Skip to content
This repository was archived by the owner on Mar 21, 2026. It is now read-only.

chore: validate gateway group sizes #328

Merged
Frostman merged 2 commits into from
Feb 26, 2026
Merged

chore: validate gateway group sizes #328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c4ad2c1
chore: validate gateway group sizes
edipascale Feb 25, 2026
1dc5066
chore: temp change to fabricator ref
edipascale Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ jobs:
matrix.upgradefrom == '' || contains(github.event.pull_request.labels.*.name, 'ci:-upgrade')
)
}}
fabricatorref: master
fabricatorref: ema/gw-validate-signature
Comment thread
edipascale marked this conversation as resolved.
prebuild: "just bump gateway ${{ needs.test-build.outputs.version }} ${{ needs.test-build.outputs.ref }}"
fabricmode: ${{ matrix.fabricmode }}
mesh: ${{ matrix.mesh }}
Expand Down
10 changes: 9 additions & 1 deletion api/gateway/v1alpha1/gateway_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"strconv"
"strings"

"go.githedgehog.com/gateway/api/meta"
kmetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
kclient "sigs.k8s.io/controller-runtime/pkg/client"
)
Expand Down Expand Up @@ -169,7 +170,7 @@ func (gw *Gateway) Default() {

var linuxIfaceNameRegex = regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9_.-]{0,8}[a-zA-Z0-9]$`)

func (gw *Gateway) Validate(ctx context.Context, kube kclient.Reader) error {
func (gw *Gateway) Validate(ctx context.Context, kube kclient.Reader, gwCfg *meta.GatewayCtrlConfig) error {
if gw.Namespace != kmetav1.NamespaceDefault {
return fmt.Errorf("gateway namespace must be %s: %w", kmetav1.NamespaceDefault, ErrInvalidGW)
}
Expand Down Expand Up @@ -357,6 +358,7 @@ func (gw *Gateway) Validate(ctx context.Context, kube kclient.Reader) error {
if kube != nil {
protocolIPs := map[netip.Addr]bool{}
vtepIPs := map[netip.Addr]bool{}
gwGroupMembers := map[string]int{}
gateways := &GatewayList{}
if err := kube.List(ctx, gateways); err != nil {
return fmt.Errorf("listing gateways: %w", err)
Expand All @@ -376,6 +378,9 @@ func (gw *Gateway) Validate(ctx context.Context, kube kclient.Reader) error {
vtepIPs[ip.Addr()] = true
}
}
for _, group := range other.Spec.Groups {
gwGroupMembers[group.Name]++
}
}
if _, exist := protocolIPs[protoIP.Addr()]; exist {
return fmt.Errorf("gateway %s protocol IP %s is already in use: %w", gw.Name, protoIP, ErrInvalidGW)
Expand All @@ -396,6 +401,9 @@ func (gw *Gateway) Validate(ctx context.Context, kube kclient.Reader) error {
if !gwGroups[gwGroup.Name] {
return fmt.Errorf("gateway group %s not found: %w", gwGroup.Name, ErrInvalidGW)
}
if gwCfg != nil && len(gwCfg.Communities) > 0 && gwGroupMembers[gwGroup.Name] >= len(gwCfg.Communities) {
return fmt.Errorf("gateway group %s already has too many members (%d), max is %d: %w", gwGroup.Name, gwGroupMembers[gwGroup.Name], len(gwCfg.Communities), ErrInvalidGW)
}
}
}

Expand Down
43 changes: 42 additions & 1 deletion api/gateway/v1alpha1/gateway_types_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.githedgehog.com/gateway/api/gateway/v1alpha1"
"go.githedgehog.com/gateway/api/meta"
kmetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
runtime "k8s.io/apimachinery/pkg/runtime"
kclient "sigs.k8s.io/controller-runtime/pkg/client"
Expand Down Expand Up @@ -212,10 +213,50 @@ func TestGatewayValidate(t *testing.T) {
objs: base,
err: v1alpha1.ErrInvalidGW,
},
{
name: "test-too-many-gws-in-group",
gw: *gwa("gw-1", func(gw *v1alpha1.Gateway) {
gw.Spec.Groups = []v1alpha1.GatewayGroupMembership{{Name: "gr1", Priority: 0}}
}),
objs: withObjs(base,
withName("gr1", &v1alpha1.GatewayGroup{}),
withName("gw-3", &v1alpha1.Gateway{
Spec: v1alpha1.GatewaySpec{
Groups: []v1alpha1.GatewayGroupMembership{{Name: "gr1", Priority: 1}},
},
}),
withName("gw-4", &v1alpha1.Gateway{
Spec: v1alpha1.GatewaySpec{
Groups: []v1alpha1.GatewayGroupMembership{{Name: "gr1", Priority: 2}},
},
}),
),
err: v1alpha1.ErrInvalidGW,
},
{
name: "test-fits-in-gw-group",
gw: *gwa("gw-1", func(gw *v1alpha1.Gateway) {
gw.Spec.Groups = []v1alpha1.GatewayGroupMembership{{Name: "gr1", Priority: 0}}
}),
objs: withObjs(base,
withName("gr1", &v1alpha1.GatewayGroup{}),
withName("gw-3", &v1alpha1.Gateway{
Spec: v1alpha1.GatewaySpec{
Groups: []v1alpha1.GatewayGroupMembership{{Name: "gr1", Priority: 1}},
},
}),
),
},
}

