The Consul API Gateway is a dedicated ingress solution for intelligently routing traffic to applications running on a Consul Service Mesh.

Last update: Dec 14, 2022

Overview

Consul API Gateway

Overview

The Consul API Gateway is a dedicated ingress solution for intelligently routing traffic to applications running on a Consul Service Mesh. Currently it only runs on Kubernetes and is implemented as a Kubernetes Gateway Controller but, in future releases, it will work across multiple scheduler and runtime ecosystems.

Usage

Prerequisites

The Consul API Gateway must be installed on a Kubernetes cluster with the Consul K8s service mesh deployed on it. The installed version of Consul must be v1.11-beta2 or greater.

The Consul Helm chart must be used, with specific settings, to install Consul on the Kubernetes cluster. This can be done with the following commands:

helm repo add hashicorp https://helm.releases.hashicorp.com
cat <<EOF | helm install consul hashicorp/consul --version 0.36.0 -f -
global:
  name: consul
  image: "hashicorp/consul:1.11.0-beta2"
  tls:
    enabled: true
connectInject:
  enabled: true
controller:
  enabled: true
EOF

Install the Tech Preview

To install the Consul API Gateway controller and a base Kubernetes GatewayClass that leverages the API Gateway, run the following commands:

kubectl apply -k "github.com/hashicorp/consul-api-gateway/config/crd?ref=v0.1.0-techpreview"
kubectl apply -k "github.com/hashicorp/consul-api-gateway/config?ref=v0.1.0-techpreview"

You should now be able to deploy a Gateway by referencing the gateway class default-consul-gateway-class in a Kubernetes Gateway manifest.

Configuring and Deploying API Gateways

Consul API Gateways are configured and deployed via the Kubernetes Gateway API standard. The Kubernetes Gateway API webite explains the design of the standard, examples of how to use it and the complete specification of the API.

The Consul API Gateway Tech Preview supports current version (v1alpha2) of the Gateway API.

Supported Features: Please see Supported Features for a list of K8s Gateway API features supported by the current release of Consul API Gateway.

Tutorial

For an example of how to deploy a Consul API Gateway and use it alongside CertManager and External DNS, see the Example Setup.

Contributing

Thank you for your interest in contributing! Please refer to CONTRIBUTING.md for guidance.

For development, please see our Quick Start guide. Other documentation can be found inside our in-repo developer documentation.

Comments

There doesn't appear to be a way to create an API Gateway, or Gateway per cluster in a federated WAN

Overview of the Issue

I don't seem to be able to set up API gateway in such a way that I can either have access to all mesh services from a single API Gateway, or using and API Gateway per cluster.

Reproduction Steps

Set up an initial cluster using HELM charts and creating an API Gateway (this all works as expected)
Set up a second federated cluster following the instructions here: https://www.consul.io/docs/k8s/installation/multi-cluster/kubernetes
Services in the second datacenter are not accessible to the API Gateway created in the first datacenter cluster.
Using the federated setup, creating a new API Gateway to access services in the second datacenter fail with SSL connection issues.

Logs

Error when trying to add mesh service from second cluster to API Gateway in first cluster

k get httproute/test-service-route -n test -o jsonpath='{.status}' | jq
{
  "parents": [
    {
      "conditions": [
        {
          "lastTransitionTime": "2022-08-08T07:38:16Z",
          "message": "1 error occurred:\n\t* route is in an invalid state and cannot bind\n\n",
          "observedGeneration": 2,
          "reason": "BindError",
          "status": "False",
          "type": "Accepted"
        },
        {
          "lastTransitionTime": "2022-08-08T07:38:16Z",
          "message": "k8s: service test/test-service not found",
          "observedGeneration": 2,
          "reason": "ServiceNotFound",
          "status": "False",
          "type": "ResolvedRefs"
        }
      ],
      "controllerName": "hashicorp.com/consul-api-gateway-controller",
      "parentRef": {
        "group": "gateway.networking.k8s.io",
        "kind": "Gateway",
        "name": "api-gateway",
        "namespace": "consul"
      }
    }
  ]
}

Error when trying to connect to a second API Gateway in the second datacenter cluster.

curl -vvi -k --header "Host: test-service.api.gateway" "https://${API}:8443/
* TCP_NODELAY set
* Connected to X.X.X.X (X.X.X.X) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to X.X.X.X:8445
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to X.X.X.X:8445

Expected behavior

There is a documented solution for setting up API Gateways across federated clusters.

