-
Notifications
You must be signed in to change notification settings - Fork 679
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
design: Reworking HTTPProxy duplicate route detection and reporting #5045
design: Reworking HTTPProxy duplicate route detection and reporting #5045
Conversation
Signed-off-by: Sunjay Bhatia <sunjayb@vmware.com>
Still not exactly happy with how to report errors/status etc., would appreciate opinions on that section |
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## main #5045 +/- ##
==========================================
- Coverage 77.48% 77.47% -0.01%
==========================================
Files 138 138
Lines 16904 16904
==========================================
- Hits 13098 13097 -1
- Misses 3551 3552 +1
Partials 255 255 |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
Sorry @sunjayBhatia, with everything else going on I have not had a chance to digest this yet, but it's in the queue. |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In general, this LGTM. Some questions and comments.
However, I do worry about silently breaking folks/adding possible perf implications when we do roll this out. Having a community discussion/poll regarding this should alleviate this.
conditions: | ||
- errors: | ||
- message: duplicate match conditions defined on route matching path prefix: "/foo" | ||
reason: DuplicateMatchConditions | ||
status: "True" | ||
type: RouteError | ||
lastTransitionTime: ... | ||
message: At least one error present, see Errors for details | ||
observedGeneration: ... | ||
reason: ErrorPresent | ||
status: "False" | ||
type: Valid | ||
currentStatus: invalid | ||
description: At least one error present, see Errors for details | ||
... |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: I cant quite remember the contour standard, but since we program the route anyway, would a warning be more apt?
just from a UX perspective an error come across as non-recoverable and implies that none of the routes were programmed.
status: "True" | ||
type: Valid | ||
warnings: | ||
- message: duplicate match conditions defined in included HTTPProxy "default/example-child2" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would like to see both the "offending" child proxies here. If I think about this from the pov of a cluster admin, I would like the information of which proxies are clashing. providing just one, will leave me to hunt for the other one myself.
status: "True" | ||
type: IncludeError | ||
currentStatus: invalid | ||
description: Valid HTTPProxy |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
in this case will the child proxies have any error/warning conditions set?
|
||
This might lead to complications in accounting where routes came from which could get unwieldy to implement, but some combination of this and the currently proposed solution could be used. | ||
|
||
### Add a name field to routes |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this does seem appealing. can see a few usecases where having the name can be helpful.
### Exposing match conditions from parent HTTPProxies down to child status | ||
We propose adding details of the full set of duplicate match conditions to be included in Status Conditions detailing why a route is invalid. | ||
This may be information not explicitly known/shared with the owner of the child HTTPProxy. | ||
Since a backend configured on such a route will receive a request with all of that information, I do not think it is a security concern to include that detail in most cases, but something to think about in case any organizations have an issue with this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I dont think it should be a problem, but adding a contour config flag to toggle this would be nice.
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
Closes #5019.