values.

‎conformance/Makefile

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ NGF_MANIFEST=../deploy/manifests/nginx-gateway.yaml
1414
CRDS=../deploy/manifests/crds/
1515
STATIC_MANIFEST=provisioner/static-deployment.yaml
1616
PROVISIONER_MANIFEST=provisioner/provisioner.yaml
17-
INSTALL_WEBHOOK ?= false
1817
ENABLE_EXPERIMENTAL ?= false
1918
.DEFAULT_GOAL := help
2019

@@ -62,13 +61,13 @@ load-images-with-plus: ## Load NGF and NGINX Plus images on configured kind clus
6261

6362
.PHONY: prepare-ngf-dependencies
6463
prepare-ngf-dependencies: update-ngf-manifest ## Install NGF dependencies on configured kind cluster
65-
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
64+
./scripts/install-gateway.sh $(GW_API_VERSION) $(ENABLE_EXPERIMENTAL)
6665
kubectl apply -f $(CRDS)
6766
kubectl apply -f $(NGF_MANIFEST)
6867

6968
.PHONY: prepare-ngf-dependencies-with-plus
7069
prepare-ngf-dependencies-with-plus: update-ngf-manifest-with-plus ## Install NGF dependencies with Plus on configured kind cluster
71-
./scripts/install-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK)
70+
./scripts/install-gateway.sh $(GW_API_VERSION)
7271
kubectl apply -f $(CRDS)
7372
kubectl apply -f $(NGF_MANIFEST)
7473

@@ -120,7 +119,7 @@ uninstall-ngf: uninstall-k8s-components undo-manifests-update ## Uninstall NGF o
120119
.PHONY: uninstall-k8s-components
121120
uninstall-k8s-components: ## Uninstall installed components on configured kind cluster
122121
-kubectl delete -f $(NGF_MANIFEST)
123-
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(INSTALL_WEBHOOK) $(ENABLE_EXPERIMENTAL)
122+
./scripts/uninstall-gateway.sh $(GW_API_VERSION) $(ENABLE_EXPERIMENTAL)
124123
kubectl delete clusterrole nginx-gateway-provisioner
125124
kubectl delete clusterrolebinding nginx-gateway-provisioner
126125

‎conformance/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ update-ngf-manifest Update the NGF deployment manifest image na
6060
| SERVICE_MANIFEST | ../deploy/manifests/service/nodeport.yaml | The location of the NGF Service manifest |
6161
| STATIC_MANIFEST | provisioner/static-deployment.yaml | The location of the NGF static deployment manifest |
6262
| PROVISIONER_MANIFEST | provisioner/provisioner.yaml | The location of the NGF provisioner manifest |
63-
| INSTALL_WEBHOOK | false | Install the Gateway API Validating Webhook. Necessary for Kubernetes versions < 1.25. |
6463
| ENABLE_EXPERIMENTAL | false | Enable experimental features. Installs the Gateway APIs from the experimental channel and enables any supported experimental features in NGF. |
6564

6665
### Step 1 - Create a kind Cluster

‎conformance/scripts/install-gateway.sh

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,33 +5,20 @@ if [ -z $1 ]; then
55
exit 1
66
fi
77

8-
if [ -z $2 ]; then
9-
echo "install webhook argument not set; exiting"
10-
exit 1
11-
fi
12-
138
if [ $1 == "main" ]; then
149
temp_dir=$(mktemp -d)
1510
cd ${temp_dir}
1611
curl -s https://codeload.github.com/kubernetes-sigs/gateway-api/tar.gz/main | tar -xz --strip=2 gateway-api-main/config
17-
if [ $3 == "true" ]; then
12+
if [ $2 == "true" ]; then
1813
kubectl apply -f crd/experimental
1914
else
2015
kubectl apply -f crd/standard
2116
fi
22-
if [ $2 == "true" ]; then
23-
kubectl apply -f webhook
24-
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system
25-
fi
2617
rm -rf ${temp_dir}
2718
else
28-
if [ $3 == "true" ]; then
19+
if [ $2 == "true" ]; then
2920
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/experimental-install.yaml
3021
else
3122
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
3223
fi
33-
if [ $2 == "true" ]; then
34-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/webhook-install.yaml
35-
kubectl wait --for=condition=available --timeout=60s deployment gateway-api-admission-server -n gateway-system
36-
fi
3724
fi