Environment details

Additional Context

I suspect this is a simple case of me not seeing the specific documentation required to set this up correctly, but I'm having a lot of problems getting the API Gateway up and running across multiple clusters.

type/enhancement

opened by codex70 38

CRT Build workflows
I'm sure we'll want someone to take a look to make sure I set the CRT stuff makes sense -- a few things:

I'm not entirely sure what we need around EULA stuff/how this works with enterprise licensing

Do we need the distro packaging components right now (do we actually want to make a deb/rpm for release)?

I'd be inclined to introduce the testing job to the build workflow rather than its own separate workflow so that we don't actually attempt to build/deploy a release without it having gone through the testing pipeline (alternatively can we add the test workflow as a dependency in the .release/ci.yml file?) -- is that frowned upon with the CRT process or is it fine to add our own jobs in the workflow?

Not entirely sure if I set up the .release/ci.yml file properly -- I'm assuming that the sign and verify steps are for GPG-signing the deb/rpm artifacts, do we need either of those steps if we're not shipping packages but only a Docker artifact?

not entirely sure if release_branches = ["main"] in the .release/ci.yml is the way to go -- does that mean we'd be pushing a container to Docker Hub whenever there's a push to the main branch?

Any suggestions as to who can review those components of the setup?
opened by andrewstucki 8

Gateway Status Update Stub

So this still needs to be hooked up to our reconciliation loop for the Gateway status, which I wanted to do in a separate PR.... but here's a basic tracker for gateway pods. Here's an example of the log output showing the generated conditions based on the pod status:

➜  consul-api-gateway git:(gateway-status) ✗ ./scripts/develop -s | grep -i "gateway deployment pod status"
2021-09-21T14:50:52.569-0400 [INFO]  consul-api-gateway-server.k8s.controllers.Pod: gateway deployment pod status updated: pod=default/test-gateway-67cf6fff56-xmvc4 conditions=["{Scheduled False 0 2021-09-21 14:50:52.569222 -0400 EDT m=+20.402226267 NotReconciled }"]
2021-09-21T14:50:52.580-0400 [INFO]  consul-api-gateway-server.k8s.controllers.Pod: gateway deployment pod status updated: pod=default/test-gateway-67cf6fff56-xmvc4 conditions=["{Scheduled True 0 2021-09-21 14:50:52.58065 -0400 EDT m=+20.413654163 Scheduled }"]
2021-09-21T14:50:55.110-0400 [INFO]  consul-api-gateway-server.k8s.controllers.Pod: gateway deployment pod status updated: pod=default/test-gateway-67cf6fff56-xmvc4 conditions=["{Scheduled True 0 2021-09-21 14:50:55.110591 -0400 EDT m=+22.943518755 Scheduled }", "{Ready False 0 2021-09-21 14:50:55.110591 -0400 EDT m=+22.943518847 ListenersNotReady }"]
2021-09-21T14:51:02.601-0400 [INFO]  consul-api-gateway-server.k8s.controllers.Pod: gateway deployment pod status updated: pod=default/test-gateway-67cf6fff56-xmvc4 conditions=["{Scheduled True 0 2021-09-21 14:51:02.601438 -0400 EDT m=+30.434140975 Scheduled }", "{Ready True 0 2021-09-21 14:51:02.601438 -0400 EDT m=+30.434141055 Ready }"]

One thing to note is that this leverages readiness probes to figure out when the listeners for the gateway are actually ready. For now the probe just hits the same internal envoy endpoint used for Consul health checking, but we could also potentially leverage the bound listeners themselves if we can manage to bind a listener with no upstreams at provision time.

opened by andrewstucki 8

build(deps): bump google.golang.org/grpc from 1.49.0 to 1.50.0
Bumps google.golang.org/grpc from 1.49.0 to 1.50.0.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.50.0

Behavior Changes

client: use proper "@" semantics for connecting to abstract unix sockets. (#5678)

This is technically a bug fix; the result is that the address was including a trailing NULL byte, which it should not have. This may break users creating the socket in Go by prefixing a NULL instead of an "@", though, so calling it out as a behavior change.

Special Thanks: @jachor

New Features

metadata: add experimental ValueFromIncomingContext to more efficiently retrieve a single value (#5596)

Special Thanks: @horpto

stats: provide peer information in HandleConn context (#5589)

Special Thanks: @feihu-stripe

xds: add support for Outlier Detection, enabled by default (#5435, #5673)

Bug Fixes

client: fix deadlock in transport caused by GOAWAY racing with stream creation (#5652)

This should only occur with an HTTP/2 server that does not follow best practices of an advisory GOAWAY (not a grpc-go server).

