[WIP] Merge cluster-proxy into core #151

qiujian16 · 2025-08-13T09:40:13Z

No description provided.

Signed-off-by: Jian Qiu <[email protected]>

openshift-ci · 2025-08-13T09:40:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiujian16

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [qiujian16]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

xuezhaojun · 2025-08-13T12:27:07Z

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

+registration process begins after the cluster registration process and will not impact normal cluster
+registration.
+
+#### Proxy API


I wonder whether we should use term "proxy", I got some cases that users get confused about cluster-proxy with other "proxy" settings like addonproxyconfig.proxyconfig.

Could we use another term like "tunnel"?

tunnel may not be clearly state the functions. Tunnel would mean that agent and hub is establishing the tunnel, but proxy is more accurate which mean user is proxying the request.

some naming suggestion from chatgpt.

grpxy (grpc proxy, short, sysadmin vibe)

tunnx (tunnel nginx-style)

relayx (captures the agent relay role)

I believe the complete description of this functionality can be "proxy requests between hub and agent," but it can also be "establish a tunnel between hub and agent that can be used to proxy requests."

For users of this functionality, they indeed only need to know about an endpoint that can proxy requests - they don't need to know about the existence of a "tunnel." However, for developers and maintainers, the term "tunnel" helps distinguish this functionality from other proxy-related features.

If "tunnel" doesn't work, could we adopt other terms such as: gateway, bridge, relay, etc.?

relay seems ok to me, but since cluster-proxy has been known to many, I am not quite sure how strong the desire to rename.

@jnpacker thought?

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

xuezhaojun · 2025-08-14T14:11:52Z

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

+
+#### Installation
+
+To enable the feature, the user needs to enable the feature gate in `ClusterManager` and `Klusterlet` API.


In hub side, except for grpc server, we will also need endpoint and certificates for the http server.

yes, it is specified in the following.

Don‘t we also need cert and endpoint configuration of this http server also set in cluster-manager?

cluster manager will generate the cert. and we only need to configure endpoint I think?

What if user want to use their customzied cert as the proxy endpoint maybe exposed in their domain?

grpc connection is internal used by proxy, but http proxy is facing to user or maybe user's user.

I got your point, yes we need at least endpoint of http server. I am not sure we need ca bundle. Do we support setting this in cluster-proxy today?

Currently, this version of http-server using CA generated by openshift:

https://github.com/stolostron/backplane-operator/blob/main/pkg/templates/charts/toggle/cluster-proxy-addon/templates/user-deployment.yaml#L139-L148

https://github.com/stolostron/backplane-operator/blob/b5438698d74b66ada00c92cc63c13611757b77c8/pkg/templates/charts/toggle/cluster-proxy-addon/templates/user-service.yaml#L9

The fix looks good to me

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

skeeey · 2025-08-15T01:35:33Z

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

+#### Installation
+
+To enable the feature, the user needs to enable the feature gate in `ClusterManager` and `Klusterlet` API.
+In addition, A new proxyConfig field should be added in `ClusterManager` API:


how about introduce a config for grpcserver instead of proxyConifg

type GRPCServerConfiguration struct { ImagePullSpec string `json:"imagePullSpec,omitempty"` FeatureGates []FeatureGate `json:"featureGates,omitempty"` EndpointExposure *GRPCEndpointExposure `json:"endpointExposure,omitempty"` }

use featureGates to control proxy or transport hub resources with grpc

when we use grpc registration driver, does it mean we need to set both in registrationConfig and gRPCconfig?

yes, for registrationConfig, we need to set authType with grpc to enable the grpc registration

Signed-off-by: Jian Qiu <[email protected]>

skeeey · 2025-08-25T02:47:56Z

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

+        endpoint: grpc://<external grpc address>
+```
+
+Example of grpc registration with proxy disabled:


Suggested change

Example of grpc registration with proxy disabled:

Example of grpc registration with proxy enabled:

skeeey · 2025-08-25T02:48:11Z

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md

+          endpoint: grpc://<external grpc address>
+```
+
+Example of grpc registraion with proxy enabled:


Suggested change

Example of grpc registraion with proxy enabled:

Example of grpc registraion with proxy disabled:

qiujian16 · 2025-08-26T02:04:17Z

@skeeey @xuezhaojun are your fine with the API change on the clusterManager, if so we will need to update clustermanager API sooner.

skeeey · 2025-08-26T02:07:25Z

@skeeey @xuezhaojun are your fine with the API change on the clusterManager, if so we will need to update clustermanager API sooner.

