feat: provide default application access data plane

conf/app.conf

@@ -27,3 +27,5 @@ helmImplicitLatestPullPolicy = false
 apiserverPort = 6443
 apiserverBind = 127.0.0.1
 dataDir       = /var/lib/casos
+ingressControllerEnabled = true
+serviceLBEnabled = true

controllers/ingress.go

@@ -18,14 +18,15 @@ type ingressRule struct {
 }
 
 type ingressSummary struct {
-	Namespace       string        `json:"namespace"`
-	Name            string        `json:"name"`
-	IngressClass    string        `json:"ingressClass"`
-	Rules           []ingressRule `json:"rules"`
-	TLSEnabled      bool          `json:"tlsEnabled"`
-	TLSSecretName   string        `json:"tlsSecretName"`
-	CreatedAt       string        `json:"createdAt"`
-	ResourceVersion string        `json:"resourceVersion"`
+	Namespace             string        `json:"namespace"`
+	Name                  string        `json:"name"`
+	IngressClass          string        `json:"ingressClass"`
+	Rules                 []ingressRule `json:"rules"`
+	TLSEnabled            bool          `json:"tlsEnabled"`
+	TLSSecretName         string        `json:"tlsSecretName"`
+	LoadBalancerAddresses []string      `json:"loadBalancerAddresses,omitempty"`
+	CreatedAt             string        `json:"createdAt"`
+	ResourceVersion       string        `json:"resourceVersion"`
 }
 
 func toIngressSummary(ing networkingv1.Ingress) ingressSummary {
@@ -65,15 +66,24 @@ func toIngressSummary(ing networkingv1.Ingress) ingressSummary {
 	if tlsEnabled {
 		tlsSecretName = ing.Spec.TLS[0].SecretName
 	}
+	loadBalancerAddresses := make([]string, 0, len(ing.Status.LoadBalancer.Ingress))
+	for _, address := range ing.Status.LoadBalancer.Ingress {
+		if address.IP != "" {
+			loadBalancerAddresses = append(loadBalancerAddresses, address.IP)
+		} else if address.Hostname != "" {
+			loadBalancerAddresses = append(loadBalancerAddresses, address.Hostname)
+		}
+	}
 	return ingressSummary{
-		Namespace:       ing.Namespace,
-		Name:            ing.Name,
-		IngressClass:    cls,
-		Rules:           rules,
-		TLSEnabled:      tlsEnabled,
-		TLSSecretName:   tlsSecretName,
-		CreatedAt:       ing.CreationTimestamp.UTC().Format("2006-01-02 15:04:05"),
-		ResourceVersion: ing.ResourceVersion,
+		Namespace:             ing.Namespace,
+		Name:                  ing.Name,
+		IngressClass:          cls,
+		Rules:                 rules,
+		TLSEnabled:            tlsEnabled,
+		TLSSecretName:         tlsSecretName,
+		LoadBalancerAddresses: loadBalancerAddresses,
+		CreatedAt:             ing.CreationTimestamp.UTC().Format("2006-01-02 15:04:05"),
+		ResourceVersion:       ing.ResourceVersion,
 	}
 }
 

controllers/service.go

@@ -20,14 +20,15 @@ type portSummary struct {
 }
 
 type serviceSummary struct {
-	Namespace       string            `json:"namespace"`
-	Name            string            `json:"name"`
-	Type            string            `json:"type"`
-	ClusterIP       string            `json:"clusterIP"`
-	Selector        map[string]string `json:"selector"`
-	Ports           []portSummary     `json:"ports"`
-	CreatedAt       string            `json:"createdAt"`
-	ResourceVersion string            `json:"resourceVersion"`
+	Namespace             string            `json:"namespace"`
+	Name                  string            `json:"name"`
+	Type                  string            `json:"type"`
+	ClusterIP             string            `json:"clusterIP"`
+	Selector              map[string]string `json:"selector"`
+	Ports                 []portSummary     `json:"ports"`
+	LoadBalancerAddresses []string          `json:"loadBalancerAddresses,omitempty"`
+	CreatedAt             string            `json:"createdAt"`
+	ResourceVersion       string            `json:"resourceVersion"`
 }
 