xds/xdsclient: fix a bug which was causing routes with cluster_specifier_plugin set to be NACKed when GRPC_EXPERIMENTAL_XDS_RLS_LB was off (#5670)

xds/xdsclient: NACK cluster resource if config_source_specifier in lrs_server is not self (#5613)

xds/ringhash: fix a bug which sometimes prevents the LB policy from retrying connection attempts (#5601)

xds/ringhash: do nothing when asked to exit IDLE instead of falling back on the default channel behavior of connecting to all addresses (#5614)

xds/rls: fix a bug which was causing the channel to be stuck in IDLE (#5656)

alts: fix a bug which was setting WaitForReady on handshaker service RPCs, thereby delaying fallback when required (#5620)

gcp/observability: fix End() to cleanup global state correctly (#5623)

Commits

c1d7d7a Change version to 1.50.0 (#5685)

1451c62 internal/transport: optimize grpc-message encoding/decoding (#5654)

be4b63b test: minor test cleanup (#5679)

d83070e Changed Outlier Detection Env Var to default true (#5673)

54521b2 client: remove trailing null from unix abstract socket address (#5678)

36e4810 orca: cleanup old code, and get grpc package to use new code (#5627)

e8866a8 build: harden GitHub Workflow permissions (#5660)

8458251 xdsclient: ignore routes with cluster_specifier_plugin when GRPC_EXPERIMENTAL...

a238ceb xDS: Outlier Detection Env Var not hardcoded to false (#5664)

b1d7f56 transport: Fix deadlock in transport caused by GOAWAY race with new stream cr...

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 6
Trigger CRT workflows for main branch
Changes proposed in this PR:

Add main to the list of branches that trigger Common Release Tooling workflows. This will produce the dev_tags images of consul-api-gateway defined here onto hashicorppreview whenever we push commits to main. Matches what Consul is doing here.

Change CRT notification target to different Slack channel where the additional noise created by merges to main won't interrupt our daily conversations.

Publish mutable + immutable dev_tags so that we can always test with a specific image even after newer versions have been published. I used the naming patterns from Consul's hashicorppreview repo here.

Change version.go to reflect our next release, 0.3.0, so that dev tags reflect the in-progress work correctly

How I've tested this PR:

There's not a good way to test this change without having the modified actions file merged into main, but the stakes are very low since we're only modifying our own internal process.

How I expect reviewers to test this PR:

Checklist:

[ ] Tests added

[ ] CHANGELOG entry added

Run make changelog-entry for guidance in authoring a changelog entry, and commit the resulting file, which should have a name matching your PR number. Entries should use imperative present tense (e.g. Add support for...)

pr/no-changelog
opened by nathancoleman 6
Enable namespace mapping for gateway service registration and future mesh service lookup

This PR introduces namespace mapping similar to the options allowed in our consul-k8s helm chart:

https://www.consul.io/docs/k8s/helm#v-synccatalog-consulnamespaces

In order to simplify our proposed MeshService CRD to rely on the same namespace mapping security posture as consul-k8s we essentially need to support the same k8s --> consul namespace mappings that they do. This allows k8s namespace-based RBAC policies to control access to particular consul-namespace services.

By doing this for the future MeshService CRD it essentially means we just need a consul service name and the consul namespace will be constructed based off of the k8s namespace that the CRD resource is created in.

Prior to this all gateways were just created in the default namespace, this also fixes that.

opened by andrewstucki 6
Bump k8s.io/api from 0.22.1 to 0.24.2
Bumps k8s.io/api from 0.22.1 to 0.24.2.

Commits

7e99a1e Update dependencies to v0.24.2 tag

0bf1867 Revert "Introduce APIs to support multiple ClusterCIDRs (#108290)"

2de6996 Merge pull request #109241 from ravisantoshgudimetla/sts-ar-optional

7734d26 [sts] api: Make available replicas optional

38ec09a [sts] Generated: Make available replicas optional

ec84bcb Merge pull request #109178 from liggitt/openapi-master

e3797f2 Drop enum tag from certificate request condition

02c2207 Merge pull request #109151 from Argh4k/r-101566

1eb735b Revert "Field status.hostIPs added for Pod (#101566)"

290a349 Introduce APIs to support multiple ClusterCIDRs (#108290)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog
opened by dependabot[bot] 5
URLRewrite support
Is your feature request related to a problem? Please describe.

HTTPRoute URLRewrite filter support is a deal breaker for the company I work for. I have tried to use it following Gateway API spec, but had no success.

The supported features doc does not confirm support as well.

Is it actually supported or planned?

