Skip to content

Commit 79afa42

Browse files
cnvergencecnvergence
committed
Add initial token validation, add tests and review changes
Signed-off-by: Karol Szwaj <[email protected]>
1 parent c7884e5 commit 79afa42

33 files changed

+694
-986
lines changed

‎internal/cmd/certgen.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func certGen(ctx context.Context, logOut io.Writer, local bool) error {
9797
func outputCertsForKubernetes(ctx context.Context, cli client.Client, cfg *config.Server,
9898
updateSecrets bool, certs *crypto.Certificates,
9999
) error {
100-
secrets, err := kubernetes.CreateOrUpdateSecrets(ctx, cli, kubernetes.CertsToSecret(cfg.Namespace, certs), updateSecrets)
100+
secrets, err := kubernetes.CreateOrUpdateSecrets(ctx, cli, kubernetes.CertsToSecret(cfg.ControllerNamespace, certs), updateSecrets)
101101
log := cfg.Logger
102102

103103
if err != nil {
@@ -121,7 +121,7 @@ func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *c
121121
return nil
122122
}
123123

124-
webhookConfigName := fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.Namespace)
124+
webhookConfigName := fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.ControllerNamespace)
125125
webhookCfg := &admissionregistrationv1.MutatingWebhookConfiguration{}
126126
if err := cli.Get(ctx, client.ObjectKey{Name: webhookConfigName}, webhookCfg); err != nil {
127127
return fmt.Errorf("failed to get mutating webhook configuration: %w", err)

‎internal/cmd/certgen_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ func TestPatchTopologyWebhook(t *testing.T) {
6565
caseName: "Update caBundle",
6666
webhook: &admissionregistrationv1.MutatingWebhookConfiguration{
6767
ObjectMeta: metav1.ObjectMeta{
68-
Name: fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.Namespace),
68+
Name: fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.ControllerNamespace),
6969
},
7070
Webhooks: []admissionregistrationv1.MutatingWebhook{{ClientConfig: admissionregistrationv1.WebhookClientConfig{}}},
7171
},
@@ -77,7 +77,7 @@ func TestPatchTopologyWebhook(t *testing.T) {
7777
caseName: "No-op",
7878
webhook: &admissionregistrationv1.MutatingWebhookConfiguration{
7979
ObjectMeta: metav1.ObjectMeta{
80-
Name: fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.Namespace),
80+
Name: fmt.Sprintf("%s.%s", topologyWebhookNamePrefix, cfg.ControllerNamespace),
8181
},
8282
Webhooks: []admissionregistrationv1.MutatingWebhook{{ClientConfig: admissionregistrationv1.WebhookClientConfig{CABundle: []byte("foo")}}},
8383
},

‎internal/cmd/egctl/config_test.go

-2
Original file line numberDiff line numberDiff line change
@@ -223,8 +223,6 @@ func TestExtractSubResourcesConfigDump(t *testing.T) {
223223
}
224224

225225
func TestLabelSelectorBadInput(t *testing.T) {
226-
podNamespace = "default"
227-
228226
cases := []struct {
229227
name string
230228
args []string

‎internal/crypto/certgen.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -108,8 +108,8 @@ func GenerateCerts(cfg *config.Server) (*Certificates, error) {
108108
egProvider := cfg.EnvoyGateway.GetEnvoyGatewayProvider().Type
109109
switch egProvider {
110110
case egv1a1.ProviderTypeKubernetes:
111-
egDNSNames = kubeServiceNames(DefaultEnvoyGatewayDNSPrefix, cfg.Namespace, cfg.DNSDomain)
112-
envoyDNSNames = append(envoyDNSNames, fmt.Sprintf("*.%s", cfg.Namespace))
111+
egDNSNames = kubeServiceNames(DefaultEnvoyGatewayDNSPrefix, cfg.ControllerNamespace, cfg.DNSDomain)
112+
envoyDNSNames = append(envoyDNSNames, fmt.Sprintf("*.%s", cfg.ControllerNamespace))
113113
default:
114114
// Kubernetes is the only supported Envoy Gateway provider.
115115
return nil, fmt.Errorf("unsupported provider type %v", egProvider)

