Skip to content

Commit 5e8ed63

Browse files
root30root30
authored
feat(health): support various policies _.microgateway.airlock.com (#28268)
Signed-off-by: Roman Willi <roman.willi@ergon.ch>
1 parent 6edf79a commit 5e8ed63

10 files changed

Lines changed: 254 additions & 0 deletions

File tree

‎resource_customizations/microgateway.airlock.com/_/health.lua‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
local hs = { status = "Progressing", message = "Waiting for " .. (obj.kind or "Policy") .. " status"}
2+
3+
local function is_policy_kind(kind)
4+
return kind ~= nil and string.match(kind, "Policy$") ~= nil
5+
end
6+
7+
if not is_policy_kind(obj.kind) then
8+
return { status = "Healthy", message = obj.kind .. " is healthy" }
9+
end
10+
11+
if obj.status ~= nil and obj.status.ancestors ~= nil then
12+
if obj.metadata.generation ~= nil then
13+
for i, ancestor in ipairs(obj.status.ancestors) do
14+
for _, condition in ipairs(ancestor.conditions) do
15+
if condition.observedGeneration == nil or condition.observedGeneration ~= obj.metadata.generation then
16+
hs.message = "Waiting for Ancestor " .. (ancestor.ancestorRef.name or "") .. " to update " .. (obj.kind or "Policy") .. " status"
17+
return hs
18+
end
19+
end
20+
end
21+
end
22+
23+
for i, ancestor in ipairs(obj.status.ancestors) do
24+
local hasAcceptedCondition = false
25+
for j, condition in ipairs(ancestor.conditions) do
26+
if condition.type == "Accepted" then
27+
hasAcceptedCondition = true
28+
if condition.status ~= "True" then
29+
hs.status = "Degraded"
30+
hs.message = "Ancestor " .. (ancestor.ancestorRef.name or "") .. ": " .. condition.message
31+
return hs
32+
else
33+
hs.status = "Healthy"
34+
hs.message = (obj.kind or "Policy") .. " is healthy"
35+
end
36+
end
37+
38+
if condition.type == "ResolvedRefs" then
39+
if condition.status ~= "True" then
40+
hs.status = "Degraded"
41+
hs.message = "Ancestor " .. (ancestor.ancestorRef.name or "") .. ": " .. condition.message
42+
return hs
43+
end
44+
end
45+
end
46+
if not hasAcceptedCondition then
47+
hs.status = "Degraded"
48+
hs.message = "Ancestor " .. (ancestor.ancestorRef.name or "") .. ": " .. (obj.kind or "Policy") .. " is not accepted"
49+
end
50+
end
51+
end
52+
53+
return hs

‎resource_customizations/microgateway.airlock.com/_/health_test.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
tests:
2+
- healthStatus:
3+
status: Healthy
4+
message: "AccessControlPolicy is healthy"
5+
inputPath: testdata/healthy.yaml
6+
- healthStatus:
7+
status: Degraded
8+
message: "Ancestor example-gateway: ContentSecurityPolicy is conflicting with other policies for this ancestor: [example-contentsecuritypolicy]"
9+
inputPath: testdata/degraded_conflicting.yaml
10+
- healthStatus:
11+
status: Degraded
12+
message: >-
13+
Ancestor example-gateway: Resolving CustomResponsePolicy failed:
14+
Missing referenced CustomResponse 'example'
15+
WARNING: traffic to referenced target(s) will be rejected.
16+
inputPath: testdata/degraded_resolved_refs.yaml
17+
- healthStatus:
18+
status: Degraded
19+
message: "Ancestor example-gateway-2: RateLimitPolicy is not accepted"
20+
inputPath: testdata/degraded_multiple_ancestors.yaml
21+
- healthStatus:
22+
status: Progressing
23+
message: "Waiting for EnvoyExtensionPolicy status"
24+
inputPath: testdata/progressing.yaml
25+
- healthStatus:
26+
status: Progressing
27+
message: "Waiting for Ancestor example-gateway to update ICAPPolicy status"
28+
inputPath: testdata/progressing_observed_generation.yaml
29+
- healthStatus:
30+
status: Healthy
31+
message: "DenyRules is healthy"
32+
inputPath: testdata/unknown.yaml

‎resource_customizations/microgateway.airlock.com/_/testdata/degraded_conflicting.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: ContentSecurityPolicy
3+
metadata:
4+
name: example-contentsecuritypolicy-2
5+
namespace: default
6+
spec:
7+
targetRefs:
8+
- group: gateway.networking.k8s.io
9+
kind: HTTPRoute
10+
name: example-httproute
11+
status:
12+
ancestors:
13+
- ancestorRef:
14+
group: gateway.networking.k8s.io
15+
kind: Gateway
16+
name: example-gateway
17+
conditions:
18+
- lastTransitionTime: '2026-04-16T14:21:38Z'
19+
message: >-
20+
ContentSecurityPolicy is conflicting with other policies for this ancestor: [example-contentsecuritypolicy]
21+
observedGeneration: 3
22+
reason: Conflicted
23+
status: 'False'
24+
type: Accepted
25+
controllerName: example.com/gatewayclass-controller