 func toSvcSummary(svc corev1.Service) serviceSummary {
@@ -41,15 +42,24 @@ func toSvcSummary(svc corev1.Service) serviceSummary {
 			NodePort:   p.NodePort,
 		})
 	}
+	loadBalancerAddresses := make([]string, 0, len(svc.Status.LoadBalancer.Ingress))
+	for _, ingress := range svc.Status.LoadBalancer.Ingress {
+		if ingress.IP != "" {
+			loadBalancerAddresses = append(loadBalancerAddresses, ingress.IP)
+		} else if ingress.Hostname != "" {
+			loadBalancerAddresses = append(loadBalancerAddresses, ingress.Hostname)
+		}
+	}
 	return serviceSummary{
-		Namespace:       svc.Namespace,
-		Name:            svc.Name,
-		Type:            string(svc.Spec.Type),
-		ClusterIP:       svc.Spec.ClusterIP,
-		Selector:        svc.Spec.Selector,
-		Ports:           ports,
-		CreatedAt:       svc.CreationTimestamp.UTC().Format("2006-01-02 15:04:05"),
-		ResourceVersion: svc.ResourceVersion,
+		Namespace:             svc.Namespace,
+		Name:                  svc.Name,
+		Type:                  string(svc.Spec.Type),
+		ClusterIP:             svc.Spec.ClusterIP,
+		Selector:              svc.Spec.Selector,
+		Ports:                 ports,
+		LoadBalancerAddresses: loadBalancerAddresses,
+		CreatedAt:             svc.CreationTimestamp.UTC().Format("2006-01-02 15:04:05"),
+		ResourceVersion:       svc.ResourceVersion,
 	}
 }
 

main.go

@@ -67,6 +67,11 @@ func main() {
 			if err := server.Bootstrap(ctx, adminCfg, srvCfg); err != nil {
 				logs.Warning("bootstrap: %v", err)
 			}
+			if srvCfg.ServiceLBEnabled {
+				if err := server.StartServiceLB(ctx, adminCfg); err != nil {
+					logs.Warning("start service load balancer: %v", err)
+				}
+			}
 			if err := server.StartScheduler(ctx, srvCfg); err != nil {
 				logs.Warning("start scheduler: %v", err)
 			}

server/apiserver.go

@@ -150,7 +150,7 @@ func buildApiserverArgs(cfg Config, certDir, etcdEndpoint, authzKubeconfig strin
 		"--service-cluster-ip-range=" + serviceClusterIPRange,
 		"--allow-privileged=true",
 		"--authorization-mode=" + authzMode(authzKubeconfig),
-		"--enable-admission-plugins=NodeRestriction,ValidatingAdmissionWebhook",
+		"--enable-admission-plugins=NodeRestriction,DefaultIngressClass,ValidatingAdmissionWebhook",
 		"--tls-cert-file=" + filepath.Join(certDir, "apiserver.crt"),
 		"--tls-private-key-file=" + filepath.Join(certDir, "apiserver.key"),
 		"--client-ca-file=" + filepath.Join(certDir, "ca.crt"),

server/bootstrap.go

@@ -16,8 +16,8 @@ import (
 	"k8s.io/client-go/rest"
 )
 