Feature Description

Use Case(s)

Given that "/orders" redirect to order service When I reach "/orders/10" Then orders service request path must be "/10" And request path should not have "/orders" prefix

apiVersion: gateway.networking.k8s.io/v1alpha2 kind: HTTPRoute metadata: name: orders namespace: consul spec: parentRefs: - name: api-gateway rules: - matches: - path: type: PathPrefix value: /orders backendRefs: - kind: Service name: orders namespace: orders port: 80 weight: 100 filters: - type: URLRewrite urlRewrite: path: type: replacePrefixMatch value: /orders

Contributions
type/enhancement theme/k8s-gateway-api runtime/kubernetes
opened by manobi 5
store: remove route from listener when not able to bind
Changes proposed in this PR:

Removes a route from a listener if it fails to bind when reconciling. Fixes an issue where deleting a ReferencePolicy would update the route status, but the stale route would not be removed from the gateway listener.

As an aside, the (bool, error) return of CanBind seems redundant and makes it prone to misuse - should it be changed to just one of those values instead of the tuple?

How I've tested this PR:

[x] Add checks for gateway listener status attachedRoutes after deleting ReferencePolicy in e2e test

[x] Add checks for TCP and HTTP connection errors after deleting ReferencePolicy in e2e test

[x] Add e2e test for switching route binding from one gateway to another

How I expect reviewers to test this PR:

Review the test additions/changes.

Confirm that a gateway removes a stale route and stops routing traffic after a route is invalidated by being modified or having a ReferencePolicy that affects it deleted.

The checkRouteError function and only looking for an empty string TCP response feel like quite crude checks, is there a better way to handle these?

TestRouteParentRefChange contains the checks/assertions that are currently working as expected - I believe there's a different bug here still preventing some functionality from working as expected, but punted further exploration of that out to https://github.com/hashicorp/consul-api-gateway/pull/200

The debug logging I added in the helper funcs was quite helpful and I'm leaning towards wanting to keep it somehow, should it be switched to something like t.Log instead though?

Checklist:

[x] Tests added

[x] CHANGELOG entry added

Run make changelog-entry for guidance in authoring a changelog entry, and commit the resulting file, which should have a name matching your PR number. Entries should use imperative present tense (e.g. Add support for...)
opened by mikemorris 5
Simplify comparison of gateways to use only resource version
We currently wind up with a stale gateway in memory that can't be written to the store when we want to update it.

2022-03-15T17:56:05.165Z [ERROR] memory/store.go:110: consul-api-gateway-server.state: error syncing gateways: error= | 1 error occurred: | * Operation cannot be fulfilled on gateways.gateway.networking.k8s.io "backend-namespaces": the object has been modified; please apply your changes to the latest version and try again |

Due to this, the new route that's being added is unable to bind and thus the conformance tests fail.

After adding some code using go-test/diff, I was able to determine the diff between the gateway Listeners() during the sync process:

slice[0].gateway.ObjectMeta.Annotations.map[api-gateway.consul.hashicorp.com/config]: -{\"serviceType\":\"LoadBalancer\",\"consul\":{\"authentication\":{},\"scheme\":\"https\",\"ports\":{\"http\":8501,\"grpc\":8502}},\"image\":{\"consulAPIGateway\":\"gcr.io/hc-9b66efef4c6f4f9a85bcdbe92a9/consul-api-gateway-oss:16\",\"envoy\":\"envoyproxy/envoy-alpine:v1.20.2\"},\"copyAnnotations\":{},\"logLevel\":\"info\"} +{\"serviceType\":\"LoadBalancer\",\"consul\":{\"authentication\":{},\"scheme\":\"https\",\"ports\":{\"http\":8501,\"grpc\":8502}},\"image\":{\"consulAPIGateway\":\"gcr.io/hc-9b66efef4c6f4f9a85bcdbe92a9/consul-api-gateway-oss:17\",\"envoy\":\"envoyproxy/envoy-alpine:v1.20.2\"},\"copyAnnotations\":{},\"logLevel\":\"info\"} slice[0].routeCount: -1 +0

When the sync fails, it retries a couple of times and then goes silent. The gateway then never has the route listed in attached routes. Andrew mentioned that he doesn't think we want to dirty-check the route count, and I think we want the annotation config to be a snapshot of creation time. I'm not sure which of these is preventing the sync; however, including gateway.Listeners() in the isEqual comparison dirty-checks both implicitly and fixes the issue in my testing.

Changes proposed in this PR:

When determining if two gateways are equal during the sync process, only compare the resource version. This will prevent the list of things to compare from continually growing and requiring tons of mental overhead to figure out any bugs.

How I've tested this PR:

Running the upstream conformance tests against main will trigger the issue above. The only fix I've found is to delete the controller pod so that the stale gateway is dumped.

How I expect reviewers to test this PR:

Checklist:

[ ] Tests added

[ ] CHANGELOG entry added

HashiCorp engineers only, community PRs should not add a changelog entry. Entries should use imperative present tense (e.g. Add support for...)
opened by nathancoleman 5
build(deps): bump github.com/hashicorp/consul/api from 1.15.3 to 1.16.0
Bumps github.com/hashicorp/consul/api from 1.15.3 to 1.16.0.