‎resource_customizations/microgateway.airlock.com/_/testdata/degraded_multiple_ancestors.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: RateLimitPolicy
3+
metadata:
4+
name: example-ratelimitpolicy
5+
namespace: default
6+
generation: 3
7+
spec:
8+
targetRefs:
9+
- group: gateway.networking.k8s.io
10+
kind: HTTPRoute
11+
name: example-httproute
12+
status:
13+
ancestors:
14+
- ancestorRef:
15+
group: gateway.networking.k8s.io
16+
kind: Gateway
17+
name: example-gateway
18+
conditions:
19+
- lastTransitionTime: '2026-04-16T12:20:11Z'
20+
message: RateLimitPolicy is accepted
21+
observedGeneration: 3
22+
reason: Accepted
23+
status: 'True'
24+
type: Accepted
25+
controllerName: example.com/gatewayclass-controller
26+
- ancestorRef:
27+
group: gateway.networking.k8s.io
28+
kind: Gateway
29+
name: example-gateway-2
30+
conditions:
31+
- lastTransitionTime: '2026-04-16T12:20:11Z'
32+
message: FooBar
33+
observedGeneration: 3
34+
reason: Foo
35+
status: 'True'
36+
type: Bar
37+
controllerName: example.com/gatewayclass-controller

‎resource_customizations/microgateway.airlock.com/_/testdata/degraded_resolved_refs.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: CustomResponsePolicy
3+
metadata:
4+
name: example-customresponsepolicy
5+
namespace: default
6+
spec:
7+
targetRefs:
8+
- group: gateway.networking.k8s.io
9+
kind: HTTPRoute
10+
name: example-httproute
11+
status:
12+
ancestors:
13+
- ancestorRef:
14+
group: gateway.networking.k8s.io
15+
kind: Gateway
16+
name: example-gateway
17+
conditions:
18+
- lastTransitionTime: '2026-04-16T12:20:11Z'
19+
message: >-
20+
Resolving CustomResponsePolicy failed:
21+
Missing referenced CustomResponse 'example'
22+
WARNING: traffic to referenced target(s) will be rejected.
23+
observedGeneration: 3
24+
reason: Invalid
25+
status: 'False'
26+
type: Accepted
27+
controllerName: example.com/gatewayclass-controller

‎resource_customizations/microgateway.airlock.com/_/testdata/healthy.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: AccessControlPolicy
3+
metadata:
4+
name: example-accesscontrolpolicy
5+
namespace: default
6+
generation: 3
7+
spec:
8+
targetRefs:
9+
- group: gateway.networking.k8s.io
10+
kind: HTTPRoute
11+
name: example-httproute
12+
status:
13+
ancestors:
14+
- ancestorRef:
15+
group: gateway.networking.k8s.io
16+
kind: Gateway
17+
name: example-gateway
18+
conditions:
19+
- lastTransitionTime: '2026-04-16T12:20:11Z'
20+
message: AccessControlPolicy is accepted
21+
observedGeneration: 3
22+
reason: Accepted
23+
status: 'True'
24+
type: Accepted
25+
controllerName: example.com/gatewayclass-controller

‎resource_customizations/microgateway.airlock.com/_/testdata/progressing.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: EnvoyExtensionPolicy
3+
metadata:
4+
name: example-envoyextensionpolicy
5+
namespace: default
6+
spec:
7+
targetRefs:
8+
- group: gateway.networking.k8s.io
9+
kind: HTTPRoute
10+
name: example-httproute
11+
status:
12+
ancestors: []

‎resource_customizations/microgateway.airlock.com/_/testdata/progressing_observed_generation.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: ICAPPolicy
3+
metadata:
4+
name: example-icappolicy
5+
namespace: default
6+
generation: 3
7+
spec:
8+
targetRefs:
9+
- group: gateway.networking.k8s.io
10+
kind: HTTPRoute
11+
name: example-httproute
12+
status:
13+
ancestors:
14+
- ancestorRef:
15+
group: gateway.networking.k8s.io
16+
kind: Gateway
17+
name: example-gateway
18+
conditions:
19+
- lastTransitionTime: '2026-04-16T12:20:11Z'
20+
message: ICAPPolicy is accepted
21+
observedGeneration: 1
22+
reason: Accepted
23+
status: 'True'
24+
type: Accepted
25+
controllerName: example.com/gatewayclass-controller

‎resource_customizations/microgateway.airlock.com/_/testdata/unknown.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: microgateway.airlock.com/v1alpha1
2+
kind: DenyRules
3+
metadata:
4+
name: example-denyrules
5+
namespace: default
6+
spec:
7+
targetRefs:
8+
- group: gateway.networking.k8s.io
9+
kind: HTTPRoute
10+
name: example-httproute
11+
status:
12+
ancestors:
13+
- ancestorRef:
14+
group: gateway.networking.k8s.io
15+
kind: Gateway
16+
name: example-gateway
17+
controllerName: example.com/gatewayclass-controller

‎util/lua/lua_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1127,6 +1127,7 @@ func Test_getHealthScriptPaths(t *testing.T) {
11271127
"_.crossplane.io/_",
11281128
"_.upbound.io/_",
11291129
"grafana-org-operator.kubitus-project.gitlab.io/_",
1130+
"microgateway.airlock.com/_",
11301131
"operator.victoriametrics.com/_",
11311132
}, paths)
11321133
}

0 commit comments

Comments
 (0)