feat: add support of TLSRoute (#146)

Signed-off-by: Ruslan Suprun <[email protected]>

Author: ruslansuprun

docs/features/tls.md

@@ -0,0 +1,77 @@
+# TLS Routes
+
+To use TLSRoute:
+
+1. Install your traffic provider
+2. Install [GatewayAPI CRD](https://gateway-api.sigs.k8s.io/guides/#installing-gateway-api) if your traffic provider doesn't do it by default
+3. Install [Argo Rollouts](https://argoproj.github.io/argo-rollouts/installation/)
+4. Install [Argo Rollouts GatewayAPI plugin](../installation.md)
+5. Create stable and canary services
+6. Create TLSRoute resource according to the GatewayAPI and your traffic provider documentation
+```yaml
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: first-tlsroute
+  namespace: default
+spec:
+  parentRefs:
+    - name: traefik-gateway # read documentation of your traffic provider to understand what you need to specify here
+      sectionName: tls
+      namespace: default
+      kind: Gateway
+  hostnames:
+    - "example.com" # SNI hostname for TLS traffic routing
+  rules:
+    - backendRefs:
+        - name: argo-rollouts-stable-service # stable service you have created on the 5th step
+          port: 443
+        - name: argo-rollouts-canary-service # canary service you have created on the 5th step
+          port: 443
+```
+7. Create Rollout resource
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  name: rollouts-demo
+  namespace: default
+spec:
+  replicas: 2
+  strategy:
+    canary:
+      canaryService: argo-rollouts-canary-service
+      stableService: argo-rollouts-stable-service
+      trafficRouting:
+        plugins:
+          argoproj-labs/gatewayAPI:
+            tlsRoute: first-tlsroute # tlsroute you have created on the 6th step
+            namespace: default # namespace where your tlsroute is
+      steps:
+        - setWeight: 30
+        - pause: { duration: 2 }
+  revisionHistoryLimit: 1
+  selector:
+    matchLabels:
+      app: rollouts-demo
+  template:
+    metadata:
+      labels:
+        app: rollouts-demo
+    spec:
+      containers:
+        - name: rollouts-demo
+          image: argoproj/rollouts-demo:red
+          ports:
+            - name: https
+              containerPort: 8080
+              protocol: TCP
+          resources:
+            requests:
+              memory: 32Mi
+              cpu: 5m
+```
+
+## Traffic Provider Support
+
+TLSRoute is part of the Gateway API experimental channel. Ensure your traffic provider supports TLSRoute before using it in production. Check the [Gateway API implementations list](https://gateway-api.sigs.k8s.io/implementations/) for TLSRoute support.

mkdocs.yml

@@ -24,6 +24,7 @@ nav:
   - Multiple Routes: features/multiple-routes.md
   - Header Based Routing: features/header-based-routing.md    
   - TCP Routing: features/tcp.md
+  - TLS Routing: features/tls.md
   - GRPC Routing: features/grpc.md  
 
 - Contributing: CONTRIBUTING.md

pkg/mocks/plugin.go

@@ -12,11 +12,13 @@ import (
 const (
 	HTTPRoute         = "HTTPRoute"
 	TCPRoute          = "TCPRoute"
+	TLSRoute          = "TLSRoute"
 	StableServiceName = "argo-rollouts-stable-service"
 	CanaryServiceName = "argo-rollouts-canary-service"
 	HTTPRouteName     = "argo-rollouts-http-route"
 	GRPCRouteName     = "argo-rollouts-grpc-route"
 	TCPRouteName      = "argo-rollouts-tcp-route"
+	TLSRouteName      = "argo-rollouts-tls-route"
 	RolloutNamespace  = "default"
 	ConfigMapName     = "test-config"
 	ManagedRouteName  = "test-header-route"
@@ -186,6 +188,40 @@ func CreateTCPRouteWithLabels(name string, labels map[string]string) *v1alpha2.T
 	}
 }
 