I'm fine with it

xuezhaojun · 2025-08-26T05:10:19Z

/lgtm

xuezhaojun · 2025-08-26T05:37:32Z

@skeeey @xuezhaojun are your fine with the API change on the clusterManager, if so we will need to update clustermanager API sooner.

Yes, the PR looks good to me.

Signed-off-by: Jian Qiu <[email protected]>

openshift-ci · 2025-09-02T01:33:49Z

New changes are detected. LGTM label has been removed.

Signed-off-by: Jian Qiu <[email protected]>

qiujian16 · 2025-11-05T08:43:38Z

we finally decide we will still follow with addon pattern for cluster-proxy.

/close

openshift-ci · 2025-11-05T08:43:42Z

@qiujian16: Closed this PR.

In response to this:

we finally decide we will still follow with addon pattern for cluster-proxy.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Merge cluster-proxy into core

6736bad

Signed-off-by: Jian Qiu <[email protected]>

openshift-ci bot requested a review from deads2k August 13, 2025 09:40

openshift-ci bot added the approved label Aug 13, 2025

qiujian16 changed the title ~~Merge cluster-proxy into core~~ [WIP] Merge cluster-proxy into core Aug 13, 2025

openshift-ci bot added the do-not-merge/work-in-progress label Aug 13, 2025

xuezhaojun reviewed Aug 13, 2025

View reviewed changes

xuezhaojun reviewed Aug 14, 2025

View reviewed changes

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md Outdated Show resolved Hide resolved

xuezhaojun reviewed Aug 14, 2025

View reviewed changes

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md Show resolved Hide resolved

xuezhaojun reviewed Aug 14, 2025

View reviewed changes

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md Outdated Show resolved Hide resolved

xuezhaojun reviewed Aug 14, 2025

View reviewed changes

enhancements/sig-architecture/149-moving-cluster-proxy-to-core/README.md Show resolved Hide resolved

skeeey reviewed Aug 15, 2025

View reviewed changes

Resolve some comments

123ffd3

Signed-off-by: Jian Qiu <[email protected]>

skeeey reviewed Aug 25, 2025

View reviewed changes

openshift-ci bot assigned xuezhaojun Aug 26, 2025

openshift-ci bot added the lgtm label Aug 26, 2025

Update API shape

83591ad

Signed-off-by: Jian Qiu <[email protected]>

qiujian16 force-pushed the proxy branch from 7ccb210 to 83591ad Compare September 2, 2025 01:33

openshift-ci bot removed the lgtm label Sep 2, 2025

Update according to the latest API

a4fa62d

Signed-off-by: Jian Qiu <[email protected]>

openshift-ci bot closed this Nov 5, 2025


		#### Installation

		To enable the feature, the user needs to enable the feature gate in `ClusterManager` and `Klusterlet` API.

	Example of grpc registration with proxy disabled:
	Example of grpc registration with proxy enabled:

	Example of grpc registraion with proxy enabled:
	Example of grpc registraion with proxy disabled:

[WIP] Merge cluster-proxy into core #151

[WIP] Merge cluster-proxy into core #151

Conversation

qiujian16 commented Aug 13, 2025

Uh oh!

openshift-ci bot commented Aug 13, 2025

Uh oh!

xuezhaojun Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

skeeey Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

skeeey Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiujian16 commented Aug 26, 2025

Uh oh!

skeeey commented Aug 26, 2025

Uh oh!

xuezhaojun commented Aug 26, 2025

Uh oh!

xuezhaojun commented Aug 26, 2025

Uh oh!

openshift-ci bot commented Sep 2, 2025

Uh oh!

qiujian16 commented Nov 5, 2025

Uh oh!

openshift-ci bot commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

xuezhaojun Aug 13, 2025 •

edited

Loading

skeeey Aug 15, 2025 •

edited

Loading

skeeey Aug 15, 2025 •

edited

Loading