Commits

05b4282 Update api submodule gomod.

d9d0d92 Backport of auto-config: relax node name validation for JWT authorization int...

5d10221 Peering Mesh Gateway Updates for GA (#15344) (#15363)

6f82a5e docs(peering): remove beta references (#15340) (#15362)

329d111 backport of commit 87038bb6723a3433cccbd8b5cab68e3585d1a92a (#15364)

6ca306f Backport of Ensure that NodeDump imported nodes are filtered into release/1.1...

4d36fd1 backport of commit 33d521d9cee89cfe8dcd639a2047295d45351314 (#15357)

54f7a79 Backport of Fixup authz for data imported from peers into release/1.14.x (#15...

904aaf7 Backport of connect: strip port from DNS SANs for ingress gateway leaf cert i...

a6f4893 backport of commit cf529cfdabc87ced74ac8ab1ec85173667850d7a (#15350)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 4
k8s/controller: always map "default" Consul namespace to empty string
Changes proposed in this PR:

Always map the "default" Consul namespace to the empty string in the memory backend store, for compatibility with Consul OSS and the logic to parse the namespace of a Gateway from the SPIFFE URI, used when reading a Gateway from a store backend.

This Consul namespace mapper function is already called when reconciling a Gateway to a backend store, but the corresponding lookup fails with Consul Enterprise when --consul-destination-namespace is set to "default" because of the special case handling in the parseURI helper.

No migration handling should be needed because this is all within the ephemeral memory store for now, but this does need an e2e test for a service in the "default" namespace on Consul Enterprise.

As a temporary workaround, this edge case can be avoided by configuring consulNamespaces.mirroringK8S: true or specfiying "" or any value other than "default" for consulNamespaces.consulDestinationNamespace in the Helm chart.

How I've tested this PR:

How I expect reviewers to test this PR:

Checklist:

[x] Tests added

[x] CHANGELOG entry added

Run make changelog-entry for guidance in authoring a changelog entry, and commit the resulting file, which should have a name matching your PR number. Entries should use imperative present tense (e.g. Add support for...)

backport/0.5.x
opened by mikemorris 0
build(deps): bump sigs.k8s.io/gateway-api from 0.5.1 to 0.6.0
Bumps sigs.k8s.io/gateway-api from 0.5.1 to 0.6.0.

Release notes

Sourced from sigs.k8s.io/gateway-api's releases.

v0.6.0

API versions: v1beta1, v1alpha2

Major Changes

ReferenceGrant moves to v1beta1, ReferencePolicy removed

With more implementations now supporting ReferenceGrant (and more conformance coverage of the resource), we've moved ReferenceGrant to v1beta1 in this release. Note that moving to beta also moves the object to the Standard channel (it was Experimental previously).

We've also removed the already-deprecated ReferencePolicy resource, so please move over to the shiny new ReferenceGrant, which has all the same features.

Promotes ReferenceGrant to the v1beta1 API and the standard release channel (#1455, @nathancoleman)

ReferencePolicy has been removed from the API in favor of ReferenceGrant. (#1406, @robscott)

Introduce GRPCRoute

The GRPCRoute resource has been introduced in order to simplify the routing of GRPC requests. Its design is described in GEP-1016. As it is a new resource, it is introduced in the experimental channel.

Thanks to @gnossen for pushing this ahead.

Introduce GRPCRoute resource. (#1115, @gnossen)

Status updates

As described in GEP-1364, status conditions have been updated within the Gateway resource to make it more consistent with the rest of the API. These changes, along with some other status changes, are detailed below.

Gateway:

New Accepted and Programmed conditions introduced.

Scheduled condition deprecated.

Core Conditions now Accepted and Programmed.

Moves to Extended: Ready.

Gateway Listener:

New Accepted and Programmed conditions introduced.

Detached condition deprecated.

Core Conditions now Accepted, Programmed, ResolvedRefs, and Conflicted.

Moves to Extended: Ready.

All Resources:

The Accepted Condition now has a Pending reason, which is the default until the condition is updated by a controller.

Route resources:

... (truncated)

Changelog

Sourced from sigs.k8s.io/gateway-api's changelog.

v0.6.0

Major Changes

ReferenceGrant moves to v1beta1, ReferencePolicy removed

With more implementations now supporting ReferenceGrant (and more conformance coverage of the resource), we've moved ReferenceGrant to v1beta1 in this release. Note that moving to beta also moves the object to the Standard channel (it was Experimental previously).

We've also removed the already-deprecated ReferencePolicy resource, so please move over to the shiny new ReferenceGrant, which has all the same features.