‎internal/envoygateway/config/config.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ const (
3131
type Server struct {
3232
// EnvoyGateway is the configuration used to startup Envoy Gateway.
3333
EnvoyGateway *egv1a1.EnvoyGateway
34-
// Namespace is the namespace that Envoy Gateway runs in.
35-
Namespace string
34+
// ControllerNamespace is the namespace that Envoy Gateway runs in.
35+
ControllerNamespace string
3636
// DNSDomain is the dns domain used by k8s services. Defaults to "cluster.local".
3737
DNSDomain string
3838
// Logger is the logr implementation used by Envoy Gateway.
@@ -44,11 +44,11 @@ type Server struct {
4444
// New returns a Server with default parameters.
4545
func New(logOut io.Writer) (*Server, error) {
4646
return &Server{
47-
EnvoyGateway: egv1a1.DefaultEnvoyGateway(),
48-
Namespace: env.Lookup("ENVOY_GATEWAY_NAMESPACE", DefaultNamespace),
49-
DNSDomain: env.Lookup("KUBERNETES_CLUSTER_DOMAIN", DefaultDNSDomain),
50-
Logger: logging.DefaultLogger(logOut, egv1a1.LogLevelInfo),
51-
Elected: make(chan struct{}),
47+
EnvoyGateway: egv1a1.DefaultEnvoyGateway(),
48+
ControllerNamespace: env.Lookup("ENVOY_GATEWAY_NAMESPACE", DefaultNamespace),
49+
DNSDomain: env.Lookup("KUBERNETES_CLUSTER_DOMAIN", DefaultDNSDomain),
50+
Logger: logging.DefaultLogger(logOut, egv1a1.LogLevelInfo),
51+
Elected: make(chan struct{}),
5252
}, nil
5353
}
5454

@@ -57,7 +57,7 @@ func (s *Server) Validate() error {
5757
switch {
5858
case s == nil:
5959
return errors.New("server config is unspecified")
60-
case len(s.Namespace) == 0:
60+
case len(s.ControllerNamespace) == 0:
6161
return errors.New("namespace is empty string")
6262
}
6363
if err := validation.ValidateEnvoyGateway(s.EnvoyGateway); err != nil {

‎internal/envoygateway/config/config_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,15 @@ func TestValidate(t *testing.T) {
4949
Provider: egv1a1.DefaultEnvoyGatewayProvider(),
5050
},
5151
},
52-
Namespace: "",
52+
ControllerNamespace: "",
5353
},
5454
expect: false,
5555
},
5656
{
5757
name: "unspecified envoy gateway",
5858
cfg: &Server{
59-
Namespace: "test-ns",
60-
Logger: logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo),
59+
ControllerNamespace: "test-ns",
60+
Logger: logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo),
6161
},
6262
expect: false,
6363
},

‎internal/extension/registry/extension_manager.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func NewManager(cfg *config.Server) (extTypes.Manager, error) {
7777

7878
return &Manager{
7979
k8sClient: cli,
80-
namespace: cfg.Namespace,
80+
namespace: cfg.ControllerNamespace,
8181
extension: *extension,
8282
}, nil
8383
}

‎internal/gatewayapi/runner/runner.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
157157
GlobalRateLimitEnabled: r.EnvoyGateway.RateLimit != nil,
158158
EnvoyPatchPolicyEnabled: r.EnvoyGateway.ExtensionAPIs != nil && r.EnvoyGateway.ExtensionAPIs.EnableEnvoyPatchPolicy,
159159
BackendEnabled: r.EnvoyGateway.ExtensionAPIs != nil && r.EnvoyGateway.ExtensionAPIs.EnableBackend,
160-
Namespace: r.Namespace,
160+
ControllerNamespace: r.ControllerNamespace,
161161
GatewayNamespaceMode: r.EnvoyGateway.GatewayNamespaceMode(),
162162
MergeGateways: gatewayapi.IsMergeGatewaysEnabled(resources),
163163
WasmCache: r.wasmCache,
@@ -313,7 +313,7 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
313313
func (r *Runner) loadTLSConfig(ctx context.Context) (tlsConfig *tls.Config, salt []byte, err error) {
314314
switch {
315315
case r.EnvoyGateway.Provider.IsRunningOnKubernetes():
316-
salt, err = hmac(ctx, r.Namespace)
316+
salt, err = hmac(ctx, r.ControllerNamespace)
317317
if err != nil {
318318
return nil, nil, fmt.Errorf("failed to get hmac secret: %w", err)
319319
}

