Documentation
¶
Overview ¶
Package gatewayapi implements routing.RouteProvider on top of Gateway API resources on the tenant's regional cluster (ADR-0001).
Data path: the tenant Gateway terminates TLS for the tenant domain → HTTPRoute (hostname-matched) → mirror Service in the workspace namespace (same name + namespace as the child-cluster Service, no local endpoints) → Istio multi-cluster endpoint discovery carries traffic to the workspace pods on the child cluster.
The provider never mutates the Gateway — it only attaches routes. The Gateway, wildcard cert, DNS, and mesh wiring are admin-installed tenant infrastructure; when they are missing the provider reports routing.InfraNotReadyError.
Index ¶
Constants ¶
const ( // DefaultGatewayName is the well-known name of the tenant Gateway on the // regional cluster. The Gateway's HTTPS listener hostname is the single // source of truth for the tenant domain. DefaultGatewayName = "istio-ingressgateway" // DefaultGatewayNamespace is the well-known namespace of the tenant Gateway. DefaultGatewayNamespace = "istio-system" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
GatewayName string
GatewayNamespace string
// Mesh resolves the Istio mesh-enrollment labels stamped on the regional
// mirror namespace (from --workspace-mesh-mode). The mirror gets enrollment
// only — the per-child waypoint-routing labels are stamped on the child
// namespace alone (ADR-0005). The per-child waypoint Gateway itself is still
// validated on both clusters in EnsureRoutes.
Mesh routing.MeshConfig
}
Config locates the tenant Gateway by convention. Operator-level defaults, overridable via manager flags — deliberately NOT per-tenant config: the gateway location is an installation convention, the tenant domain is derived from the Gateway itself.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements routing.RouteProvider via Gateway API resources.
func New ¶
New returns a Gateway API route provider. Empty config fields fall back to the well-known defaults.
func (*Provider) CleanupRoutes ¶
CleanupRoutes implements routing.RouteProvider. Everything the provider creates lives in the workspace's mirror namespace on the regional cluster, so cleanup is namespace deletion. Cluster teardown counts as cleanup: a gone ClusterDeployment or unresolvable regional topology means there is nothing left to clean.
func (*Provider) EnsureRoutes ¶
func (p *Provider) EnsureRoutes(ctx context.Context, req routing.RouteRequest) ([]workspacesv1.AccessEntry, error)
EnsureRoutes implements routing.RouteProvider.
func (*Provider) SweepOrphans ¶
SweepOrphans implements routing.OrphanSweeper: it visits every regional cluster and removes workspace mirror namespaces (and their TCPRoutes, which are the port-allocation table) whose workspace no longer exists.
Unreachable regional clusters are logged and skipped — the sweep is a periodic backstop; the next run retries.
Source Files