is cross-namespace routing supported?

[ssube]

Does the nginx gateway have any support for cross-namespace routing today, or where is that on the roadmap?

I'm hoping to use the nginx gateway in a staging environment with many services, some micro and some macro.
Each service has at least one namespace, for the default branch, and feature branches are deployed to their
own namespaces with their own configs, deployments, services, etc.

We have the gateway itself up and running, and the advanced routing example is working correctly, but it only
works with routes in the default namespace. When I try to apply HTTPRoutes to other namespaces, we are getting
a few different errors from the gateway pod or in the route resource's events, which seem to indicate that
cross-namespace routing is not supported yet.

Spec:
  Gateway Class Name:  nginx
  Listeners:
    Allowed Routes:
      Namespaces:
        From:  All
    Name:      http
    Port:      80
    Protocol:  HTTP
    ...
Status:
  Parents:
    Conditions:
      Last Transition Time:  2023-03-22T18:22:21Z
      Message:               The route is accepted
      Observed Generation:   1
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2023-03-22T18:22:21Z
      Message:               The condition for this has not been implemented yet: Gateway is ignored
      Observed Generation:   1
      Reason:                TODO
      Status:                True
      Type:                  TODO
    Controller Name:         k8s-gateway.nginx.org/nginx-gateway-controller
    Parent Ref:
      Group:         gateway.networking.k8s.io
      Kind:          Gateway
      Name:          gateway
      Namespace:     default
      Section Name:  http
Events:              <none>

In https://github.com/nginxinc/nginx-kubernetes-gateway/blob/main/docs/gateway-api-compatibility.md#gateway,
the allowedRoutes field is marked as not supported, so that all makes sense. It seems like there is also
a hard-coded check to make sure backend refs are in the same namespace as their routes: https://github.com/nginxinc/nginx-kubernetes-gateway/blob/1cc1b12c40ea56df47adf49610b8539988d0e374/internal/state/graph/backend_refs.go#L165

I see a few issues that seem to be related:

• Core API: AllowedRoutes #475
• Core API: ReferenceGrant #477

Based on the gateway spec, it sounds like this usage should be supported in theory, but there are a lot
of grants that will need to be checked.

Since this is our main use case, I'm trying to figure out what the current state is, if there's anything
we can do to make the current version work, or if we should be contributing some patches.

[pleshakov]

Hi @ssube

Does the nginx gateway have any support for cross-namespace routing today, or where is that on the roadmap?

We don't support cross-namespace routing yet. This means HTTPRoute cannot talk to backends in different namespaces. This will be fixed #477
However, the Gateway resource doesn't filter namespaces of HTTPRoutes, so it sees HTTPRoutes from all namespaces. Support for selecting namespaces will be added in #477

This means if you have a Gateway in one namespace (let's say nginx-gateway), but HTTPRoutes in the other, the Gateway should pick up those HTTPRoutes.

Based on the status you provided, you got this condition reported:

      Message:               The condition for this has not been implemented yet: Gateway is ignored
      Observed Generation:   1
      Reason:                TODO
      Status:                True
      Type:                  TODO
    Controller Name:         k8s-gateway.nginx.org/nginx-gateway-controller

This means that Gateway was ignored. Currently, NGINX Kubernetes Gateway supports only one Gateway resource

NGINX Kubernetes Gateway supports only a single Gateway resource. The Gateway resource must reference NGINX Kubernetes Gateway's corresponding GatewayClass. In case of multiple Gateway resources created in the cluster, NGINX Kubernetes Gateway will use a deterministic conflict resolution strategy: it will choose the oldest resource by creation timestamp. If the timestamps are equal, NGINX Kubernetes Gateway will choose the resource that appears first in alphabetical order by “{namespace}/{name}”.

This makes me think if the real issue here is this limitation. I wonder if it is possible in your case to use a single Gateway resource.

[brianehlert]

RefernceGrant support was implemented.
#477 was merged.