Skip to content

Commit c91f19e

Browse files
shraddhabangshraddhabang
authored
[feat: gw api] Add Rules CRD for customizing Gateway API L7 routes with ELB-specific features (#4265)
1 parent e457112 commit c91f19e

File tree

4 files changed

+1439
-3
lines changed

4 files changed

+1439
-3
lines changed

‎apis/gateway/v1beta1/listenerruleconfig_types.go

Lines changed: 325 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,325 @@
1+
package v1beta1
2+
3+
import (
4+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
5+
)
6+
7+
// ListenerRuleConditionField defines the field in the HTTP request to match
8+
// +kubebuilder:validation:Enum=source-ip
9+
type ListenerRuleConditionField string
10+
11+
const (
12+
ListenerRuleConditionFieldSourceIP ListenerRuleConditionField = "source-ip"
13+
)
14+
15+
// AuthenticateCognitoActionConditionalBehaviorEnum defines the behavior when a user is not authenticated
16+
// +kubebuilder:validation:Enum=deny;allow;authenticate
17+
type AuthenticateCognitoActionConditionalBehaviorEnum string
18+
19+
// Enum values for AuthenticateCognitoActionConditionalBehaviorEnum
20+
const (
21+
AuthenticateCognitoActionConditionalBehaviorEnumDeny AuthenticateCognitoActionConditionalBehaviorEnum = "deny"
22+
AuthenticateCognitoActionConditionalBehaviorEnumAllow AuthenticateCognitoActionConditionalBehaviorEnum = "allow"
23+
AuthenticateCognitoActionConditionalBehaviorEnumAuthenticate AuthenticateCognitoActionConditionalBehaviorEnum = "authenticate"
24+
)
25+
26+
// AuthenticateOidcActionConditionalBehaviorEnum defines the behavior when a user is not authenticated
27+
// +kubebuilder:validation:Enum=deny;allow;authenticate
28+
type AuthenticateOidcActionConditionalBehaviorEnum string
29+
30+
// Enum values for AuthenticateOidcActionConditionalBehaviorEnum
31+
const (
32+
AuthenticateOidcActionConditionalBehaviorEnumDeny AuthenticateOidcActionConditionalBehaviorEnum = "deny"
33+
AuthenticateOidcActionConditionalBehaviorEnumAllow AuthenticateOidcActionConditionalBehaviorEnum = "allow"
34+
AuthenticateOidcActionConditionalBehaviorEnumAuthenticate AuthenticateOidcActionConditionalBehaviorEnum = "authenticate"
35+
)
36+
37+
// Information about a source IP condition
38+
type SourceIPConditionConfig struct {
39+
// One or more source IP addresses, in CIDR format
40+
// +kubebuilder:validation:MinItems=1
41+
Values []string `json:"values"`
42+
}
43+
44+
// Information about a condition for a listener rule
45+
// +kubebuilder:validation:XValidation:rule="has(self.field) && self.field == 'source-ip' ? has(self.sourceIPConfig) : !has(self.sourceIPConfig)",message="sourceIPConfig must be specified only when field is 'source-ip'"
46+
type ListenerRuleCondition struct {
47+
// The field in the HTTP request
48+
Field ListenerRuleConditionField `json:"field"`
49+
50+
// Information for a source IP condition
51+
// +optional
52+
SourceIPConfig *SourceIPConditionConfig `json:"sourceIPConfig,omitempty"`
53+
}
54+
55+
// ActionType defines the type of action for the rule
56+
// +kubebuilder:validation:Enum=forward;fixed-response;redirect;authenticate-cognito;authenticate-oidc
57+
type ActionType string
58+
59+
const (
60+
ActionTypeForward ActionType = "forward"
61+
ActionTypeFixedResponse ActionType = "fixed-response"
62+
ActionTypeEnumRedirect ActionType = "redirect"
63+
ActionTypeAuthenticateCognito ActionType = "authenticate-cognito"
64+
ActionTypeAuthenticateOIDC ActionType = "authenticate-oidc"
65+
)
66+
67+
// Information about the target group stickiness for a listener rule.
68+
type TargetGroupStickinessConfig struct {
69+
70+
// The time period, in seconds, during which requests from a client should be
71+
// routed to the same target group. The range is 1-604800 seconds (7 days).
72+
// +kubebuilder:default=3600
73+
// +kubebuilder:validation:Minimum=1
74+
// +kubebuilder:validation:Maximum=604800
75+
DurationSeconds *int32 `json:"durationSeconds,omitempty"`
76+
77+
// Indicates whether target group stickiness is enabled.
78+
// +kubebuilder:default=false
79+
Enabled *bool `json:"enabled,omitempty"`
80+
}
81+
82+
// Information about a forward action.
83+
type ForwardActionConfig struct {
84+