‎internal/gatewayapi/securitypolicy.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -905,14 +905,14 @@ func (t *Translator) buildOIDC(
905905
// HMAC secret is generated by the CertGen job and stored in a secret
906906
// We need to rotate the HMAC secret in the future, probably the same
907907
// way we rotate the certs generated by the CertGen job.
908-
hmacSecret := resources.GetSecret(t.Namespace, oidcHMACSecretName)
908+
hmacSecret := resources.GetSecret(t.ControllerNamespace, oidcHMACSecretName)
909909
if hmacSecret == nil {
910-
return nil, fmt.Errorf("HMAC secret %s/%s not found", t.Namespace, oidcHMACSecretName)
910+
return nil, fmt.Errorf("HMAC secret %s/%s not found", t.ControllerNamespace, oidcHMACSecretName)
911911
}
912912
hmacData, ok := hmacSecret.Data[oidcHMACSecretKey]
913913
if !ok || len(hmacData) == 0 {
914914
return nil, fmt.Errorf(
915-
"HMAC secret not found in secret %s/%s", t.Namespace, oidcHMACSecretName)
915+
"HMAC secret not found in secret %s/%s", t.ControllerNamespace, oidcHMACSecretName)
916916
}
917917

918918
return &ir.OIDC{

‎internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ infraIR:
228228
gateway.envoyproxy.io/owning-gateway-name: gateway-1
229229
gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
230230
name: envoy-gateway/gateway-1
231+
namespace: envoy-gateway-system
231232
envoy-gateway/gateway-2:
232233
proxy:
233234
listeners:
@@ -243,6 +244,7 @@ infraIR:
243244
gateway.envoyproxy.io/owning-gateway-name: gateway-2
244245
gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
245246
name: envoy-gateway/gateway-2
247+
namespace: envoy-gateway-system
246248
xdsIR:
247249
envoy-gateway/gateway-1:
248250
accessLog:

‎internal/gatewayapi/translator.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ type Translator struct {
9090
// store referenced resources in the IR for later use.
9191
ExtensionGroupKinds []schema.GroupKind
9292

93-
// Namespace is the namespace that Envoy Gateway runs in.
94-
Namespace string
93+
// ControllerNamespace is the namespace that Envoy Gateway controller runs in.
94+
ControllerNamespace string
9595

9696
// WasmCache is the cache for Wasm modules.
9797
WasmCache wasm.Cache
@@ -308,7 +308,7 @@ func (t *Translator) InitIRs(gateways []*GatewayContext) (map[string]*ir.Xds, ma
308308
}
309309

310310
gwInfraIR.Proxy.Name = irKey
311-
gwInfraIR.Proxy.Namespace = t.Namespace
311+
gwInfraIR.Proxy.Namespace = t.ControllerNamespace
312312
if t.GatewayNamespaceMode {
313313
gwInfraIR.Proxy.Namespace = gateway.Gateway.Namespace
314314
}

‎internal/gatewayapi/translator_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ func TestTranslate(t *testing.T) {
9696
GlobalRateLimitEnabled: true,
9797
EnvoyPatchPolicyEnabled: envoyPatchPolicyEnabled,
9898
BackendEnabled: backendEnabled,
99-
Namespace: "envoy-gateway-system",
99+
ControllerNamespace: "envoy-gateway-system",
100100
MergeGateways: IsMergeGatewaysEnabled(resources),
101101
GatewayNamespaceMode: gatewayNamespaceMode,
102102
WasmCache: &mockWasmCache{},

