Istio workload selector fetched from the gateway service spec

[guicassolato]

Closes #141

Verification steps

❶ Setup:

make local-setup

kubectl apply -f examples/toystore/toystore.yaml
kubectl apply -f examples/toystore/httproute.yaml

kubectl apply -f - <<EOF
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant
spec: {}
EOF

❷ Create the policies:

kubectl apply -f - <<EOF
apiVersion: kuadrant.io/v1beta1
kind: AuthPolicy
metadata:
  name: toystore
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  authScheme: {}
---
apiVersion: kuadrant.io/v1beta1
kind: RateLimitPolicy
metadata:
  name: toystore
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rateLimits:
    - rules:
        - hosts: ["rate-limited.toystore.com"]
      configurations:
        - actions:
            - generic_key:
                descriptor_key: "limited"
                descriptor_value: "1"
      limits:
        - conditions:
            - "limited == 1"
          maxValue: 5
          seconds: 10
          variables: []
EOF

❸ Check the workload selectors:

Check the Gateway status and Gateway Service's selector:

kubectl get gateway/istio-ingressgateway -n istio-system -o jsonpath='{.metadata.labels}' | jq .

kubectl get gateway/istio-ingressgateway -n istio-system -o jsonpath='{.status.addresses}' | jq .

kubectl get service/istio-ingressgateway -n istio-system -o jsonpath='{.spec.selector}' | jq .

Check the workload selectors added to the Istio resources:

AuthorizationPolicy:

kubectl get authorizationpolicy/on-istio-ingressgateway-using-toystore -n istio-system -o jsonpath='{.spec.selector}' | jq .

EnvoyFilter:

kubectl get envoyfilter/kuadrant-ratelimiting-cluster-istio-ingressgateway -n istio-system -o jsonpath='{.spec.workloadSelector}' | jq .

WasmPlugin:

kubectl get wasmplugin/kuadrant-istio-ingressgateway -n istio-system -o jsonpath='{.spec.selector}' | jq .

❹ Add a 2nd gateway:

kubectl apply -n istio-system -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: kuadrant-ingressgateway
  labels:
    app: kuadrant
  annotations:
    kuadrant.io/namespace: default
spec:
  gatewayClassName: istio
  listeners:
    - name: default
      protocol: HTTP
      hostname: "*.kuadrant.io"
      port: 8080
      allowedRoutes:
        namespaces:
          from: All
EOF

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
  name: toystore
  labels:
    app: toystore
  annotations:
    kuadrant.io/ratelimitpolicy: 'default/toystore'
    kuadrant.io/authpolicy: 'default/toystore'
spec:
  parentRefs:
    - name: istio-ingressgateway
      namespace: istio-system
    - name: kuadrant-ingressgateway
      namespace: istio-system
  hostnames: ["*.toystore.com", "*.toystore.kuadrant.io"]
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/toy"
          method: GET
        - path:
            type: Exact
            value: "/admin/toy"
          method: POST
        - path:
            type: Exact
            value: "/admin/toy"
          method: DELETE
      backendRefs:
        - name: toystore
          port: 80
EOF

❺ Check the workload selectors:

Check the 2nd Gateway status and 2nd Gateway Service's selector:

kubectl get gateway/kuadrant-ingressgateway -n istio-system -o jsonpath='{.metadata.labels}' | jq .

kubectl get gateway/kuadrant-ingressgateway -n istio-system -o jsonpath='{.status.addresses}' | jq .

kubectl get service/kuadrant-ingressgateway -n istio-system -o jsonpath='{.spec.selector}' | jq .

Check the workload selectors added to the Istio resources:

AuthorizationPolicy:

kubectl get authorizationpolicy/on-kuadrant-ingressgateway-using-toystore -n istio-system -o jsonpath='{.spec.selector}' | jq .

EnvoyFilter:

kubectl get envoyfilter/kuadrant-ratelimiting-cluster-kuadrant-ingressgateway -n istio-system -o jsonpath='{.spec.workloadSelector}' | jq .

WasmPlugin:

kubectl get wasmplugin/kuadrant-kuadrant-ingressgateway -n istio-system -o jsonpath='{.spec.selector}' | jq .

[eguzki]

verification steps working