85+
// The target group stickiness for the rule.
86+
// Note: ForwardActionConfig only supports target group stickiness configuration through CRD.
87+
// All other forward action fields must be set through the Gateway API native way.
88+
TargetGroupStickinessConfig *TargetGroupStickinessConfig `json:"targetGroupStickinessConfig,omitempty"`
89+
}
90+
91+
// Information about a redirect action.
92+
type RedirectActionConfig struct {
93+
// The query parameters, URL-encoded when necessary, but not percent-encoded. Do
94+
// not include the leading "?", as it is automatically added. You can specify any
95+
// of the reserved keywords.
96+
// Note: RedirectActionConfig only supports setting the query parameter through CRD.
97+
// All other redirect action fields must be set through the Gateway API native way.
98+
// +kubebuilder:default="#{query}"
99+
Query *string `json:"query,omitempty"`
100+
}
101+
102+
// Information about an action that returns a custom HTTP response.
103+
type FixedResponseActionConfig struct {
104+
// The HTTP response code (2XX, 4XX, or 5XX).
105+
// +kubebuilder:validation:XValidation:rule="(self >= 200 && self <= 299) || (self >= 400 && self <= 599)",message="StatusCode must be a valid HTTP status code in the 2XX, 4XX, or 5XX range"
106+
StatusCode int32 `json:"statusCode"`
107+
108+
// The content type of the fixed response.
109+
// +optional
110+
// +kubebuilder:default="text/plain"
111+
// +kubebuilder:validation:Enum=text/plain;text/css;text/html;application/javascript;application/json
112+
ContentType *string `json:"contentType,omitempty"`
113+
114+
// The message
115+
// +optional
116+
MessageBody *string `json:"messageBody,omitempty"`
117+
}
118+
119+
// Secret holds OAuth 2.0 clientID and clientSecret. You need to create this secret and provide its name and namespace
120+
type Secret struct {
121+
// Name is name of the secret
122+
Name string `json:"name"`
123+
// Namespace is namespace of secret. If empty it will be considered to be in same namespace as of the resource referring it
124+
Namespace *string `json:"namespace,omitempty"`
125+
}
126+
127+
// Information about an authenticate-cognito action
128+
type AuthenticateCognitoActionConfig struct {
129+
// The Amazon Resource Name (ARN) of the Amazon Cognito user pool.
130+
UserPoolArn string `json:"userPoolArn"`
131+
132+
// The ID of the Amazon Cognito user pool client.
133+
UserPoolClientID string `json:"userPoolClientId"`
134+
135+
// The domain prefix or fully-qualified domain name of the Amazon Cognito user
136+
// pool.
137+
UserPoolDomain string `json:"userPoolDomain"`
138+
139+
// The set of user claims to be requested from the IdP. The default is openid .
140+
//
141+
// To verify which scope values your IdP supports and how to separate multiple
142+
// values, see the documentation for your IdP.
143+
// +optional
144+
// +kubebuilder:default="openid"
145+
Scope *string `json:"scope,omitempty"`
146+
147+
// The query parameters (up to 10) to include in the redirect request to the
148+
// authorization endpoint.
149+
// +optional
150+
// +kubebuilder:validation:MaxProperties=10
151+
AuthenticationRequestExtraParams *map[string]string `json:"authenticationRequestExtraParams,omitempty"`
152+
153+
// The behavior if the user is not authenticated. The following are possible
154+
// +kubebuilder:default="authenticate"
155+
OnUnauthenticatedRequest *AuthenticateCognitoActionConditionalBehaviorEnum `json:"onUnauthenticatedRequest,omitempty"`
156+
157+
// The name of the cookie used to maintain session information. The default is
158+
// AWSELBAuthSessionCookie.
159+
// +optional
160+
// +kubebuilder:default="AWSELBAuthSessionCookie"
161+
SessionCookieName *string `json:"sessionCookieName,omitempty"`
162+
163+
// The maximum duration of the authentication session, in seconds. The default is
164+
// 604800 seconds (7 days).
165+
// +optional
166+
// +kubebuilder:default=604800
167+
// +kubebuilder:validation:Minimum=1
168+
// +kubebuilder:validation:Maximum=604800
169+
SessionTimeout *int32 `json:"sessionTimeout,omitempty"`
170+
}
171+
172+
// Information about an authenticate-oidc action
173+
type AuthenticateOidcActionConfig struct {