+func CreateTLSRouteWithLabels(name string, labels map[string]string) *v1alpha2.TLSRoute {
+	stableWeight := int32(100)
+	canaryWeight := int32(0)
+	return &v1alpha2.TLSRoute{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: RolloutNamespace,
+			Labels:    labels,
+		},
+		Spec: v1alpha2.TLSRouteSpec{
+			Rules: []v1alpha2.TLSRouteRule{
+				{
+					BackendRefs: []v1alpha2.BackendRef{
+						{
+							BackendObjectReference: v1alpha2.BackendObjectReference{
+								Name: StableServiceName,
+								Port: &port,
+							},
+							Weight: &stableWeight,
+						},
+						{
+							BackendObjectReference: v1alpha2.BackendObjectReference{
+								Name: CanaryServiceName,
+								Port: &port,
+							},
+							Weight: &canaryWeight,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
 var GRPCRouteObj = gatewayv1.GRPCRoute{
 	ObjectMeta: metav1.ObjectMeta{
 		Name:      GRPCRouteName,
@@ -248,6 +284,35 @@ var TCPPRouteObj = v1alpha2.TCPRoute{
 	},
 }
 
+var TLSRouteObj = v1alpha2.TLSRoute{
+	ObjectMeta: metav1.ObjectMeta{
+		Name:      TLSRouteName,
+		Namespace: RolloutNamespace,
+	},
+	Spec: v1alpha2.TLSRouteSpec{
+		Rules: []v1alpha2.TLSRouteRule{
+			{
+				BackendRefs: []v1alpha2.BackendRef{
+					{
+						BackendObjectReference: v1alpha2.BackendObjectReference{
+							Name: StableServiceName,
+							Port: &port,
+						},
+						Weight: &weight,
+					},
+					{
+						BackendObjectReference: v1alpha2.BackendObjectReference{
+							Name: CanaryServiceName,
+							Port: &port,
+						},
+						Weight: &weight,
+					},
+				},
+			},
+		},
+	},
+}
+
 var ConfigMapObj = v1.ConfigMap{
 	ObjectMeta: metav1.ObjectMeta{
 		Name:      ConfigMapName,

pkg/plugin/errors.go

@@ -2,12 +2,14 @@ package plugin
 
 const (
 	GatewayAPIUpdateError                    = "error updating Gateway API %q: %s"
-	GatewayAPIManifestError                  = "No routes configured. At least one of 'httpRoutes', 'grpcRoutes', 'tcpRoutes', 'httpRoute', 'grpcRoute' or 'tcpRoute' must be set"
+	GatewayAPIManifestError                  = "No routes configured. At least one of 'httpRoutes', 'grpcRoutes', 'tcpRoutes', 'tlsRoutes', 'httpRoute', 'grpcRoute', 'tcpRoute' or 'tlsRoute' must be set"
 	HTTPRouteFieldIsEmptyError               = "httpRoute field is empty. It has to be set to remove managed routes"
 	InvalidHeaderMatchTypeError              = "invalid header match type"
 	BackendRefWasNotFoundInHTTPRouteError    = "backendRef was not found in httpRoute"
 	BackendRefWasNotFoundInGRPCRouteError    = "backendRef was not found in grpcRoute"
 	BackendRefWasNotFoundInTCPRouteError     = "backendRef was not found in tcpRoute"
+	BackendRefWasNotFoundInTLSRouteError     = "backendRef was not found in tlsRoute"
 	BackendRefListWasNotFoundInTCPRouteError = "backendRef list was not found in tcpRoute"
+	BackendRefListWasNotFoundInTLSRouteError = "backendRef list was not found in tlsRoute"
 	ManagedRouteMapEntryDeleteError          = "can't delete key %q from managedRouteMap. The key %q is not in the managedRouteMap"
 )

pkg/plugin/plugin.go

@@ -98,6 +98,14 @@ func (r *RpcPlugin) SetWeight(rollout *v1alpha1.Rollout, desiredWeight int32, ad
 		gatewayAPIConfig.TCPRoute = route.Name
 		return r.setTCPRouteWeight(rollout, desiredWeight, gatewayAPIConfig)
 	})
+	if rpcError.HasError() {
+		return rpcError
+	}
+	r.LogCtx.Info(fmt.Sprintf("[SetWeight] plugin %q controls TLSRoutes: %v", PluginName, getGatewayAPIRouteNameList(gatewayAPIConfig.TLSRoutes)))
+	rpcError = forEachGatewayAPIRoute(gatewayAPIConfig.TLSRoutes, func(route TLSRoute) pluginTypes.RpcError {
+		gatewayAPIConfig.TLSRoute = route.Name
+		return r.setTLSRouteWeight(rollout, desiredWeight, gatewayAPIConfig)
+	})
 	return rpcError
 }
 
