Skip to content

Gateway API 1.6.0 #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hjames9 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Gateway API 1.6.0 #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 41 additions & 20 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,35 @@

Project status: **Beta**

## Supported Gateway API Resources

Installing Gateway API v1.6.0 may install CRDs that this controller does not implement.
Unsupported resource kinds are ignored: the controller does not watch them, reconcile them,
update their status, or provision OCI resources for them.

| Resource | Support |
| --- | --- |
| `GatewayClass` | Supported |
| `Gateway` | Supported |
| `HTTPRoute` | Supported on OCI Load Balancer |
| `GRPCRoute` | Supported on OCI Load Balancer |
| `TLSRoute` | Supported on OCI Load Balancer and OCI Network Load Balancer where OCI capabilities allow |
| `TCPRoute` | Supported on OCI Network Load Balancer |
| `UDPRoute` | Supported on OCI Network Load Balancer |
| `ReferenceGrant` | Supported for cross-namespace references used by supported routes and policies |
| `BackendTLSPolicy` | Supported for OCI Load Balancer backend TLS; OCI Network Load Balancer uses passthrough routing instead |
| `ListenerSet` | Not supported; ignored if installed |
| `XBackend`, `XBackendTrafficPolicy`, `XMesh` | Not supported; ignored if installed |

## Getting Started

Install Gateway API CRDs. Choose one path:
Install Gateway API CRDs:
```sh
# Standard CRDs are enough for HTTPRoute / ALB usage.
kubectl apply --server-side=true \
-f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml

# Or use experimental CRDs when enabling TCPRoute / UDPRoute / NLB usage.
kubectl apply --server-side=true \
-f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/experimental-install.yaml
-f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml
```
The controller can run with only the standard CRDs. The experimental channel is required only for `TCPRoute` and `UDPRoute` support.
`TLSRoute` is available from the standard Gateway API CRDs.
The controller can run with only the standard CRDs. `HTTPRoute`, `GRPCRoute`, `TLSRoute`,
`TCPRoute`, `UDPRoute`, and `BackendTLSPolicy` are standard in Gateway API v1.6.0.

Prepare API key and config file (use actual values):
```ini
Expand Down Expand Up @@ -187,6 +202,8 @@ kubectl -n oke-gw delete httproute oke-gateway-example-server

## HTTPRoute matching

See [deploy/manifests/examples/serverroutes.yaml](./deploy/manifests/examples/serverroutes.yaml) for a complete HTTPRoute example.

Following match types are supported:
- path: `PathPrefix` and `Exact`
- header: `Exact` and `RegularExpression`
Expand Down Expand Up @@ -216,23 +233,23 @@ See [deploy/manifests/examples/grpcroute.yaml](./deploy/manifests/examples/grpcr

## Backend TLS

`BackendTLSPolicy` configures TLS from OCI Load Balancer backend sets to backend Pods for ALB-backed `HTTPRoute`, `GRPCRoute`, and `TLSRoute` with `tls.mode: Terminate`. It is not supported for OCI Network Load Balancer routes.
`BackendTLSPolicy` configures TLS from OCI Load Balancer backend sets to backend Pods for OCI Load Balancer-backed `HTTPRoute`, `GRPCRoute`, and `TLSRoute` with `tls.mode: Terminate`. It is not supported for OCI Network Load Balancer routes.

OCI backend SSL validates the backend certificate chain but does not enforce hostname/SAN identity. Policies must explicitly set `oci.oraclecloud.com/backend-hostname-validation: Disabled`, and unsupported standard fields such as `subjectAltNames` are rejected. CA trust can come from `validation.caCertificateRefs`, from pre-managed OCI CA bundle OCIDs in `oci.oraclecloud.com/trusted-ca-bundle-ocids`, or both.
OCI backend SSL validates the backend certificate chain but does not enforce hostname/SAN identity. Policies must explicitly set `oci.oraclecloud.com/backend-hostname-validation: Disabled`, and unsupported standard fields such as `subjectAltNames` are rejected. CA trust can come from `validation.caCertificateRefs`, from pre-managed OCI CA bundle OCIDs in `oci.oraclecloud.com/trusted-ca-bundle-ocids`, or both. A policy may use pre-managed OCI CA bundle OCIDs without a ConfigMap CA reference.

See [deploy/manifests/examples/backendtlspolicy.yaml](./deploy/manifests/examples/backendtlspolicy.yaml) for a complete example with a Gateway, HTTPRoute, Service, CA ConfigMap, and BackendTLSPolicy.

## TCPRoute And UDPRoute With OCI Network Load Balancer

Layer 4 support uses an existing OCI Network Load Balancer. The controller reconciles listeners, backend sets, and backends on the referenced NLB, but does not create or delete the NLB resource itself.
Layer 4 support uses an existing OCI Network Load Balancer. The controller reconciles listeners, backend sets, and backends on the referenced OCI Network Load Balancer, but does not create or delete the OCI Network Load Balancer resource itself.

Apply the NLB GatewayClass:
Apply the OCI Network Load Balancer GatewayClass:

```sh
kubectl apply -f deploy/manifests/examples/gatewayclass-nlb.yaml
```

Create a GatewayConfig that points to the existing NLB:
Create a GatewayConfig that points to the existing OCI Network Load Balancer:

```yaml
apiVersion: oke-gateway-api.gemyago.github.io/v1
Expand All @@ -253,31 +270,35 @@ kubectl apply -n <namespace> -f deploy/manifests/examples/tcproute-nlb.yaml
kubectl apply -n <namespace> -f deploy/manifests/examples/udproute-nlb.yaml
```

See [deploy/manifests/examples/tcproute-nlb.yaml](./deploy/manifests/examples/tcproute-nlb.yaml) and [deploy/manifests/examples/udproute-nlb.yaml](./deploy/manifests/examples/udproute-nlb.yaml) for route examples.

OCI Network Load Balancer backend sets require health checks. For `UDPRoute`,
set `oke-gateway-api.gemyago.github.io/nlb-udp-health-check-port` on each route
to the TCP port the backend Pods expose for health checking. UDP health checks
are not configured by this controller.

`GatewayConfig.spec.loadBalancerId` is shared with ALB usage. The GatewayClass determines whether the OCID is resolved through the OCI Load Balancer API or the OCI Network Load Balancer API.
`GatewayConfig.spec.loadBalancerId` is shared with OCI Load Balancer usage. The GatewayClass determines whether the OCID is resolved through the OCI Load Balancer API or the OCI Network Load Balancer API.

## TLSRoute

`TLSRoute` supports two OCI-backed modes:

- OCI Load Balancer with `tls.mode: Terminate`: terminates TLS at the ALB and forwards to the backend Service port. Use `BackendTLSPolicy` when the backend connection should also use TLS.
- OCI Load Balancer with `tls.mode: Terminate`: terminates TLS at the OCI Load Balancer and forwards to the backend Service port. Use `BackendTLSPolicy` when the backend connection should also use TLS.
- OCI Network Load Balancer with `tls.mode: Passthrough`: forwards encrypted TCP bytes to a backend that terminates TLS itself.

Unsupported combinations are rejected: ALB passthrough and NLB termination. OCI does not support SNI fanout for ALB TCP+SSL listeners or NLB TCP passthrough listeners, so only one effective `TLSRoute` can own a TLS listener. TLSRoute health checks use TCP on the resolved backend Service port.
Unsupported combinations are rejected: OCI Load Balancer passthrough and OCI Network Load Balancer termination. OCI does not support SNI fanout for OCI Load Balancer TCP+SSL listeners or OCI Network Load Balancer TCP passthrough listeners, so only one effective `TLSRoute` can own a TLS listener. TLSRoute health checks use TCP on the resolved backend Service port.

See [deploy/manifests/examples/tlsroute-alb.yaml](./deploy/manifests/examples/tlsroute-alb.yaml) for OCI Load Balancer termination and [deploy/manifests/examples/tlsroute-nlb.yaml](./deploy/manifests/examples/tlsroute-nlb.yaml) for OCI Network Load Balancer passthrough.

Apply the ALB terminate example:
Apply the OCI Load Balancer terminate example:

```sh
kubectl apply -n <namespace> -f deploy/manifests/examples/gatewayconfig.yaml
kubectl apply -n <namespace> -f deploy/manifests/examples/gatewayclass.yaml
kubectl apply -f deploy/manifests/examples/gatewayclass.yaml
kubectl apply -n <namespace> -f deploy/manifests/examples/tlsroute-alb.yaml
```

Apply the NLB passthrough example:
Apply the OCI Network Load Balancer passthrough example:

```sh
kubectl apply -n <namespace> -f deploy/manifests/examples/gatewayconfig-nlb.yaml
Expand Down
2 changes: 1 addition & 1 deletion deploy/manifests/examples/tcproute-nlb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
apiVersion: gateway.networking.k8s.io/v1alpha2
apiVersion: gateway.networking.k8s.io/v1
kind: TCPRoute
metadata:
name: rtmp
Expand Down
4 changes: 2 additions & 2 deletions deploy/manifests/examples/udproute-nlb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
apiVersion: gateway.networking.k8s.io/v1alpha2
apiVersion: gateway.networking.k8s.io/v1
kind: UDPRoute
metadata:
name: coap-dtls
Expand All @@ -13,7 +13,7 @@ spec:
- name: coap-service
port: 5684
---
apiVersion: gateway.networking.k8s.io/v1alpha2
apiVersion: gateway.networking.k8s.io/v1
kind: UDPRoute
metadata:
name: srt
Expand Down
82 changes: 44 additions & 38 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/gemyago/oke-gateway-api

go 1.26
go 1.26.0

require (
github.com/go-logr/logr v1.4.3
Expand All @@ -16,11 +16,11 @@ require (
go.uber.org/dig v1.19.0
golang.org/x/sync v0.20.0
golang.org/x/sys v0.45.0
k8s.io/api v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/client-go v0.35.1
sigs.k8s.io/controller-runtime v0.20.4
sigs.k8s.io/gateway-api v1.5.1
k8s.io/api v0.36.1
k8s.io/apimachinery v0.36.1
k8s.io/client-go v0.36.1
sigs.k8s.io/controller-runtime v0.24.1
sigs.k8s.io/gateway-api v1.6.0
)

require (
Expand All @@ -35,28 +35,34 @@ require (
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fatih/color v1.18.0 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-openapi/jsonpointer v0.21.2 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/swag v0.23.1 // indirect
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
github.com/go-openapi/jsonpointer v0.23.1 // indirect
github.com/go-openapi/jsonreference v0.21.5 // indirect
github.com/go-openapi/swag v0.26.0 // indirect
github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
github.com/go-openapi/swag/conv v0.26.0 // indirect
github.com/go-openapi/swag/fileutils v0.26.0 // indirect
github.com/go-openapi/swag/jsonname v0.26.0 // indirect
github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
github.com/go-openapi/swag/loading v0.26.0 // indirect
github.com/go-openapi/swag/mangling v0.26.0 // indirect
github.com/go-openapi/swag/netutils v0.26.0 // indirect
github.com/go-openapi/swag/stringutils v0.26.0 // indirect
github.com/go-openapi/swag/typeutils v0.26.0 // indirect
github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/gobuffalo/flect v1.0.3 // indirect
github.com/gofrs/flock v0.12.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/gnostic-models v0.7.1 // indirect
github.com/google/go-github/v82 v82.0.0 // indirect
github.com/google/go-querystring v1.2.0 // indirect
github.com/huandu/xstrings v1.5.0 // indirect
github.com/iancoleman/strcase v0.3.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jinzhu/copier v0.4.0 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.9.1 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
Expand All @@ -69,10 +75,10 @@ require (
github.com/narqo/go-badge v0.0.0-20230821190521-c9a75c019a59 // indirect
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.64.0 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/rjeczalik/notify v0.9.3 // indirect
github.com/rs/zerolog v1.35.1 // indirect
github.com/sagikazarmark/locafero v0.11.0 // indirect
Expand All @@ -87,35 +93,35 @@ require (
github.com/vladopajic/go-test-coverage/v2 v2.18.8 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
go.opentelemetry.io/otel v1.35.0 // indirect
go.opentelemetry.io/otel/trace v1.35.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.48.0 // indirect
golang.org/x/crypto v0.51.0 // indirect
golang.org/x/image v0.38.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/net v0.50.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.42.0 // indirect
golang.org/x/mod v0.35.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.44.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.33.1 // indirect
k8s.io/code-generator v0.33.1 // indirect
k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/utils v0.0.0-20260108192941-914a6e750570 // indirect
k8s.io/apiextensions-apiserver v0.36.0 // indirect
k8s.io/code-generator v0.36.0 // indirect
k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6 // indirect
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
sigs.k8s.io/controller-tools v0.18.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)

Expand Down
Loading