scheme := runtime.NewScheme()
require.NoError(t, v1alpha1.AddToScheme(scheme), "should add gateway API to scheme")
cfg := &meta.GatewayCtrlConfig{
Communities: map[uint32]string{
0: "50000:1000",
1: "50000:1001",
},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand All @@ -227,7 +268,7 @@ func TestGatewayValidate(t *testing.T) {
Build()

tt.gw.Default()
actual := tt.gw.Validate(ctx, kube)
actual := tt.gw.Validate(ctx, kube, cfg)
assert.ErrorIs(t, actual, tt.err, "validate should return expected error")
})
}
Expand Down
2 changes: 1 addition & 1 deletion cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ func run() error {
}

// Webhooks
if err := ctrl.SetupGatewayWebhookWith(mgr); err != nil {
if err := ctrl.SetupGatewayWebhookWith(mgr, cfg); err != nil {
return fmt.Errorf("setting up gateway webhook: %w", err)
}
if err := ctrl.SetupGatewayGroupWebhookWith(mgr); err != nil {
Expand Down
9 changes: 6 additions & 3 deletions pkg/ctrl/gateway_wh.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,18 +12,21 @@ import (
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"

gwapi "go.githedgehog.com/gateway/api/gateway/v1alpha1"
"go.githedgehog.com/gateway/api/meta"
)

// +kubebuilder:webhook:path=/mutate-gateway-githedgehog-com-v1alpha1-gateway,mutating=true,failurePolicy=fail,sideEffects=None,groups=gateway.githedgehog.com,resources=gateways,verbs=create;update;delete,versions=v1alpha1,name=mgateway.kb.io,admissionReviewVersions=v1
// +kubebuilder:webhook:path=/validate-gateway-githedgehog-com-v1alpha1-gateway,mutating=false,failurePolicy=fail,sideEffects=None,groups=gateway.githedgehog.com,resources=gateways,verbs=create;update;delete,versions=v1alpha1,name=vgateway.kb.io,admissionReviewVersions=v1

type GatewayWebhook struct {
kclient.Reader
Cfg *meta.GatewayCtrlConfig
}

func SetupGatewayWebhookWith(mgr kctrl.Manager) error {
func SetupGatewayWebhookWith(mgr kctrl.Manager, cfg *meta.GatewayCtrlConfig) error {
w := &GatewayWebhook{
Reader: mgr.GetClient(),
Cfg: cfg,
}

if err := kctrl.NewWebhookManagedBy(mgr, &gwapi.Gateway{}).
Expand All @@ -43,12 +46,12 @@ func (w *GatewayWebhook) Default(_ context.Context, obj *gwapi.Gateway) error {
}

func (w *GatewayWebhook) ValidateCreate(ctx context.Context, gw *gwapi.Gateway) (admission.Warnings, error) {
return nil, gw.Validate(ctx, w.Reader) //nolint:wrapcheck
return nil, gw.Validate(ctx, w.Reader, w.Cfg) //nolint:wrapcheck
}

func (w *GatewayWebhook) ValidateUpdate(ctx context.Context, _ *gwapi.Gateway, newGw *gwapi.Gateway) (admission.Warnings, error) {
// TODO validate diff between oldObj and newObj if needed
return nil, newGw.Validate(ctx, w.Reader) //nolint:wrapcheck
return nil, newGw.Validate(ctx, w.Reader, w.Cfg) //nolint:wrapcheck
}

func (w *GatewayWebhook) ValidateDelete(_ context.Context, _ *gwapi.Gateway) (admission.Warnings, error) {
Expand Down