@@ -205,7 +213,8 @@ func (r *RpcPlugin) getGatewayAPIConfigWithDiscovery(rollout *v1alpha1.Rollout)
 
 	if gatewayAPIConfig.HTTPRouteSelector != nil ||
 		gatewayAPIConfig.GRPCRouteSelector != nil ||
-		gatewayAPIConfig.TCPRouteSelector != nil {
+		gatewayAPIConfig.TCPRouteSelector != nil ||
+		gatewayAPIConfig.TLSRouteSelector != nil {
 		if err := r.discoverRoutesBySelector(rollout, gatewayAPIConfig); err != nil {
 			return nil, err
 		}
@@ -315,6 +324,32 @@ func (r *RpcPlugin) discoverRoutesBySelector(rollout *v1alpha1.Rollout, gatewayA
 		}
 	}
 
+	if gatewayAPIConfig.TLSRouteSelector != nil {
+		selector, err := metav1.LabelSelectorAsSelector(gatewayAPIConfig.TLSRouteSelector)
+		if err != nil {
+			return err
+		}
+
+		tlsRouteList, err := r.GatewayAPIClientset.GatewayV1alpha2().TLSRoutes(namespace).List(
+			context.TODO(),
+			metav1.ListOptions{LabelSelector: selector.String()},
+		)
+		if err != nil {
+			return err
+		}
+
+		for _, route := range tlsRouteList.Items {
+			gatewayAPIConfig.TLSRoutes = append(gatewayAPIConfig.TLSRoutes, TLSRoute{
+				Name:            route.Name,
+				UseHeaderRoutes: false,
+			})
+		}
+
+		if len(tlsRouteList.Items) > 0 {
+			r.LogCtx.Info(fmt.Sprintf("[discoverRoutesBySelector] discovered %d TLSRoutes via selector", len(tlsRouteList.Items)))
+		}
+	}
+
 	return nil
 }
 
@@ -337,6 +372,12 @@ func insertGatewayAPIRouteLists(gatewayAPIConfig *GatewayAPITrafficRouting) {
 			UseHeaderRoutes: true,
 		})
 	}
+	if gatewayAPIConfig.TLSRoute != "" {
+		gatewayAPIConfig.TLSRoutes = append(gatewayAPIConfig.TLSRoutes, TLSRoute{
+			Name:            gatewayAPIConfig.TLSRoute,
+			UseHeaderRoutes: true,
+		})
+	}
 }
 
 func getRouteRule[T1 GatewayAPIBackendRef, T2 GatewayAPIRouteRule[T1], T3 GatewayAPIRouteRuleList[T1, T2]](routeRuleList T3, backendRefNameList ...string) (T2, error) {
@@ -387,7 +428,7 @@ func getBackendRefs[T1 GatewayAPIBackendRef, T2 GatewayAPIRouteRule[T1], T3 Gate
 }
 
 func isConfigHasRoutes(config *GatewayAPITrafficRouting) bool {
-	return len(config.HTTPRoutes) > 0 || len(config.TCPRoutes) > 0 || len(config.GRPCRoutes) > 0
+	return len(config.HTTPRoutes) > 0 || len(config.TCPRoutes) > 0 || len(config.GRPCRoutes) > 0 || len(config.TLSRoutes) > 0
 }
 
 func forEachGatewayAPIRoute[T1 GatewayAPIRoute](routeList []T1, fn func(route T1) pluginTypes.RpcError) pluginTypes.RpcError {

