AllowedRoutes support for Listeners #721
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
documentation
kate-osborn
requested changes
Jun 6, 2023
sjberman
force-pushed
the
feature/allowed-routes
branch
from
737f9e2 to
0b049bc
Compare
pleshakov
suggested changes
Jun 6, 2023
sjberman
force-pushed
the
feature/allowed-routes
branch
from
f9febe9 to
e830802
Compare
kate-osborn
reviewed
Jun 7, 2023
kate-osborn
approved these changes
Jun 7, 2023
sjberman
force-pushed
the
feature/allowed-routes
branch
from
06a5c20 to
d4759ce
Compare
|
https://gateway-api.sigs.k8s.io/guides/multiple-ns/ has a pretty good description of the use case and examples of using this functionality, so I don't think we need to rewrite that with our own example. |
pleshakov
suggested changes
Jun 8, 2023
sjberman
force-pushed
the
feature/allowed-routes
branch
from
d4759ce to
b78d6cd
Compare
pleshakov
reviewed
Jun 9, 2023
Add support for specifying AllowedRoutes in Listeners. A user can now allow/disallow routes based on namespace. Either all namespaces, same namespace, or label selectors can be used to determine which routes are allowed.
sjberman
force-pushed
the
feature/allowed-routes
branch
from
b78d6cd to
746bf67
Compare
pleshakov
approved these changes
Jun 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem: As a Cluster Admin I want to restrict what elements of my system have access to Gateway ingress, I want to create predictable isolation across GatewayClasses and dataplanes, I want to help App Devs by restricting Route binding so they see predictable attachments and not unintentional or unexpected traffic routing.
Conversely, I want to allow App Devs in different organizations access to my Gateway controller by specifying All namespaces, a selection, or only same namespaces are supported.
Solution: Add support for specifying AllowedRoutes in Listeners. A user can now allow/disallow routes based on namespace. Either all namespaces, same namespace, or label selectors can be used to determine which routes are allowed.
Testing: Manually verified adding/removing labels to namespaces triggers updates and sets the status properly.
Closes #475
Checklist
Before creating a PR, run through this checklist and mark each as complete.