Promotes ReferenceGrant to the v1beta1 API and the standard release channel (#1455, @nathancoleman)

ReferencePolicy has been removed from the API in favor of ReferenceGrant. (#1406, @robscott)

Introduce GRPCRoute

The GRPCRoute resource has been introduced in order to simplify the routing of GRPC requests. Its design is described in GEP-1016. As it is a new resource, it is introduced in the experimental channel.

Thanks to @gnossen for pushing this ahead.

Introduce GRPCRoute resource. (#1115, @gnossen)

Status updates

As described in GEP-1364, status conditions have been updated within the Gateway resource to make it more consistent with the rest of the API. These changes, along with some other status changes, are detailed below.

Gateway:

New Accepted and Programmed conditions introduced.

Scheduled condition deprecated.

Core Conditions now Accepted and Programmed.

Moves to Extended: Ready.

Gateway Listener:

New Accepted and Programmed conditions introduced.

Detached condition deprecated.

Core Conditions now Accepted, Programmed, ResolvedRefs, and Conflicted.

Moves to Extended: Ready.

All Resources:

The Accepted Condition now has a Pending reason, which is the default until the condition is updated by a controller.

Route resources:

... (truncated)

Commits

6c222d3 chore: update default version to v0.6.0

ca470e2 Merge pull request #1614 from shaneutt/shaneutt/v0.6.0-changelog

9522bd0 docs: add v0.6.0 changelog entry

6a8738a Merge pull request #1594 from youngnick/973-fix

05fa505 Update wording on ParentRef field to require AllowedRoutes or ReferenceGrant

dc314b1 Assert observedGeneration is incremented in Status.Conditions. (#1586)

9c9429a Merge pull request #1609 from frankbu/impl/istio

889b226 Merge pull request #1608 from shaneutt/shaneutt/release-v060-rc2

91d868b chore: update webhook version in build hacks

3c693e0 fix link target

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 0
build(deps): bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.1
Bumps sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.1.

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.14.1

Changes since v0.14.0

:bug: Bug Fixes

🐛 controllers without For() fail to start by @k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#2108

Full Changelog: https://github.com/kubernetes-sigs/controller-runtime/compare/v0.14.0...v0.14.1

v0.14.0

Changes since v0.13.1

:warning: Breaking Changes

Add Get functionality to SubResourceClient (#2094)

Allow configuring RecoverPanic for controllers globally (#2093)

Add client.SubResourceWriter (#2072)

Support registration and removal of event handler (#2046)

Update Kubernetes dependencies to v0.26 (#2043, #2087)

Zap log: Default to RFC3339 time encoding (#2029)

cache.BuilderWithOptions inherit options from caller (#1980)

:sparkles: New Features

Builder: Do not require For (#2091)

support disable deepcopy on list funcion (#2076)

Add cluster.NewClientFunc with options (#2054)

Tidy up startup logging of kindWithCache source (#2057)

Add function to get reconcileID from context (#2056)

feat: add NOT predicate (#2031)

Allow to provide a custom lock interface to manager (#2027)

Add tls options to manager.Options (#2023)

Update Go version to 1.19 (#1986)

:bug: Bug Fixes

Prevent manager from getting started a second time (#2090)

Missing error log for in-cluster config (#2051)

Skip custom mutation handler when delete a CR (#2049)

fix: improve semantics of combining cache selectorsByObject (#2039)

Conversion webhook should not panic when conversion request is nil (#1970)

:seedling: Others

Prepare for release 0.14 (#2100)

Generate files and update modules (#2096)

Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#2097)

Bump golang.org/x/time (#2089)

Update OWNERS: remove inactive members, promote fillzpp sbueringer (#2088, #2092)

Default ENVTEST version to a working one (1.24.2) (#2081)

Update golangci-lint to v1.50.1 (#2080)

Bump go.uber.org/zap from 1.23.0 to 1.24.0 (#2077)

Bump golang.org/x/sys from 0.2.0 to 0.3.0 (#2078)

Ignore Kubernetes Dependencies in Dependabot (#2071)

... (truncated)

Commits

84c5c9f 🐛 controllers without For() fail to start (#2108)

ddcb99d Merge pull request #2100 from vincepri/release-0.14

69f0938 Merge pull request #2094 from alvaroaleman/subresoruce-get

8738e91 Merge pull request #2091 from alvaroaleman/no-for

ca4b4de Merge pull request #2096 from lucacome/generate

5673341 Merge pull request #2097 from kubernetes-sigs/dependabot/go_modules/github.co...

7333aed :seedling: Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0

d4f1e82 Generate files and update modules

a387bf4 Merge pull request #2093 from alvaroaleman/recover-panic-globally

da7dd5d :warning: Allow configuring RecoverPanic for controllers globally

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 0
build(deps): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible
Bumps github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible.

