tree

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 9, 2026 License: Apache-2.0 Imports: 43 Imported by: 0

Documentation

Overview

Copyright 2025 HAProxy Technologies LLC

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

Constants

View Source 
const (

	// OwnerKindGateway and OwnerKindListenerSet are the values a Listener's OwnerKind
	// carries. Exported because a consumer of a listener -- the HAProxy apply feedback
	// that stamps Programmed, for one -- has to name the resource that declares it.
	OwnerKindGateway     = kindGateway
	OwnerKindListenerSet = kindListenerSet
)

The kinds that can declare a listener. They name the "from" side of a ReferenceGrant, so they are the API's spelling and not ours: a grant is matched on this string.

View Source 
const (
	CONTROLLER = "haproxy.org/ingress-controller"
)

Variables

View Source 
var (
	SupportedGatewayAPIBundleVersion = SupportedVersions{"v1.7"}
	SupportedParametersRefKind       = gatewayv1.Kind("HugGate")
	SupportedParametersRefGroup      = gatewayv1.Group("gate.v3.haproxy.org")
)

Functions

func GetBackendRefNamespacedName 

func GetBackendRefNamespacedName(backendRef gatewayv1.BackendObjectReference, defaultNamespace string) types.NamespacedName

GetBackendRefNamespacedName returns the namespaced name for a backendref reference, using the Route's namespace as a default if the reference does not specify one.

func GetCertificateRefNamespacedName 

func GetCertificateRefNamespacedName(certRef gatewayv1.SecretObjectReference, ownerNamespace string) types.NamespacedName

GetCertificateRefNamespacedName returns the namespaced name a certificate reference denotes, resolving it in ownerNamespace when the reference does not name one.

ownerNamespace is the namespace of the resource that declares the listener holding the reference -- the Gateway for one of its own listeners, the ListenerSet for an entry it contributes. It is not the Gateway's namespace in general: a reference is relative to the document it appears in.

func GetParentRefNamespacedName 

func GetParentRefNamespacedName(parentRef gatewayv1.ParentReference, defaultNamespace string) types.NamespacedName

GetParentRefNamespacedName returns the namespaced name for a parentRef reference, using the Route's namespace as a default if the reference does not specify one.

func GetParentRefNamespacedNameFromResource added in v0.8.0 

func GetParentRefNamespacedNameFromResource(parentRef gatewayv1.ParentReference, resourceNamespace string) types.NamespacedName

func ReferenceGrantCovers added in v1.1.0 

func ReferenceGrantCovers(referenceGrant *gatewayv1beta1.ReferenceGrant, from GrantFrom, to GrantTo) bool

ReferenceGrantCovers reports whether a single ReferenceGrant, from its spec alone, permits the given reference. It is the stateless half of IsAccessGranted: it reads no resolved map, so an enqueue edge can filter on exactly the shape the manager is built from -- referenceGrantTos/referenceGrantFroms are shared with UpsertReferenceGrant -- rather than keeping a second, drift-prone copy of it.

A same-namespace reference is not "covered": it needs no grant at all, so a grant appearing or disappearing cannot be its cause.

func ServiceNsNameKey 

func ServiceNsNameKey(routeNs string, backendRef gatewayv1.BackendObjectReference) client.ObjectKey

ServiceNsNameKey returns the service Ns/Name If the backendRef namespace is empty or nil, fills with the Route Namesapce

func ServiceNsNameKeyTlSRoute added in v0.8.0 

func ServiceNsNameKeyTlSRoute(tlsRoute *v1alpha2.TLSRoute, backendRef gatewayv1.BackendObjectReference) client.ObjectKey

ServiceNsNameKey returns the service Ns/Name If the backendRef namespace is empty or nil, fills with the Route Namesapce

Types

type AttachedRoutes 

type AttachedRoutes map[types.NamespacedName]struct{} // map[routeKey]

AttachedRoutes is a map from a route's NamespacedName to a placeholder struct.

