feat(gateway): expose gatewayAPI.gateway.infrastructure passthrough (#939)
Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.
- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
This commit is contained in:
sabsari
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
d86f08ff96
commit
c638121997
@@ -589,6 +589,10 @@ metadata:
|
||||
{{- end }}
|
||||
spec:
|
||||
gatewayClassName: {{ required "gatewayAPI.gateway.className is required to render the shared Gateway" $obj.className | quote }}
|
||||
{{- with $obj.infrastructure }}
|
||||
infrastructure:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
allowedListeners:
|
||||
namespaces:
|
||||
from: {{ default "All" $obj.allowedListenersNamespaces }}
|
||||
|
||||
@@ -243,6 +243,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
|
||||
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
|
||||
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
|
||||
| `gatewayAPI.gateway.infrastructure` | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB. | `{}` |
|
||||
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
|
||||
|
||||
@@ -138,6 +138,8 @@ gatewayAPI:
|
||||
className: ""
|
||||
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
||||
annotations: {}
|
||||
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
|
||||
infrastructure: {}
|
||||
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
||||
allowedListenersNamespaces: All
|
||||
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
||||
|
||||
@@ -328,6 +328,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
|
||||
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
|
||||
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
|
||||
| `gatewayAPI.gateway.infrastructure` | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB. | `{}` |
|
||||
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
|
||||
|
||||
@@ -159,6 +159,8 @@ gatewayAPI:
|
||||
className: ""
|
||||
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
||||
annotations: {}
|
||||
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
|
||||
infrastructure: {}
|
||||
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
||||
allowedListenersNamespaces: All
|
||||
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
||||
|
||||
@@ -985,4 +985,21 @@ spire-server:
|
||||
Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret"))
|
||||
})
|
||||
})
|
||||
Describe("gatewayAPI.gateway.infrastructure", func() {
|
||||
It("passes infrastructure through to the shared Gateway spec when set", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
gatewayAPI:
|
||||
gateway:
|
||||
enabled: true
|
||||
className: istio
|
||||
infrastructure:
|
||||
annotations:
|
||||
service.beta.kubernetes.io/aws-load-balancer-scheme: internal
|
||||
`)
|
||||
Expect(err).Should(Succeed())
|
||||
gateway := objs["spire/templates/gateway.yaml"]
|
||||
Expect(gateway).Should(ContainSubstring("infrastructure:"))
|
||||
Expect(gateway).Should(ContainSubstring("service.beta.kubernetes.io/aws-load-balancer-scheme: internal"))
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user