-// Bootstrap creates cluster-wide resources required for worker-node components
-// to function correctly. It is idempotent — safe to call on every startup.
+// Bootstrap creates CasOS-managed cluster add-ons. It is idempotent and safe
+// to call on every startup; individual add-ons can be disabled in config.
 func Bootstrap(ctx context.Context, cfg *rest.Config, srvCfg Config) error {
 	client, err := kubernetes.NewForConfig(cfg)
 	if err != nil {
@@ -32,6 +32,14 @@ func Bootstrap(ctx context.Context, cfg *rest.Config, srvCfg Config) error {
 	errs = append(errs, ensureNodeProxierBinding(ctx, client))
 	errs = append(errs, ensureFlannel(ctx, client, srvCfg))
 	errs = append(errs, ensureClusterDNS(ctx, client, srvCfg))
+	if srvCfg.IngressControllerEnabled {
+		errs = append(errs, ensureIngressController(ctx, client, srvCfg))
+	} else {
+		errs = append(errs, cleanupIngressController(ctx, client))
+	}
+	if !srvCfg.ServiceLBEnabled {
+		errs = append(errs, cleanupServiceLB(ctx, client))
+	}
 	if srvCfg.StorageProvisionerEnabled {
 		errs = append(errs, ensureDefaultStorageProvisioner(ctx, client, srvCfg))
 	}

server/config.go

@@ -23,7 +23,10 @@ type Config struct {
 	LocalPathHelperImage      string // helper pod image used by local-path-provisioner
 	FlannelImage              string // Flannel daemon image used by the built-in network bootstrap
 	FlannelCNIPluginImage     string // Flannel CNI plugin image installed on worker hosts
+	IngressControllerImage    string // Traefik image used by the built-in Ingress controller
 	StorageProvisionerEnabled bool   // install the built-in local-path provisioner for local clusters
+	IngressControllerEnabled  bool   // install the built-in Traefik controller
+	ServiceLBEnabled          bool   // run the built-in bare-metal LoadBalancer controller
 }
 
 // ConfigFromAppConf reads server config from the beego app.conf.
@@ -60,13 +63,16 @@ func ConfigFromAppConf() (Config, error) {
 	}
 
 	storageProvisionerEnabled := conf.GetConfigBoolDefault("storageProvisionerEnabled", true)
+	ingressControllerEnabled := conf.GetConfigBoolDefault("ingressControllerEnabled", false)
+	serviceLBEnabled := conf.GetConfigBoolDefault("serviceLBEnabled", false)
 	coreDNSImage := conf.GetConfigStringDefault("coreDNSImage", "docker.1ms.run/coredns/coredns:1.12.4")
 	localPathProvisionerImage := conf.GetConfigStringDefault("localPathProvisionerImage", "docker.1ms.run/rancher/local-path-provisioner:v0.0.32")
 	localPathHelperImage := conf.GetConfigStringDefault("localPathHelperImage", "docker.1ms.run/library/busybox:1.37.0")
 	flannelImage := conf.GetConfigStringDefault("flannelImage", defaultFlannelImage)
 	flannelCNIPluginImage := conf.GetConfigStringDefault("flannelCNIPluginImage", defaultFlannelCNIPluginImage)
+	ingressControllerImage := conf.GetConfigStringDefault("ingressControllerImage", defaultIngressControllerImage)
 
-	return Config{
+	config := Config{
 		DataDir:                   dataDir,
 		ApiserverBind:             bind,
 		AdvertiseAddress:          advertise,
@@ -80,8 +86,22 @@ func ConfigFromAppConf() (Config, error) {
 		LocalPathHelperImage:      localPathHelperImage,
 		FlannelImage:              flannelImage,
 		FlannelCNIPluginImage:     flannelCNIPluginImage,
+		IngressControllerImage:    ingressControllerImage,
 		StorageProvisionerEnabled: storageProvisionerEnabled,
-	}, nil
+		IngressControllerEnabled:  ingressControllerEnabled,
+		ServiceLBEnabled:          serviceLBEnabled,
+	}
+	if err := validateApplicationAccessConfig(config); err != nil {
+		return Config{}, err
+	}
+	return config, nil
+}
+
+func validateApplicationAccessConfig(config Config) error {
+	if config.IngressControllerEnabled && !config.ServiceLBEnabled {
+		return fmt.Errorf("ingressControllerEnabled requires serviceLBEnabled because the built-in Ingress Service uses LoadBalancerClass %q", serviceLBClass)
+	}
+	return nil
 }
 
 // injectDBName inserts dbName into a MySQL DSN of the form