func (AttachedRoutes) MarshalJSON 

func (m AttachedRoutes) MarshalJSON() ([]byte, error)

MarshalJSON implements the json.Marshaler interface for AttachedRoutes.

func (*AttachedRoutes) UnmarshalJSON 

func (m *AttachedRoutes) UnmarshalJSON(data []byte) error

UnmarshalJSON implements the json.Unmarshaler interface for AttachedRoutes.

type Builder 

type Builder interface {
	ComputeTreeUpdates()
	CleanTreeUpdates()
}

func NewCertificateBuilder 

func NewCertificateBuilder(controllerStore *ControllerStore, storeCertOnDisk, runtimeUpdate bool, certStorage storage.CertificateStorage) Builder

func NewGatewayBuilder 

func NewGatewayBuilder(params GatewayBuilderParams) Builder

func NewGatewayClassBuilder 

func NewGatewayClassBuilder(params GatewayClassBuilderParams) Builder

func NewHTTPRouteBuilder 

func NewHTTPRouteBuilder(params HTTPRouteBuilderParams) Builder

func NewIngressBuilder added in v1.1.0 

func NewIngressBuilder(controllerStore *ControllerStore) Builder

func NewListenerSetContributionBuilder added in v1.1.0 

func NewListenerSetContributionBuilder(controllerStore *ControllerStore) Builder

func NewListenerSetVerdictBuilder added in v1.1.0 

func NewListenerSetVerdictBuilder(controllerStore *ControllerStore) Builder

func NewReferenceGrantBuilder added in v1.0.3 

func NewReferenceGrantBuilder(controllerStore *ControllerStore, referenceGrantManager *ReferenceGrantManager) Builder

func NewSecretBuilder 

func NewSecretBuilder(controllerStore *ControllerStore) Builder

func NewServiceBuilder 

func NewServiceBuilder(controllerStore *ControllerStore) Builder

func NewSyntheticGatewayBuilder added in v1.1.0 

func NewSyntheticGatewayBuilder(controllerStore *ControllerStore) Builder

func NewTCPRouteBuilder added in v1.1.0 

func NewTCPRouteBuilder(params TCPRouteBuilderParams) Builder

func NewTLSRouteBuilder added in v0.8.0 

func NewTLSRouteBuilder(params TLSRouteBuilderParams) Builder

func NewVirtualListenerBuilder added in v0.9.0 

func NewVirtualListenerBuilder(controllerStore *ControllerStore) Builder

type CertUpdates 

type CertUpdates struct {
	Created map[string]certificate.CertificateData
	Updated map[string]certificate.CertificateData
	Deleted map[string]certificate.CertificateData
}

type CertificateBuilderImpl 

type CertificateBuilderImpl struct {
	*ControllerStore
	// contains filtered or unexported fields
}

func (*CertificateBuilderImpl) CleanTreeUpdates 

func (*CertificateBuilderImpl) CleanTreeUpdates()

func (*CertificateBuilderImpl) ComputeTreeUpdates 

func (b *CertificateBuilderImpl) ComputeTreeUpdates()

type CheckResult 

type CheckResult struct {
	Conditions generic.Conditions
	// If Valid = true, then Conditions should be empty
	// If Valid = false:
	// - Conditions are set if there is an invalid check
	// - Conditions is empty if the check does not make sense (for example no listener status for an invalid Gateway)
	Valid bool
}

type CheckResultRoute 

type CheckResultRoute struct {
	Conditions rc.RouteConditions
	// If Valid = true, then Conditions should be empty
	// If Valid = false:
	// - Conditions are set if there is an invalid check
	// - Conditions is empty if the check does not make sense (for example no listener status for an invalid Gateway)
	Valid   bool
	Managed bool
}

