writers

Documentation

Index

• Constants
• func LabelSafe(s string) string
• type IstioL4Writer
  • func NewIstioL4Writer(c client.Client) *IstioL4Writer
  • func (w *IstioL4Writer) Apply(ctx context.Context, scheme *runtime.Scheme, gateway *gatewayApiv1.Gateway, ...) error
  • func (w *IstioL4Writer) Delete(ctx context.Context, gateway *gatewayApiv1.Gateway) error
  • func (w *IstioL4Writer) RequiredPermissions() []Permission
• type IstioL7Writer
  • func NewIstioL7Writer(c client.Client, managedBy string, cidrResolver resolvers.CidrResolver) *IstioL7Writer
  • func (w *IstioL7Writer) Apply(ctx context.Context, scheme *runtime.Scheme, route *gatewayApiv1.HTTPRoute, ...) error
  • func (w *IstioL7Writer) ApplyMerged(ctx context.Context, gateway *gatewayApiv1.Gateway, ...) error
  • func (w *IstioL7Writer) Delete(ctx context.Context, obj client.Object) error
  • func (w *IstioL7Writer) DeleteForRoute(ctx context.Context, managedBy, routeNamespace, routeName string) error
  • func (w *IstioL7Writer) DeleteMerged(ctx context.Context, namespace, mergeKey string) error
  • func (w *IstioL7Writer) IsOrphaned(obj client.Object, allRoutes []gatewayApiv1.HTTPRoute) bool
  • func (w *IstioL7Writer) ListManaged(ctx context.Context, managedBy string) ([]client.Object, error)
  • func (w *IstioL7Writer) RequiredPermissions() []Permission
  • func (w *IstioL7Writer) TranslatePaths(matches []gatewayApiv1.HTTPRouteMatch) []string
• type L4PolicyWriter
• type L4WriterRegistry
• type L7PolicyWriter
• type L7WriterRegistry
• type MergeableL7PolicyWriter
• type PathTranslator
• type Permission
• type PermissionProvider

Constants

const IstioControllerName = "istio.io/gateway-controller"

Functions

func LabelSafe

func LabelSafe(s string) string

LabelSafe sanitizes a string for use as a Kubernetes label value. Names longer than 63 chars are truncated to 54 chars and suffixed with "-{fnv32hex}" to stay collision-resistant (same approach as truncateName).

Types

type IstioL4Writer

type IstioL4Writer struct {
	// contains filtered or unexported fields
}

IstioL4Writer creates/deletes Istio AuthorizationPolicies for Gateway-level (L4) allowlisting.

func NewIstioL4Writer

func NewIstioL4Writer(c client.Client) *IstioL4Writer

NewIstioL4Writer returns a new IstioL4Writer using the provided client.

func (*IstioL4Writer) Apply

func (w *IstioL4Writer) Apply(ctx context.Context, scheme *runtime.Scheme, gateway *gatewayApiv1.Gateway, ips []string) error

Apply creates or updates an AuthorizationPolicy for the given Gateway and IPs.

func (*IstioL4Writer) Delete

func (w *IstioL4Writer) Delete(ctx context.Context, gateway *gatewayApiv1.Gateway) error

Delete removes the AuthorizationPolicy associated with the given Gateway.

func (*IstioL4Writer) RequiredPermissions

func (w *IstioL4Writer) RequiredPermissions() []Permission

RequiredPermissions returns the RBAC permissions needed by this writer.

type IstioL7Writer

type IstioL7Writer struct {
	// contains filtered or unexported fields
}

IstioL7Writer creates/deletes Istio AuthorizationPolicies for HTTPRoute-level (L7) allowlisting.

func NewIstioL7Writer

func NewIstioL7Writer(c client.Client, managedBy string, cidrResolver resolvers.CidrResolver) *IstioL7Writer

NewIstioL7Writer returns a new IstioL7Writer.

func (*IstioL7Writer) Apply

func (w *IstioL7Writer) Apply(ctx context.Context, scheme *runtime.Scheme, route *gatewayApiv1.HTTPRoute, gateway *gatewayApiv1.Gateway, ips, hosts, paths []string) error

Apply creates or updates an AuthorizationPolicy for the given HTTPRoute+gateway+paths combination. When paths is non-empty the AP name includes a hash suffix so each rule gets its own AP. If ips is empty, any previously created AP for this route+paths is deleted instead.

func (*IstioL7Writer) ApplyMerged

func (w *IstioL7Writer) ApplyMerged(ctx context.Context, gateway *gatewayApiv1.Gateway, siblings []*gatewayApiv1.HTTPRoute, mergeKey string) error

ApplyMerged creates or updates a merged AuthorizationPolicy for a merge group.

Security model: routes with different CIDR sets must NOT share a `from` block, otherwise a CIDR allowed on one host would implicitly gain access to another host.

