Skip to content

Commit e2b2b6d

Browse files
cucxabongcucxabong
committed
feat: add support for ingress backed GlooEdge Gateway
1 parent 6e9d459 commit e2b2b6d

File tree

9 files changed

+482
-76
lines changed

9 files changed

+482
-76
lines changed

‎charts/external-dns/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1818

1919
## [UNRELEASED]
2020

21+
### Changed
22+
23+
- Grant `networking.k8s.io/ingresses` and `gateway.solo.io/gateways` permissions when using `gloo-proxy` source. ([#5909](https://github.com/kubernetes-sigs/external-dns/pull/5909)) _@cucxabong_
24+
2125
## [v1.19.0] - 2025-09-08
2226

2327
### Added

‎charts/external-dns/templates/clusterrole.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ rules:
2626
resources: ["endpointslices"]
2727
verbs: ["get","watch","list"]
2828
{{- end }}
29-
{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
29+
{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) (has "gloo-proxy" .Values.sources) }}
3030
- apiGroups: ["extensions","networking.k8s.io"]
3131
resources: ["ingresses"]
3232
verbs: ["get","watch","list"]
@@ -99,7 +99,7 @@ rules:
9999
{{- end }}
100100
{{- if has "gloo-proxy" .Values.sources }}
101101
- apiGroups: ["gloo.solo.io","gateway.solo.io"]
102-
resources: ["proxies","virtualservices"]
102+
resources: ["proxies","virtualservices","gateways"]
103103
verbs: ["get","watch","list"]
104104
{{- end }}
105105
{{- if has "kong-tcpingress" .Values.sources }}

‎charts/external-dns/tests/json-schema_test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ tests:
3030
enabled: "abrakadabra"
3131
asserts:
3232
- failedTemplate:
33-
errorPattern: "Invalid type. Expected: [boolean,null], given: string"
33+
errorPattern: "got string, want null or boolean"
3434

3535
- it: should fail if provider is null
3636
set:

‎charts/external-dns/tests/rbac_test.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -520,3 +520,27 @@ tests:
520520
resources: ["virtualservices"]
521521
verbs: ["get","watch","list"]
522522
template: clusterrole.yaml
523+
- it: should create default RBAC rules for 'GlooEdge' when 'gloo-proxy' is set
524+
set:
525+
sources:
526+
- gloo-proxy
527+
asserts:
528+
- template: clusterrole.yaml
529+
equal:
530+
path: rules
531+
value:
532+
- apiGroups: [""]
533+
resources: ["nodes"]
534+
verbs: ["list","watch"]
535+
- apiGroups: [""]
536+
resources: ["pods"]
537+
verbs: ["get","watch","list"]
538+
- apiGroups: [""]
539+
resources: ["services"]
540+
verbs: ["get","watch","list"]
541+
- apiGroups: ["extensions","networking.k8s.io"]
542+
resources: ["ingresses"]
543+
verbs: ["get","watch","list"]
544+
- apiGroups: ["gloo.solo.io","gateway.solo.io"]
545+
resources: ["proxies","virtualservices","gateways"]
546+
verbs: ["get","watch","list"]

‎docs/annotations/annotations.md‎

Lines changed: 98 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -150,14 +150,108 @@ If the annotation is not present, use the domains from both the spec and annotat
150150

151151
## external-dns.alpha.kubernetes.io/ingress
152152

153-
This annotation allows ExternalDNS to work with Istio Gateways that don't have a public IP.
153+
This annotation allows ExternalDNS to work with Istio & GlooEdge Gateways that don't have a public IP.
154154

155-
It can be used to address a specific architectural pattern, when a Kubernetes Ingress directs all public traffic to the Istio Gateway:
155+
It can be used to address a specific architectural pattern, when a Kubernetes Ingress directs all public traffic to an Istio or GlooEdge Gateway:
156156

157157
- **The Challenge**: By default, ExternalDNS sources the public IP address for a DNS record from a Service of type LoadBalancer.
158-
However, in some service mesh setups, the Istio Gateway's Service is of type ClusterIP, with all public traffic routed to it via a separate Kubernetes Ingress object. This setup leaves the Gateway without a public IP that ExternalDNS can discover.
158+
However, in some setups, the Gateway's Service is of type ClusterIP, with all public traffic routed to it via a separate Kubernetes Ingress object. This setup leaves the Gateway without a public IP that ExternalDNS can discover.
159159