174+
// The authorization endpoint of the IdP. This must be a full URL, including the
175+
// HTTPS protocol, the domain, and the path.
176+
AuthorizationEndpoint string `json:"authorizationEndpoint"`
177+
178+
// Secret holds OAuth 2.0 clientID and clientSecret. You need to create this secret and provide its name and namespace
179+
Secret *Secret `json:"secret"`
180+
181+
// The OIDC issuer identifier of the IdP. This must be a full URL, including the
182+
// HTTPS protocol, the domain, and the path.
183+
Issuer string `json:"issuer"`
184+
185+
// The token endpoint of the IdP. This must be a full URL, including the HTTPS
186+
// protocol, the domain, and the path.
187+
TokenEndpoint string `json:"tokenEndpoint"`
188+
189+
// The user info endpoint of the IdP. This must be a full URL, including the HTTPS
190+
// protocol, the domain, and the path.
191+
UserInfoEndpoint string `json:"userInfoEndpoint"`
192+
193+
// The set of user claims to be requested from the IdP. The default is openid .
194+
//
195+
// To verify which scope values your IdP supports and how to separate multiple
196+
// values, see the documentation for your IdP.
197+
// +optional
198+
// +kubebuilder:default="openid"
199+
Scope *string `json:"scope,omitempty"`
200+
201+
// The query parameters (up to 10) to include in the redirect request to the
202+
// authorization endpoint.
203+
// +optional
204+
// +kubebuilder:validation:MaxProperties=10
205+
AuthenticationRequestExtraParams *map[string]string `json:"authenticationRequestExtraParams,omitempty"`
206+
207+
// The behavior if the user is not authenticated. The following are possible
208+
// +kubebuilder:default="authenticate"
209+
OnUnauthenticatedRequest *AuthenticateOidcActionConditionalBehaviorEnum `json:"onUnauthenticatedRequest,omitempty"`
210+
211+
// The name of the cookie used to maintain session information. The default is
212+
// AWSELBAuthSessionCookie.
213+
// +optional
214+
// +kubebuilder:default="AWSELBAuthSessionCookie"
215+
SessionCookieName *string `json:"sessionCookieName,omitempty"`
216+
217+
// The maximum duration of the authentication session, in seconds. The default is
218+
// 604800 seconds (7 days).
219+
// +optional
220+
// +kubebuilder:default=604800
221+
// +kubebuilder:validation:Minimum=1
222+
// +kubebuilder:validation:Maximum=604800
223+
SessionTimeout *int32 `json:"sessionTimeout,omitempty"`
224+
225+
// Indicates whether to use the existing client secret when modifying a listener rule. If
226+
// you are creating a listener rule, you can omit this parameter or set it to false.
227+
// +optional
228+
UseExistingClientSecret *bool `json:"useExistingClientSecret,omitempty"`
229+
}
230+
231+
// Action defines an action for a listener rule
232+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'forward' ? has(self.forwardConfig) : !has(self.forwardConfig)",message="forwardConfig must be specified only when type is 'forward'"
233+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'redirect' ? has(self.redirectConfig) : !has(self.redirectConfig)",message="redirectConfig must be specified only when type is 'redirect'"
234+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'fixed-response' ? has(self.fixedResponseConfig) : !has(self.fixedResponseConfig)",message="fixedResponseConfig must be specified only when type is 'fixed-response'"
235+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'authenticate-cognito' ? has(self.authenticateCognitoConfig) : !has(self.authenticateCognitoConfig)",message="authenticateCognitoConfig must be specified only when type is 'authenticate-cognito'"
236+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'authenticate-oidc' ? has(self.authenticateOIDCConfig) : !has(self.authenticateOIDCConfig)",message="authenticateOIDCConfig must be specified only when type is 'authenticate-oidc'"
237+
type Action struct {
238+
// The type of action
239+
Type ActionType `json:"type"`
240+
241+
// Information for a forward action
242+
// +optional
243+
ForwardConfig *ForwardActionConfig `json:"forwardConfig,omitempty"`
244+
245+
// Information for a redirect action
246+
// +optional
247+