Commits

42c8b31 Merge pull request #44656 from thaJeztah/20.10_containerd_binary_1.6.13

ff29c40 update containerd binary to v1.6.13

0234322 Merge pull request #44488 from thaJeztah/20.10_backport_update_gotestsum

edca413 [20.10] update gotestsum to v1.8.2

6112b23 Merge pull request #44476 from sbuckfelder/20.10_UPDATE

194e73f Merge pull request #44607 from thaJeztah/20.10_containerd_binary_1.6.12

a9fdcd5 [20.10] update containerd binary to v1.6.12 (addresses CVE-2022-23471)

48f955d Merge pull request #44597 from thaJeztah/20.10_containerd_1.6.11

50d4d98 Merge pull request #44569 from thaJeztah/20.10_backport_relax_checkSupportedM...

17451d2 Merge pull request #44593 from thaJeztah/20.10_update_go_1.18.9

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 0
build(deps): bump k8s.io/apiextensions-apiserver from 0.25.4 to 0.26.0
Bumps k8s.io/apiextensions-apiserver from 0.25.4 to 0.26.0.

Commits

ec9ebd7 Update dependencies to v0.26.0 tag

6e13726 Merge remote-tracking branch 'origin/master' into release-1.26

c338f3e Update golang.org/x/net 1e63c2f

9768bad sync: update go.mod

f9c2bba fix aggregated discovery version sorting

d2c9e18 Merge pull request #113171 from Jefftree/aggregated-discovery-generic

470c040 Merge pull request #113577 from pacoxu/prometheus-client

915a888 add crds to aggregated discovery

ac326ca upgrade prometheus-client to v1.14.0

92430b6 Merge pull request #113314 from cici37/celIntegration

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pr/no-changelog dependencies
opened by dependabot[bot] 0
Parsing Resource Version Is Not Allowed

Overview of the Issue

The Kubernetes API explicitly disallows parsing the metadata.resourceVersion field on an object as an integer. This project, however, does so as of this commit: https://github.com/hashicorp/consul-api-gateway/pull/26/commits/cb0486e386552b24f74a457df00680785d75a2b7

During a review of code that would be affected by non-numerical resourceVersions, I came upon this code. I'm hoping to better understand what this codebase is using the parsing logic for and if there are other means to that end without using non-supported API behavior. I can see that uses of the parsing seem to all be in precondition functions passed to Upsert* methods on a store. This looks analogous to the resource version precondition provided by the Kubernetes API server, but the only implementation of the store I found was an in-memory one here - so I'm not entirely sure how the Kubernetes client and server get involved here.
type/bug

opened by stevekuznetsov 3

Releases(v0.5.1)

v0.5.1(Nov 22, 2022)
0.5.1 (November 22, 2022)

IMPROVEMENTS:

Allow MeshService CRD to reference a Consul service imported from a peer by specifying the peer's name [GH-406]

BUG FIXES:

Fix being able to use system-wide root certificates in deployments. [GH-459]

Source code(tar.gz)
Source code(zip)
v0.5.0(Nov 17, 2022)
0.5.0 (November 17, 2022)

FEATURES:

Switch deployed gateways to use TTL-based health checks to better support running with Consul servers that are not on the same network as a gateway [GH-371]

IMPROVEMENTS:

Add optional consul.partition and consul.serverName to GatewayClassConfig CRD. If set these will be used to initialize the partition and server name used in TLS verification for communicating with Consul in a deployment. [GH-450]

Add optional podSecurityPolicy to GatewayClassConfig CRD. If set and "managed" ServiceAccounts are being used, a Role and RoleBinding are created to attach the named PodSecurityPolicy to the managed ServiceAccount. [GH-433]

Add optional configuration for maximum upstream connections to GatewayClassConfig CRD. If unset, behavior is unchanged and Envoy's default will be used. [GH-405]

Add support for tolerations to Consul API Gateway Controller and GatewayClassConfig. [GH-426]

Integrate consul-server-connection-manager to support Agentless consul server discovery [GH-449]

Support distroless Envoy images (with continued support for distroful images) [GH-391]

api: add OpenAPI schema and stubs for bootstrap token CRUD [GH-384]

go: update to Go v1.19 [GH-424]

makefile: switch back to upstream go-changelog repo [GH-385]

BUG FIXES:

Delete gateway ACL tokens on shutdown so they are not orphaned after being provisioned at startup. [GH-377]

Fix failing root certificate watch for controller when deployed in secondary federated datacenter. [GH-368]