type ControllerStore 

type ControllerStore struct {
	ClusterStore      *store.ClusterStore
	GateTree          *GateTree
	UnmanagedGateTree *GateTree
	ReferencedObjects *ReferencedObjects
	// A Map of installed GwApi CRDs versions
	InstalledGwAPIVersions *InstalledVersions
	Logger                 *slog.Logger
	ExtractGVK             utilsk8s.ExtractGVK
	CertUpdates            *CertUpdates
	CrtListUpdates         *CrtListUpdates
	// ReferenceGrantManager is the shared, per-cycle-refreshed grant index. It is
	// set once by handler.NewGateTreeBuilder and read by consumers that need to
	// validate cross-namespace references outside the tree builders (e.g. the
	// Service-level Backend CR merge in the HAProxy config manager).
	ReferenceGrantManager *ReferenceGrantManager
	// PortBinder reports whether the controller process can bind to a given
	// port — derived from CAP_NET_BIND_SERVICE and the netns sysctl.
	PortBinder caps.PortBinder

	// from config
	ControllerName string
	// IngressClass is the value of --ingress.class used to select managed Ingresses.
	IngressClass string
	// EmptyIngressClass, when IngressClass is set, also selects classless Ingresses.
	EmptyIngressClass bool
	// HTTPIngressFrontendPort is the listening port of the HTTP listener of the
	// synthetic Ingress gateway.
	HTTPIngressFrontendPort int
	// HTTPSIngressFrontendPort is the listening port of the HTTPS listener of the
	// synthetic Ingress gateway.
	HTTPSIngressFrontendPort int
	// contains filtered or unexported fields
}

func (*ControllerStore) CheckGatewayClassExists 

func (b *ControllerStore) CheckGatewayClassExists(gwcName string) bool

func (*ControllerStore) CleanInstalledVersionsUpdates 

func (b *ControllerStore) CleanInstalledVersionsUpdates()

func (*ControllerStore) GetGatewayForListener added in v0.9.0 

func (b *ControllerStore) GetGatewayForListener(listener *Listener) *Gateway

GetGatewayForListener returns the Gateway this listener is served on, or nil if the tree does not hold it.

The Gateway comes from the listener's key, which carries it whatever declared the listener. It is deliberately not the listener's owner: a listener contributed by a ListenerSet belongs to that ListenerSet and is served on the Gateway it attaches to, and the two are different objects.

func (*ControllerStore) IsIngressEligible added in v1.1.0 

func (b *ControllerStore) IsIngressEligible(ingress *networkingv1.Ingress) bool

IsIngressEligible reports whether this controller instance handles the Ingress, following the IngressClass eligibility rules. It is exported so consumers outside the tree package (e.g. the Ingress LoadBalancer status update) can decide which Ingresses to advertise controller addresses on.

func (*ControllerStore) OwnerK8sResource added in v1.1.0 

func (b *ControllerStore) OwnerK8sResource(listener *Listener) client.Object

OwnerK8sResource returns the API object that declares this listener: the ListenerSet whose entry it is, or the Gateway that declares it itself. It is where everything owned by the declaring resource is read from -- its generation, first of all, which a listener's own payload does not carry.

func (*ControllerStore) ResetCertificateUpdates 

func (b *ControllerStore) ResetCertificateUpdates()

func (*ControllerStore) ResetCrtListUpdates 

func (b *ControllerStore) ResetCrtListUpdates()

type CrtListUpdates 

type CrtListUpdates struct {
	Created map[string]certificate.CrtListData
	Updated map[string]certificate.CrtListData
	Deleted map[string]certificate.CrtListData
}

type DefaultsCR added in v0.9.1 

type DefaultsCR struct {
	// K8sResource is the source resource.
	K8sResource *v3.Defaults
	// TreeStatus
	TreeStatus TreeUpdate[DefaultsCR]
}

A DefaultsCR represents a Kubernetes Defaults CR

func NewDefaultsCR added in v0.9.1 

func NewDefaultsCR(k8sObject *v3.Defaults) *DefaultsCR

NewDefaultsCR creates a new DefaultsCR for the GateTree.

func (*DefaultsCR) DeepCopy added in v0.9.1 

func (s *DefaultsCR) DeepCopy() *DefaultsCR

DeepCopy creates a deep copy of the DefaultsCR.