‎internal/infrastructure/host/proxy_infra.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func (i *Infra) CreateOrUpdateProxyInfra(ctx context.Context, infra *ir.Infra) e
7474
StatsServerPort: ptr.To(int32(0)),
7575
}
7676

77-
args, err := common.BuildProxyArgs(proxyInfra, proxyConfig.Spec.Shutdown, bootstrapConfigOptions, proxyName, i.EnvoyGateway.GatewayNamespaceMode())
77+
args, err := common.BuildProxyArgs(proxyInfra, proxyConfig.Spec.Shutdown, bootstrapConfigOptions, proxyName, false)
7878
if err != nil {
7979
return err
8080
}

‎internal/infrastructure/kubernetes/infra.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ type Infra struct {
6363
func NewInfra(cli client.Client, cfg *config.Server) *Infra {
6464
var ns string
6565
if !cfg.EnvoyGateway.GatewayNamespaceMode() {
66-
ns = cfg.Namespace
66+
ns = cfg.ControllerNamespace
6767
}
6868
return &Infra{
6969
Namespace: ns,

‎internal/infrastructure/kubernetes/proxy/resource.go

+10-14
Original file line numberDiff line numberDiff line change
@@ -289,21 +289,17 @@ func expectedShutdownPreStopCommand(cfg *egv1a1.ShutdownConfig) []string {
289289

290290
// expectedContainerVolumeMounts returns expected proxy container volume mounts.
291291
func expectedContainerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.VolumeMount {
292-
var volumeMounts []corev1.VolumeMount
293-
294-
certsMount := corev1.VolumeMount{
295-
Name: "certs",
296-
MountPath: "/certs",
297-
ReadOnly: true,
298-
}
299-
volumeMounts = append(volumeMounts, certsMount)
300-
301-
sdsMount := corev1.VolumeMount{
302-
Name: "sds",
303-
MountPath: "/sds",
292+
volumeMounts := []corev1.VolumeMount{
293+
{
294+
Name: "certs",
295+
MountPath: "/certs",
296+
ReadOnly: true,
297+
},
298+
{
299+
Name: "sds",
300+
MountPath: "/sds",
301+
},
304302
}
305-
volumeMounts = append(volumeMounts, sdsMount)
306-
307303
return resource.ExpectedContainerVolumeMounts(containerSpec, volumeMounts)
308304
}
309305

‎internal/infrastructure/kubernetes/proxy/resource_provider_test.go

+42-17
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ func newTestInfra() *ir.Infra {
4545
return newTestInfraWithAnnotations(nil)
4646
}
4747

48+
func newTestInfraWithNamespace(namespace string) *ir.Infra {
49+
i := newTestInfra()
50+
i.Proxy.Namespace = namespace
51+
return i
52+
}
53+
4854
func newTestInfraWithIPFamily(family *egv1a1.IPFamily) *ir.Infra {
4955
i := newTestInfra()
5056
i.Proxy.Config = &egv1a1.EnvoyProxy{
@@ -120,16 +126,17 @@ func TestDeployment(t *testing.T) {
120126
require.NoError(t, err)
121127