‎conformance/scripts/uninstall-gateway.sh

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,31 +5,21 @@ if [ -z $1 ]; then
55
exit 1
66
fi
77

8-
if [ -z $2 ]; then
9-
echo "install webhook argument not set; exiting"
10-
exit 1
11-
fi
128

139
if [ $1 == "main" ]; then
1410
temp_dir=$(mktemp -d)
1511
cd ${temp_dir}
1612
curl -s https://codeload.github.com/kubernetes-sigs/gateway-api/tar.gz/main | tar -xz --strip=2 gateway-api-main/config
17-
if [ $3 == "true" ]; then
13+
if [ $2 == "true" ]; then
1814
kubectl delete -f crd/experimental
1915
else
2016
kubectl delete -f crd/standard
2117
fi
22-
if [ $2 == "true" ]; then
23-
kubectl delete -f webhook
24-
fi
2518
rm -rf ${temp_dir}
2619
else
27-
if [ $3 == "true" ]; then
20+
if [ $2 == "true" ]; then
2821
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/experimental-install.yaml
2922
else
3023
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/standard-install.yaml
3124
fi
32-
if [ $2 == "true" ]; then
33-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v$1/webhook-install.yaml
34-
fi
3525
fi

‎design/resource-validation.md

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -37,27 +37,6 @@ To help the implementations with the validation, the Gateway API already include
3737
OpenAPI schema validation. For example, the field X must be specified when type is set to Y; or X must be nil if
3838
Y is not Z. Note: Kubernetes API server enforces this validation. To bypass it, a user needs to change the CRDs.
3939

40-
#### For Kubernetes 1.23 and 1.24
41-
42-
- *The webhook validation*. This validation is written in go and ran as part of the webhook, which is included in the
43-
Gateway API installation files. The validation covers additional logic, not possible to implement in the OpenAPI
44-
schema validation.
45-
It does not repeat the OpenAPI schema validation from the CRDs. Note: a user can bypass this validation if the webhook
46-
is not installed.
47-
48-
However, the built-in validation rules do not cover all validation needs of NGF:
49-
50-
- The rules are not enough for NGINX. For example, the validation rule for the
51-
`value` of the path in a path-based routing rule allows symbols like `;`, `{`
52-
and `}`, which can break NGINX configuration for the
53-
corresponding [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) block.
54-
- The rules don't cover unsupported field cases. For example, the webhook does not know which filters are implemented by
55-
NGF, thus it cannot generate an appropriate error for NGF.
56-
57-
Additionally, as mentioned in [GEP-922](https://gateway-api.sigs.k8s.io/geps/gep-922/#implementers),
58-
"implementers must not rely on webhook or CRD validation as a security mechanism. If field values need to be escaped to
59-
secure an implementation, both webhook and CRD validation can be bypassed and cannot be relied on."
60-
6140
## Requirements
6241

6342
Design a validation mechanism for Gateway API resources.
@@ -120,16 +99,6 @@ following methods in order of their appearance in the table.
12099
| CRD validation | OpenAPI and CEL validation | Kubernetes API server | Structure, field values | Kubernetes API server returns any errors a response for an API call. | Yes, if the CRDs are modified. |
121100
| NGF-specific validation | Go code | NGF control plane | Field values | Errors are reported in the status of a resource after its creation/modification. | No |
122101

123-
124-
#### For Kubernetes 1.23 and 1.24
125-
126-
| Name | Type | Component | Scope | Feedback loop for errors | Can be bypassed? |
127-
|------------------------------|---------|-----------------------|-------------------------|----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
128-
| CRD validation | OpenAPI | Kubernetes API server | Structure, field values | Kubernetes API server returns any errors a response for an API call. | Yes, if the CRDs are modified. |
129-
| Webhook validation | Go code | Gateway API webhook | Field values | Kubernetes API server returns any errors a response for an API call. | Yes, if the webhook is not installed, misconfigured, or running a different version. |
130-
| NGF-specific validation | Go code | NGF control plane | Field values | Errors are reported in the status of a resource after its creation/modification. | No |
131-
132-
133102
Notes:
134103

135104
- The amount and the extent of the validation should allow multiple application developers to share a single NGF (User