func (*DefaultsCR) GetTreeStatus added in v0.9.1 

func (s *DefaultsCR) GetTreeStatus() *TreeUpdate[DefaultsCR]

GetTreeStatus returns the TreeStatus of the DefaultsCR.

func (*DefaultsCR) SetAsDeleted added in v0.9.1 

func (s *DefaultsCR) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the Defaults CR as deleted in the GateTree.

func (*DefaultsCR) SetAsUpserted added in v0.9.1 

func (s *DefaultsCR) SetAsUpserted(logger *slog.Logger, newK8sResource *v3.Defaults)

SetAsUpserted marks the Defaults CR as upserted in the GateTree.

func (*DefaultsCR) SetTreeStatus added in v0.9.1 

func (s *DefaultsCR) SetTreeStatus(treeStatus TreeUpdate[DefaultsCR])

SetTreeStatus sets the TreeStatus of the DefaultsCR.

type DefaultsCRBuilder added in v0.9.1 

type DefaultsCRBuilder struct {
	*ControllerStore
}

DefaultsCRBuilder processes Defaults CR updates and maintains the Defaults node in the GateTree. Only the Defaults CR whose spec.name equals "haproxytech" is managed; CRs with any other spec.name are discarded with a warning log.

func NewDefaultsCRBuilder added in v0.9.1 

func NewDefaultsCRBuilder(controllerStore *ControllerStore) *DefaultsCRBuilder

func (*DefaultsCRBuilder) CleanTreeUpdates added in v0.9.1 

func (b *DefaultsCRBuilder) CleanTreeUpdates()

func (*DefaultsCRBuilder) ComputeTreeUpdates added in v0.9.1 

func (b *DefaultsCRBuilder) ComputeTreeUpdates()

type GateBuilderImpl 

type GateBuilderImpl struct {
	*ControllerStore
}

func NewGateBuilder 

func NewGateBuilder(params *ControllerStore) *GateBuilderImpl

func (*GateBuilderImpl) BuildStatus 

func (*GateBuilderImpl) BuildStatus()

type GateTree 

type GateTree struct {
	// GatewayClasses holds the GatewayClasses resource that are accepted and ignored
	GatewayClasses           map[types.NamespacedName]*GatewayClass
	Gateways                 map[types.NamespacedName]*Gateway
	Secrets                  map[types.NamespacedName]*Secret
	HTTPRoutes               map[types.NamespacedName]*HTTPRoute
	TLSRoutes                map[types.NamespacedName]*TLSRoute
	TCPRoutes                map[types.NamespacedName]*TCPRoute
	Services                 map[types.NamespacedName]*Service
	VirtualListeners         map[string]*VirtualListener // map[virtualListener.name()]VirtualListener
	PreviousVirtualListeners map[string]*VirtualListener // map[virtualListener.name()]VirtualListener
	Global                   *Global
	Defaults                 *DefaultsCR
	ReferenceGrants          map[types.NamespacedName]*ReferenceGrant
	// ListenerSets holds the ListenerSets of the cluster. Their listeners are not
	// here: each is contributed to the merged list of its parent Gateway.
	ListenerSets map[types.NamespacedName]*ListenerSet
	// contains filtered or unexported fields
}

GateTree is a Graph-like representation of Gateway API resources.

func NewGateTree 

func NewGateTree() *GateTree

func (*GateTree) RLockFeedbackView added in v1.1.0 

func (t *GateTree) RLockFeedbackView() (map[types.NamespacedName]*Gateway, map[types.NamespacedName]*ListenerSet)

RLockFeedbackView acquires a read lock on the GateTree and returns the collections the apply feedback resolves its observed owners against. The caller must call RUnlockFeedbackView when done reading.