pkg/plugin/plugin_test.go

@@ -36,6 +36,7 @@ func TestRunSuccessfully(t *testing.T) {
 		HTTPRouteClient: gwFake.NewSimpleClientset(&mocks.HTTPRouteObj).GatewayV1().HTTPRoutes(mocks.RolloutNamespace),
 		GRPCRouteClient: gwFake.NewSimpleClientset(&mocks.GRPCRouteObj).GatewayV1().GRPCRoutes(mocks.RolloutNamespace),
 		TCPRouteClient:  gwFake.NewSimpleClientset(&mocks.TCPPRouteObj).GatewayV1alpha2().TCPRoutes(mocks.RolloutNamespace),
+		TLSRouteClient:  gwFake.NewSimpleClientset(&mocks.TLSRouteObj).GatewayV1alpha2().TLSRoutes(mocks.RolloutNamespace),
 		TestClientset:   fake.NewSimpleClientset(&mocks.ConfigMapObj).CoreV1().ConfigMaps(mocks.RolloutNamespace),
 	}
 
@@ -138,6 +139,19 @@ func TestRunSuccessfully(t *testing.T) {
 		assert.Equal(t, 100-desiredWeight, *(rpcPluginImp.UpdatedTCPRouteMock.Spec.Rules[0].BackendRefs[0].Weight))
 		assert.Equal(t, desiredWeight, *(rpcPluginImp.UpdatedTCPRouteMock.Spec.Rules[0].BackendRefs[1].Weight))
 	})
+	t.Run("SetTLSRouteWeight", func(t *testing.T) {
+		var desiredWeight int32 = 30
+		rollout := newRollout(mocks.StableServiceName, mocks.CanaryServiceName,
+			&GatewayAPITrafficRouting{
+				Namespace: mocks.RolloutNamespace,
+				TLSRoute:  mocks.TLSRouteName,
+			})
+		err := pluginInstance.SetWeight(rollout, desiredWeight, []v1alpha1.WeightDestination{})
+
+		assert.Empty(t, err.Error())
+		assert.Equal(t, 100-desiredWeight, *(rpcPluginImp.UpdatedTLSRouteMock.Spec.Rules[0].BackendRefs[0].Weight))
+		assert.Equal(t, desiredWeight, *(rpcPluginImp.UpdatedTLSRouteMock.Spec.Rules[0].BackendRefs[1].Weight))
+	})
 	t.Run("SetWeightViaRoutes", func(t *testing.T) {
 		var desiredWeight int32 = 30
 		rollout := newRollout(mocks.StableServiceName, mocks.CanaryServiceName,
@@ -155,6 +169,12 @@ func TestRunSuccessfully(t *testing.T) {
 						UseHeaderRoutes: true,
 					},
 				},
+				TLSRoutes: []TLSRoute{
+					{
+						Name:            mocks.TLSRouteName,
+						UseHeaderRoutes: true,
+					},
+				},
 			})
 		err := pluginInstance.SetWeight(rollout, desiredWeight, []v1alpha1.WeightDestination{})
 
@@ -163,6 +183,8 @@ func TestRunSuccessfully(t *testing.T) {
 		assert.Equal(t, desiredWeight, *(rpcPluginImp.UpdatedHTTPRouteMock.Spec.Rules[0].BackendRefs[1].Weight))
 		assert.Equal(t, 100-desiredWeight, *(rpcPluginImp.UpdatedTCPRouteMock.Spec.Rules[0].BackendRefs[0].Weight))
 		assert.Equal(t, desiredWeight, *(rpcPluginImp.UpdatedTCPRouteMock.Spec.Rules[0].BackendRefs[1].Weight))
+		assert.Equal(t, 100-desiredWeight, *(rpcPluginImp.UpdatedTLSRouteMock.Spec.Rules[0].BackendRefs[0].Weight))
+		assert.Equal(t, desiredWeight, *(rpcPluginImp.UpdatedTLSRouteMock.Spec.Rules[0].BackendRefs[1].Weight))
 	})
 	t.Run("SetHTTPHeaderRoute", func(t *testing.T) {
 		headerName := "X-Test"