160-
- **The Solution**: The annotation on the Istio Gateway tells ExternalDNS to ignore the Gateway's Service IP. Instead, it directs ExternalDNS to a specified Ingress resource to find the target LoadBalancer IP address.
160+
- **The Solution**: The annotation on the Istio/GlooEdge Gateway tells ExternalDNS to ignore the Gateway's Service IP. Instead, it directs ExternalDNS to a specified Ingress resource to find the target LoadBalancer IP address.
161+
162+
### Use Cases for `external-dns.alpha.kubernetes.io/ingress` annotation
163+
164+
#### Getting target from Ingress backed Gloo Gateway
165+
166+
```yml
167+
apiVersion: gateway.solo.io/v1
168+
kind: Gateway
169+
metadata:
170+
annotations:
171+
external-dns.alpha.kubernetes.io/ingress: gateway-proxy
172+
labels:
173+
app: gloo
174+
name: gateway-proxy
175+
namespace: gloo-system
176+
spec:
177+
bindAddress: '::'
178+
bindPort: 8080
179+
options: {}
180+
proxyNames:
181+
- gateway-proxy
182+
ssl: false
183+
useProxyProto: false
184+
---
185+
apiVersion: networking.k8s.io/v1
186+
kind: Ingress
187+
metadata:
188+
name: gateway-proxy
189+
namespace: gloo-system
190+
spec:
191+
ingressClassName: alb
192+
rules:
193+
- host: cool-service.example.com
194+
http:
195+
paths:
196+
- backend:
197+
service:
198+
name: gateway-proxy
199+
port:
200+
name: http
201+
path: /
202+
pathType: Prefix
203+
status:
204+
loadBalancer:
205+
ingress:
206+
- hostname: k8s-alb-c4aa37c880-740590208.us-east-1.elb.amazonaws.com
207+
---
208+
# This object is generated by GlooEdge Control Plane from Gateway and VirtualService.
209+
# We have no direct control on this resource
210+
apiVersion: gloo.solo.io/v1
211+
kind: Proxy
212+
metadata:
213+
labels:
214+
created_by: gloo-gateway
215+
name: gateway-proxy
216+
namespace: gloo-system
217+
spec:
218+
listeners:
219+
- bindAddress: '::'
220+
bindPort: 8080
221+
httpListener:
222+
virtualHosts:
223+
- domains:
224+
- cool-service.example.com
225+
metadataStatic:
226+
sources:
227+
- observedGeneration: "6652"
228+
resourceKind: '*v1.VirtualService'
229+
resourceRef:
230+
name: cool-service
231+
namespace: gloo-system
232+
name: cool-service
233+
routes:
234+
- matchers:
235+
- prefix: /
236+
metadataStatic:
237+
sources:
238+
- observedGeneration: "6652"
239+
resourceKind: '*v1.VirtualService'
240+
resourceRef:
241+
name: cool-service
242+
namespace: gloo-system
243+
upgrades:
244+
- websocket: {}
245+
metadataStatic:
246+
sources:
247+
- observedGeneration: "6111"
248+
resourceKind: '*v1.Gateway'
249+
resourceRef:
250+
name: gateway-proxy
251+
namespace: gloo-system
252+
name: listener-::-8080
253+
useProxyProto: false
254+
```
161255

162256
## external-dns.alpha.kubernetes.io/internal-hostname
163257

‎docs/sources/gloo-proxy.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,52 @@ spec:
104104
- --registry=txt
105105
- --txt-owner-id=my-identifier
106106
```
107+
108+
## Gateway Annotation
109+
110+
To support setups where an Ingress resource is used provision an external LB you can add the following annotation to your Gateway
111+
112+
**Note:** The Ingress namespace can be omitted if its in the same namespace as the gateway
113+
114+
```bash
115+
$ cat <<EOF | kubectl apply -f -
116+
apiVersion: gloo.solo.io/v1
117+
kind: Proxy
118+
metadata:
119+
labels:
120+
created_by: gloo-gateway
121+
name: gateway-proxy
122+
namespace: gloo-system
123+
spec:
124+
listeners:
125+
- bindAddress: '::'
126+
metadataStatic:
127+
sources:
128+
- resourceKind: '*v1.Gateway'
129+
resourceRef:
130+
name: gateway-proxy
131+
namespace: gloo-system
132+
---
133+
apiVersion: gateway.solo.io/v1
134+
kind: Gateway
135+
metadata:
136+
annotations:
137+
external-dns.alpha.kubernetes.io/ingress: "$ingressNamespace/$ingressName"
138+
labels:
139+
app: gloo
140+
name: gateway-proxy
141+
namespace: gloo-system
142+
spec: {}
143+
---
144+
apiVersion: networking.k8s.io/v1
145+
kind: Ingress
146+
metadata:
147+
labels:
148+
gateway-proxy-id: gateway-proxy
149+
gloo: gateway-proxy
150+
name: gateway-proxy
151+
namespace: gloo-system
152+
spec:
153+
ingressClassName: alb
154+
EOF
155+
```

0 commit comments

Comments
 (0)