Both maps under one lock: taking a second read lock while the first is held can deadlock against a waiting writer, so the pair comes back together.

func (*GateTree) RUnlockFeedbackView added in v1.1.0 

func (t *GateTree) RUnlockFeedbackView()

RUnlockFeedbackView releases the read lock acquired by RLockFeedbackView.

func (*GateTree) UpdateListenerProgrammedConditions added in v1.1.0 

func (t *GateTree) UpdateListenerProgrammedConditions(logger *slog.Logger, observed ObservedGenerations, applyErr error)

UpdateListenerProgrammedConditions stamps the Programmed condition of every listener whose declaring resource was programmed in this apply cycle, with the generation of that resource.

Each listener answers to the resource that declares it -- the Gateway for its own listeners, the ListenerSet for the entries it contributed. The generation to report, and the one the staleness guard compares, is therefore the owner's: a ListenerSet and its parent Gateway have unrelated generation counters, and stamping an entry with the Gateway's would publish an observedGeneration belonging to a resource that does not carry the condition.

Thread-safe: acquires the GateTree write lock.

It takes a logger because it is the one condition writer with nowhere to put a failure: it either writes the Programmed condition or leaves the previous one alone, so a problem building that condition would otherwise leave no trace at all.

type Gateway 

type Gateway struct {
	// K8sResource is the source resource.
	K8sResource *gatewayv1.Gateway
	// Conditions include Conditions for the Gateway.
	// HugGate is a merge between the ParamsRef from GatewayClass and the one from Gateway
	// If it is invalid at GatewayClass level, it is ignored and overridden by the one at Gateway level.
	HugGate *v3.HugGate
	// Final Conditions
	Conditions generic.Conditions
	// TreeStatus
	TreeStatus TreeUpdate[Gateway]
	// Management Checks
	CheckParamsRef         CheckResult
	CheckValidGatewayClass CheckResult
	// Additional checks
	CheckConflict CheckResult
	// Listeners is the merged listener list of this Gateway, in precedence order:
	// the listeners the Gateway declares itself, in spec order, then the entries
	// contributed by attached ListenerSets.
	//
	// Not a map keyed by the bare name: a listener name is unique only within the
	// resource declaring it. The Gateway API explicitly allows the same name on a
	// Gateway and on its ListenerSets, and on sibling ListenerSets, so such a map
	// would collapse the homonyms -- the last of the consequences the structured
	// listenerKey was introduced to remove.
	//
	// Not a map keyed by listenerKey either, which would fix the collapse but not
	// the order, and the order is load-bearing: conflict detection gives a port to
	// the first listener claiming it, so a map would make that verdict depend on
	// Go's iteration order, hence on a hash seed.
	//
	// And not a map beside a slice, which would have both properties at the price of
	// an invariant -- "the two hold the same elements" -- maintained procedurally and
	// verified nowhere. That is the shape of defect this package has been removing:
	// one field read as two things, a flag doubling a reason, a table whose totality
	// two writers maintained between them.
	//
	// So a slice, and lookups that scan it. The list is bounded and small: the API
	// caps a Gateway's own listeners at 64, and TooManyListeners exists because the
	// merged total has to be capped as well. A scan runs once per route or per
	// verdict, never per request. If it ever measured, the escape is an index
	// derived from this list once per cycle -- one writer, nothing to keep in sync --
	// rather than a second source of truth.
	Listeners []*Listener
	// AttachedListenerSets is the number of ListenerSets that attached to this
	// Gateway and were accepted -- what Gateway.status.attachedListenerSets must
	// report.
	//
	// Recomputed tree-wide every cycle by the ListenerSet verdict builder, because
	// the count is a roll-up of a policy (the Gateway's allowedListeners), of each
	// ListenerSet's attachment and of each ListenerSet's own acceptance: it is the
	// end of the evaluation chain Gateway -> ListenerSet -> count, and clearing it
	// before the roll-up is what keeps a ListenerSet deleted in this cycle out of it.
	AttachedListenerSets int32
	// Valid shows whether the Gateway is valid.
	Valid bool
	// Ingress Frontend equivalent
	GatewayForIngress bool
}

Gateway represents the Gateway resource.