When a gateway is created in a namespace that doesn't exist in Consul and namespace mirroring is enabled, create the namespace in Consul. [GH-397]

NOTES:

RefNotPermitted error is now returned instead of InvalidCertificateRef in the case where a cross namespace certificate is not allowed by a ReferenceGrant [GH-412]

Source code(tar.gz)
Source code(zip)
v0.4.0(Aug 16, 2022)
0.4.0 (August 16, 2022)

DEPRECATIONS:

gateway-api: ReferencePolicy is deprecated and will be removed in a future release. The functionally identical ReferenceGrant should be used instead. [GH-224]

FEATURES:

Assign BackendNotFound reason to ResolvedRefs condition on routes where the backend reference is a supported kind but does not exist [GH-291]

Assign InvalidKind reason to ResolvedRefs condition on routes where the backend reference is an unknown or unsupported kind [GH-290]

Support prefix replacement URLRewrite filter (docs) [GH-282]

gateway-api: update to the v0.5.0-rc1 release with v1beta1 resource support [GH-224]

gateway-api: update to the v0.5.0-rc2 release with v1beta1 resource support [GH-279]

gateway-api: update to the v0.5.0 release with v1beta1 resource support [GH-283]

BUG FIXES:

Fix intentions syncing for multiple gateways bound to a single route. [GH-308]

Revalidate HTTPRoutes and TCPRoutes and update status when the Kubernetes Service(s) that they reference are modified [GH-247]

Sync in-memory store to Consul at a regular interval in the background [GH-278]

Source code(tar.gz)
Source code(zip)
v0.3.0(Jun 21, 2022)
0.3.0 (June 21, 2022)

BREAKING CHANGES:

Gateway listener certificateRefs to secrets in a different namespace now require a ReferencePolicy [GH-154]

FEATURES:

Added a new configuration option called deployment to GatewayClassConfig that allows the user to configure the number of instances that are deployed per gateway. [GH-195]

Define anti-affinity rules so that the scheduler will attempt to evenly spread gateway pods across all available nodes [GH-202]

IMPROVEMENTS:

go: build with Go 1.18 [GH-167]

k8s/controllers: watch for ReferencePolicy changes to reconcile and revalidate affected Gateways [GH-207]

BUG FIXES:

Clean up stale routes from gateway listeners when not able or allowed to bind, to prevent serving traffic for a detached route. [GH-197]

Clean up stale routes from gateway listeners when route no longer references the gateway. [GH-200]

Fix SPIFFE validation for connect certificates that have no URL (e.g., Vault connect certificates) [GH-225]

Properly handle re-registration of deployed gateways when an agent no longer has the gateway in its catalog [GH-227]

NOTES:

Gateway IP address assignment logic updated to include the case when multiple different pod IPs exist [GH-201]

Source code(tar.gz)
Source code(zip)
v0.2.1(Apr 29, 2022)
0.2.1 (April 29, 2022)

BUG FIXES:

k8s/reconciler: gateway addresses have invalid empty string when LoadBalancer services use a hostname for ExternalIP (like EKS) [GH-187]

Source code(tar.gz)
Source code(zip)
v0.2.0(Apr 27, 2022)
0.2.0 (April 27, 2022)

BREAKING CHANGES:

Routes now require a ReferencePolicy to permit references to services in other namespaces. [GH-143]

IMPROVEMENTS:

changelog: add go-changelog templates and tooling [GH-101]

k8s/controllers: watch for ReferencePolicy changes to reconcile and revalidate affected HTTPRoutes [GH-156]

k8s/controllers: watch for ReferencePolicy changes to reconcile and revalidate affected TCPRoutes [GH-162]

BUG FIXES:

Apply namespace selector for allowed routes to the route's namespace instead of the route itself [GH-119]

Fix http route merging to make sure we merge routes that reference the same hostname [GH-126]

Source code(tar.gz)
Source code(zip)
v0.1.0(Feb 24, 2022)
0.1.0 (February 23, 2022)

Initial release of Consul API Gateway

Supported on Kubernetes /w Consul version 1.11.2 or greater

Supports the following Gateway API CRDs:

v1alpha2.GatewayClass

v1alpha2.Gateway

v1alpha2.HTTPRoute

v1alpha2.TCPRoute

Source code(tar.gz)
Source code(zip)
v0.1.0-beta(Jan 27, 2022)

Source code(tar.gz)
Source code(zip)
v0.1.0-techpreview(Nov 12, 2021)
Changelog

Initial release of Consul API Gateway

Supported on Kubernetes with Consul version 1.11 or greater

Supports the following Gateway API CRDs:

v1alpha2.GatewayClass

v1alpha2.Gateway

v1alpha2.HTTPRoute

Source code(tar.gz)
Source code(zip)