‎site/content/includes/installation/install-gateway-api-resources.md

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,3 @@ additional features provided by the experimental channel. To install from the ex
1616
```shell
1717
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/experimental-install.yaml
1818
```
19-
20-
If you are running on Kubernetes 1.23 or 1.24, you also need to install the validating webhook. To do so, run:
21-
22-
```shell
23-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
24-
```
25-
26-
{{< important >}}The validating webhook is not needed if you are running Kubernetes 1.25+. Validation is done using CEL on the CRDs. See the [resource validation doc]({{< relref "/overview/resource-validation.md" >}}) for more information.{{< /important >}}

‎site/content/includes/installation/uninstall-gateway-api-resources.md

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,3 @@ docs: "DOCS-1436"
1515
```shell
1616
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/experimental-install.yaml
1717
```
18-
19-
If you are running on Kubernetes 1.23 or 1.24, you also need to delete the validating webhook. To do so, run:
20-
21-
```shell
22-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
23-
```

‎site/content/installation/installing-ngf/manifests.md

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -147,19 +147,6 @@ To upgrade NGINX Gateway Fabric and get the latest features and improvements, ta
147147
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/experimental-install.yaml
148148
```
149149

150-
- If you are running on Kubernetes 1.23 or 1.24, you also need to update the validating webhook:
151-
152-
```shell
153-
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
154-
```
155-
156-
- If you are running on Kubernetes 1.25 or newer and have the validating webhook installed, you should remove the
157-
webhook:
158-
159-
```shell
160-
kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/webhook-install.yaml
161-
```
162-
163150
1. **Upgrade NGINX Gateway Fabric CRDs:**
164151
- To upgrade the Custom Resource Definitions (CRDs), run:
165152

‎site/content/overview/resource-validation.md

Lines changed: 9 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,36 +33,20 @@ The HTTPRoute "coffee" is invalid: spec.hostnames[0]: Invalid value: "cafe.!@#$%
3333

3434
{{< note >}}While unlikely, bypassing this validation step is possible if the Gateway API CRDs are modified to remove the validation. If this happens, Step 4 will reject any invalid values (from NGINX perspective).{{< /note >}}
3535

36-
### Step 2 - CEL or Webhook validation by Kubernetes
36+
### Step 2 - CEL validation by Kubernetes API Server
3737

38-
- **Kubernetes 1.25 and later - CEL validation by Kubernetes API Server**
38+
The Kubernetes API server validates Gateway API resources using CEL validation embedded in the Gateway API CRDs. It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if you create a Gateway resource with a TCP listener that configures a hostname, the CEL validation will reject it with the following error:
3939

40-
The Kubernetes API server validates Gateway API resources using CEL validation embedded in the Gateway API CRDs. It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if you create a Gateway resource with a TCP listener that configures a hostname, the CEL validation will reject it with the following error:
41-
42-
```shell
43-
kubectl apply -f some-gateway.yaml
44-
```
45-
46-
```text
47-
The Gateway "some-gateway" is invalid: spec.listeners: Invalid value: "array": hostname must not be specified for protocols ['TCP', 'UDP']
48-
```
49-
50-
More information on CEL in Kubernetes can be found [here](https://kubernetes.io/docs/reference/using-api/cel/).
51-
52-
53-
- **Kubernetes 1.23 and 1.24 - Webhook validation by Gateway API Webhook**
54-
55-
The validating webhook must be [installed for these Kubernetes versions]({{< relref "installation/installing-ngf/helm.md#installing-the-gateway-api-resources" >}}). It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if you create a Gateway resource with a TCP listener that configures a hostname, the webhook will reject it with the following error:
40+
```shell
41+
kubectl apply -f some-gateway.yaml
42+
```
5643

57-
```shell
58-
kubectl apply -f some-gateway.yaml
59-
```
44+
```text
45+
The Gateway "some-gateway" is invalid: spec.listeners: Invalid value: "array": hostname must not be specified for protocols ['TCP', 'UDP']
46+
```
6047

61-
```text
62-
Error from server: error when creating "some-gateway.yaml": admission webhook "validate.gateway.networking.k8s.io" denied the request: spec.listeners[1].hostname: Forbidden: should be empty for protocol TCP
63-
```
48+
More information on CEL in Kubernetes can be found [here](https://kubernetes.io/docs/reference/using-api/cel/).
6449

65-
{{< note >}}Bypassing this validation step is possible if the webhook is not running in the cluster. If this happens, Step 3 will reject the invalid values.{{< /note >}}
6650

6751
### Step 3 - Validation by NGINX Gateway Fabric
6852

0 commit comments

Comments
 (0)