122128
cases := []struct {
123-
caseName string
124-
infra *ir.Infra
125-
deploy *egv1a1.KubernetesDeploymentSpec
126-
shutdown *egv1a1.ShutdownConfig
127-
shutdownManager *egv1a1.ShutdownManager
128-
proxyLogging map[egv1a1.ProxyLogComponent]egv1a1.LogLevel
129-
bootstrap string
130-
telemetry *egv1a1.ProxyTelemetry
131-
concurrency *int32
132-
extraArgs []string
129+
caseName string
130+
infra *ir.Infra
131+
deploy *egv1a1.KubernetesDeploymentSpec
132+
shutdown *egv1a1.ShutdownConfig
133+
shutdownManager *egv1a1.ShutdownManager
134+
proxyLogging map[egv1a1.ProxyLogComponent]egv1a1.LogLevel
135+
bootstrap string
136+
telemetry *egv1a1.ProxyTelemetry
137+
concurrency *int32
138+
extraArgs []string
139+
gatewayNamespaceMode bool
133140
}{
134141
{
135142
caseName: "default",
@@ -560,6 +567,11 @@ func TestDeployment(t *testing.T) {
560567
Name: ptr.To("custom-deployment-name"),
561568
},
562569
},
570+
{
571+
caseName: "gateway-namespace-mode",
572+
infra: newTestInfraWithNamespace("default"),
573+
gatewayNamespaceMode: true,
574+
},
563575
}
564576
for _, tc := range cases {
565577
t.Run(tc.caseName, func(t *testing.T) {
@@ -604,8 +616,21 @@ func TestDeployment(t *testing.T) {
604616
if len(tc.extraArgs) > 0 {
605617
tc.infra.Proxy.Config.Spec.ExtraArgs = tc.extraArgs
606618
}
619+
namespace := cfg.ControllerNamespace
620+
if tc.gatewayNamespaceMode {
621+
deployType := egv1a1.KubernetesDeployModeType(egv1a1.KubernetesDeployModeTypeGatewayNamespace)
622+
cfg.EnvoyGateway.Provider = &egv1a1.EnvoyGatewayProvider{
623+
Type: egv1a1.ProviderTypeKubernetes,
624+
Kubernetes: &egv1a1.EnvoyGatewayKubernetesProvider{
625+
Deploy: &egv1a1.KubernetesDeployMode{
626+
Type: &deployType,
627+
},
628+
},
629+
}
630+
namespace = tc.infra.GetProxyInfra().Namespace
631+
}
607632

608-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
633+
r := NewResourceRender(namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
609634
dp, err := r.Deployment()
610635
require.NoError(t, err)
611636

@@ -1034,7 +1059,7 @@ func TestDaemonSet(t *testing.T) {
10341059
tc.infra.Proxy.Config.Spec.ExtraArgs = tc.extraArgs
10351060
}
10361061

1037-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1062+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
10381063
ds, err := r.DaemonSet()
10391064
require.NoError(t, err)
10401065

@@ -1199,7 +1224,7 @@ func TestService(t *testing.T) {
11991224
provider.EnvoyService = tc.service
12001225
}
12011226

1202-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1227+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
12031228
svc, err := r.Service()
12041229
require.NoError(t, err)
12051230

@@ -1242,7 +1267,7 @@ func TestConfigMap(t *testing.T) {
12421267

12431268
for _, tc := range cases {
12441269
t.Run(tc.name, func(t *testing.T) {
1245-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1270+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
12461271
cm, err := r.ConfigMap("")
12471272
require.NoError(t, err)
12481273

@@ -1285,7 +1310,7 @@ func TestServiceAccount(t *testing.T) {
12851310

12861311
for _, tc := range cases {
12871312
t.Run(tc.name, func(t *testing.T) {
1288-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1313+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
12891314
sa, err := r.ServiceAccount()
12901315
require.NoError(t, err)
12911316

@@ -1400,7 +1425,7 @@ func TestPDB(t *testing.T) {
14001425

14011426
provider.GetEnvoyProxyKubeProvider()
14021427

1403-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1428+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
14041429

14051430
pdb, err := r.PodDisruptionBudget()
14061431
require.NoError(t, err)
@@ -1512,7 +1537,7 @@ func TestHorizontalPodAutoscaler(t *testing.T) {
15121537
}
15131538
provider.GetEnvoyProxyKubeProvider()
15141539

1515-
r := NewResourceRender(cfg.Namespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
1540+
r := NewResourceRender(cfg.ControllerNamespace, cfg.DNSDomain, tc.infra.GetProxyInfra(), cfg.EnvoyGateway)
15161541
hpa, err := r.HorizontalPodAutoscaler()
15171542
require.NoError(t, err)
15181543

0 commit comments

Comments
 (0)