RedirectConfig *RedirectActionConfig `json:"redirectConfig,omitempty"`
248+
249+
// Information for a fixed-response action
250+
// +optional
251+
FixedResponseConfig *FixedResponseActionConfig `json:"fixedResponseConfig,omitempty"`
252+
253+
// Information for an authenticate-cognito action
254+
// +optional
255+
AuthenticateCognitoConfig *AuthenticateCognitoActionConfig `json:"authenticateCognitoConfig,omitempty"`
256+
257+
// Information for an authenticate-oidc action
258+
// +optional
259+
AuthenticateOIDCConfig *AuthenticateOidcActionConfig `json:"authenticateOIDCConfig,omitempty"`
260+
}
261+
262+
// ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
263+
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions) > 0",message="At least one action must be specified if actions field is present"
264+
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || self.actions.all(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito' || a.type == 'fixed-response' || a.type == 'forward' || a.type == 'redirect')",message="Only forward, redirect, authenticate-oidc, authenticate-cognito, and fixed-response action types are supported"
265+
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions.filter(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito')) <= 1",message="At most one authentication action (either authenticate-oidc or authenticate-cognito) can be specified"
266+
type ListenerRuleSpec struct {
267+
// Actions defines the set of actions to be performed when conditions match.
268+
// This CRD implementation currently supports only authenticate-oidc, authenticate-cognito, and fixed-response action types fully and forward and redirect actions partially
269+
//
270+
// For other fields in forward and redirect actions, please use the standard Gateway API HTTPRoute or other route resources, which provide
271+
// native support for those conditions through the Gateway API specification.
272+
//
273+
// At most one authentication action can be specified (either authenticate-oidc or authenticate-cognito).
274+
// +optional
275+
// +kubebuilder:validation:MinItems=1
276+
// +kubebuilder:validation:MaxItems=2
277+
Actions []Action `json:"actions,omitempty"`
278+
279+
// Conditions defines the circumstances under which the rule actions will be performed.
280+
// This CRD implementation currently supports only the source-ip condition type
281+
//
282+
// For other condition types (such as path-pattern, host-header, http-header, etc.),
283+
// please use the standard Gateway API HTTPRoute or other route resources, which provide
284+
// native support for those conditions through the Gateway API specification.
285+
// +optional
286+
// +kubebuilder:validation:MinItems=1
287+
Conditions []ListenerRuleCondition `json:"conditions,omitempty"`
288+
289+
// Tags are the AWS resource tags to be applied to all AWS resources created for this rule.
290+
// +optional
291+
Tags *map[string]string `json:"tags,omitempty"`
292+
}
293+
294+
// ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
295+
type ListenerRuleStatus struct {
296+
297+
// The observed generation of the rule configuration
298+
// +optional
299+
ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
300+
}
301+
302+
// +kubebuilder:object:root=true
303+
// +kubebuilder:subresource:status
304+
// +kubebuilder:storageversion
305+
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
306+
// ListenerRuleConfiguration is the Schema for the ListenerRuleConfiguration API
307+
type ListenerRuleConfiguration struct {
308+
metav1.TypeMeta `json:",inline"`
309+
metav1.ObjectMeta `json:"metadata,omitempty"`
310+
311+
Spec ListenerRuleSpec `json:"spec,omitempty"`
312+
Status ListenerRuleStatus `json:"status,omitempty"`
313+
}
314+
315+
// +kubebuilder:object:root=true
316+
// ListenerRuleConfigurationList contains a list of ListenerRuleConfiguration
317+
type ListenerRuleConfigurationList struct {
318+
metav1.TypeMeta `json:",inline"`
319+
metav1.ListMeta `json:"metadata,omitempty"`
320+
Items []ListenerRuleConfiguration `json:"items"`
321+
}
322+
323+
func init() {
324+
SchemeBuilder.Register(&ListenerRuleConfiguration{}, &ListenerRuleConfigurationList{})
325+
}

0 commit comments

Comments
 (0)