Algorithm (two-level grouping):

1. For each sibling route, collect per-rule tuples: (sorted_cidrs, sorted_hosts, paths). When granularity=host the route contributes one tuple (no paths); otherwise one per rule.
2. Group tuples by sorted_cidrs → one Istio Rule per unique CIDR set (one `from` block).
3. Within each CIDR group, group by sorted_hosts → one `to` Operation per unique host set.
4. Collect all paths from matching tuples into that Operation.
5. Compact `to` operations sharing the same path set into one (merging their host lists).

func (*IstioL7Writer) Delete

func (w *IstioL7Writer) Delete(ctx context.Context, obj client.Object) error

Delete removes the given object from the cluster.

func (*IstioL7Writer) DeleteForRoute

func (w *IstioL7Writer) DeleteForRoute(ctx context.Context, managedBy, routeNamespace, routeName string) error

DeleteForRoute deletes all APs owned by the given route, identified by owner labels.

func (*IstioL7Writer) DeleteMerged

func (w *IstioL7Writer) DeleteMerged(ctx context.Context, namespace, mergeKey string) error

DeleteMerged removes the merged AuthorizationPolicy for the given merge key.

func (*IstioL7Writer) IsOrphaned

func (w *IstioL7Writer) IsOrphaned(obj client.Object, allRoutes []gatewayApiv1.HTTPRoute) bool

IsOrphaned reports whether the given AP no longer has a valid owner HTTPRoute.

func (*IstioL7Writer) ListManaged

func (w *IstioL7Writer) ListManaged(ctx context.Context, managedBy string) ([]client.Object, error)

ListManaged returns all AuthorizationPolicies managed by this controller (identified by managedBy label).

func (*IstioL7Writer) RequiredPermissions

func (w *IstioL7Writer) RequiredPermissions() []Permission

RequiredPermissions returns the RBAC permissions needed by this writer.

func (*IstioL7Writer) TranslatePaths

func (w *IstioL7Writer) TranslatePaths(matches []gatewayApiv1.HTTPRouteMatch) []string

TranslatePaths implements PathTranslator for Istio AuthorizationPolicy path semantics. PathPrefix /chaos → ["/chaos", "/chaos/*"] (exact + glob, covers /chaos and all sub-paths) Exact /chaos → ["/chaos"] (passed through unchanged) RegularExpression → skipped (not supported by Istio AuthorizationPolicy)

type L4PolicyWriter

type L4PolicyWriter interface {
	Apply(ctx context.Context, scheme *runtime.Scheme, gateway *gatewayApiv1.Gateway, ips []string) error
	Delete(ctx context.Context, gateway *gatewayApiv1.Gateway) error
}

L4PolicyWriter creates gateway-level (L4) allow policies.

type L4WriterRegistry

type L4WriterRegistry map[string]L4PolicyWriter

L4WriterRegistry maps GatewayClass controllerName to an L4PolicyWriter.

type L7PolicyWriter

type L7PolicyWriter interface {
	Apply(ctx context.Context, scheme *runtime.Scheme, route *gatewayApiv1.HTTPRoute, gateway *gatewayApiv1.Gateway, ips, hosts, paths []string) error
	ListManaged(ctx context.Context, managedBy string) ([]client.Object, error)
	IsOrphaned(obj client.Object, allRoutes []gatewayApiv1.HTTPRoute) bool
	Delete(ctx context.Context, obj client.Object) error
	// DeleteForRoute deletes all policies owned by the given route, identified by owner labels.
	// Called when the allowlist annotation is removed so that existing APs are cleaned up
	// immediately rather than waiting for the next startup cleanup.
	DeleteForRoute(ctx context.Context, managedBy, routeNamespace, routeName string) error
}

L7PolicyWriter creates route-level (L7) allow policies.

type L7WriterRegistry

type L7WriterRegistry map[string]L7PolicyWriter

L7WriterRegistry maps GatewayClass controllerName to an L7PolicyWriter.

type MergeableL7PolicyWriter

type MergeableL7PolicyWriter interface {
	L7PolicyWriter
	ApplyMerged(ctx context.Context, gateway *gatewayApiv1.Gateway, siblings []*gatewayApiv1.HTTPRoute, mergeKey string) error
	// DeleteMerged removes the merged policy for the given merge key in the gateway's namespace.
	// Called when a confirmed-empty sibling list means the merge group no longer exists.
	DeleteMerged(ctx context.Context, namespace, mergeKey string) error
}

MergeableL7PolicyWriter is an optional extension of L7PolicyWriter for writers that support merging IPs and hosts from multiple HTTPRoutes into a single shared policy identified by a merge key. Writers that don't support this concept simply don't implement this interface.

type PathTranslator

type PathTranslator interface {
	TranslatePaths(matches []gatewayApiv1.HTTPRouteMatch) []string
}

PathTranslator is an optional interface a writer can implement to control how HTTPRoute path matches are translated into the enforcement-layer path strings passed to Apply. Writers that don't implement this receive raw path values from match.Path.Value.

type Permission

type Permission struct {
	Group    string
	Resource string
	Verb     string
}

Permission represents a single Kubernetes RBAC permission required by a writer.

type PermissionProvider

type PermissionProvider interface {
	RequiredPermissions() []Permission
}

PermissionProvider is an optional interface a writer can implement to declare the RBAC permissions it needs. checkRBAC in main.go uses this for preflight checks.