PMREQ-821: Whisker access via Calico Ingress Gateway - #5146
Draft
vara2504 wants to merge 6 commits into
Draft
Conversation
Move the gateway helper logic out of the manager controller into a shared package so the Whisker controller can reuse it: label-driven namespace listing and cleanup, gateway/route health read-back, namespace provisioning, class resolution, and watch setup. The manager controller now delegates to uigateway.Config; manager-only logic (multi-tenant guard, managerDomain host check) stays in place. No behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…on both variants The GatewayAPI controller previously created the tigera-operator-secrets RoleBinding in custom gateway namespaces only on Enterprise. The operator needs secret CRUD there on Calico too, to place the Whisker gateway TLS secret. WAF resources stay Enterprise-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add spec.ingressGateway to the Whisker CR. When set, the Whisker controller renders a Gateway, HTTPRoute, Backend, and ReferenceGrant (mirroring the Manager flow via the shared uigateway helper), mints a gateway TLS secret, and follows Pattern B degraded status until the Gateway is programmed. The HTTPRoute sets a 0s request timeout so SSE flow-log streams are not cut off, and the whisker NetworkPolicy gains an ingress rule admitting only the Envoy proxy pods of this Gateway on 8443. The gateway re-originates TLS to Whisker's HTTPS port, validated against the trusted CA bundle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
calico-system carries an operator-managed default-deny on Calico too. With the proxy NetworkPolicy gated to Enterprise, the OSS Envoy proxy pod could not reach its xDS control plane (port 18000), never became ready, and the Gateway was never programmed. Render the policy on both variants; the proxy SA and RoleBinding stay Enterprise-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add controller tests for the Whisker gateway reconcile flow and direct unit tests for the shared uigateway cleanup helpers (Namespaces, MoveCleanup, Teardown); move the EnsureNamespace specs into the uigateway package. Cleanups: make EnsureNamespace a package function instead of building a throwaway Config, regroup the whisker key-pair constants, and fix stale 'sets a warning' wording in the shared IngressGatewaySpec docs (CRDs regenerated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Give the gateway-watch errors a descriptive message and ':' separator to match the surrounding style, and update the reconcileGatewayNamespaceResources comment now that the operator-secrets RoleBinding is written on both variants. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
New feature: expose the Whisker UI (Calico OSS) through Calico Ingress Gateway, following the same flow #5032 added for Manager.
spec.ingressGatewayto the Whisker CR. When set, the Whisker controller renders a Gateway, HTTPRoute, Backend, and ReferenceGrant, mints a gateway TLS secret, and reports Degraded until the Gateway is programmed.pkg/controller/uigateway(label-driven cleanup, health read-back, namespace provisioning, class resolution, watch setup). No Manager behavior change.0srequest timeout so SSE flow-log streams stay open; the whisker NetworkPolicy admits only this Gateway's Envoy proxy pods on 8443; the gateway re-originates TLS to Whisker's HTTPS port validated against the trusted CA bundle.Testing: UTs and FVs pass; verified end-to-end on two Calico clusters (AWS + GKE-based): render, LB HTTPS 200, port-forward HTTPS 200, Degraded-to-Available status flow, and cleanup on spec removal.
Depends on the Gateway API RBAC being added to the OSS operator ClusterRole (projectcalico/calico PR to follow) and the updated Whisker CRD in OSS manifests.
Release Note