func NewGateway 

func NewGateway(k8sObject *gatewayv1.Gateway) *Gateway

func (*Gateway) BuildConditions 

func (g *Gateway) BuildConditions()

func (*Gateway) ContributedListenerByName added in v1.1.0 

func (g *Gateway) ContributedListenerByName(parentKey client.ObjectKey, name gatewayv1.SectionName) *Listener

ContributedListenerByName resolves a listener a listenerSet has contributed and declared **itself**, by the name a sectionName would use.

func (*Gateway) ContributedListeners added in v1.1.0 

func (g *Gateway) ContributedListeners(parentKey client.ObjectKey) []*Listener

ContributedListeners are the listeners a ListenerSet has contributed and declared **itself**, by the parentRef naming the ListenerSet.

func (*Gateway) DeepCopy 

func (g *Gateway) DeepCopy() *Gateway

func (*Gateway) GetCreationTimestamp added in v0.9.0 

func (g *Gateway) GetCreationTimestamp() metav1.Time

func (*Gateway) GetK8sResource 

func (g *Gateway) GetK8sResource() *gatewayv1.Gateway

func (*Gateway) GetName added in v0.9.0 

func (g *Gateway) GetName() string

GetName returns the name of the Gateway Kubernetes resource. If the K8sResource is nil (for example a DELETED Gateway), it returns an empty string.

func (*Gateway) GetNamespace added in v1.1.0 

func (g *Gateway) GetNamespace() string

GetNamespace returns the namespace of the Gateway Kubernetes resource. If the K8sResource is nil (for example a DELETED Gateway), it returns an empty string. Note that an empty namespace is legitimate here: the synthetic Ingress Gateway has one.

func (*Gateway) GetTreeStatus 

func (g *Gateway) GetTreeStatus() *TreeUpdate[Gateway]

GetTreeStatus returns the TreeStatus of the Gateway.

func (*Gateway) OwnListenerByName added in v1.1.0 

func (g *Gateway) OwnListenerByName(name gatewayv1.SectionName) *Listener

OwnListenerByName resolves a listener the Gateway declares **itself**, by the name a sectionName would use.

Deliberately blind to the entries contributed by ListenerSets: a parentRef naming this Gateway with a sectionName that exists only on one of its ListenerSets must not attach -- reaching such a listener requires naming the ListenerSet as parent. The Gateway API gives that exact case as a counter-example, and resolving it here by bare name over the whole merged list is how an implementation gets it wrong.

func (*Gateway) OwnListeners added in v1.1.0 

func (g *Gateway) OwnListeners() []*Listener

OwnListeners are the listeners this Gateway declares itself, without the entries contributed by attached ListenerSets.

This is the list a parentRef naming the Gateway attaches to. The Gateway API is explicit that a route reaches a ListenerSet's listeners "by specifying it as a parentRef": the parent named is the resource whose listeners are candidates, and reaching both a Gateway and one of its ListenerSets takes two parentRefs. The same asymmetry is what makes the API's own counter-example hold -- a Gateway parentRef carrying a sectionName that exists only on a ListenerSet must not attach.

Filtered by origin rather than taken as the leading run of the merged list: the order is a contract for precedence, not a promise that own listeners come first for ever.

func (*Gateway) SetAsDeleted 

func (g *Gateway) SetAsDeleted(logger *slog.Logger, oldK8sResource *gatewayv1.Gateway)

func (*Gateway) SetAsManaged 

func (g *Gateway) SetAsManaged(logger *slog.Logger, cs ControllerStore)

func (*Gateway) SetAsUnmanaged 

func (g *Gateway) SetAsUnmanaged(logger *slog.Logger, cs ControllerStore)

func (*Gateway) SetAsUpserted 

func (g *Gateway) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1.Gateway)

func (*Gateway) SetTreeStatus 

func (g *Gateway) SetTreeStatus(treeStatus TreeUpdate[Gateway])

SetTreeStatus sets the TreeStatus of the Gateway.

type GatewayBuilderImpl 

type GatewayBuilderImpl struct {
	// certStorage storage.CertificateStorage
	*ControllerStore
	// contains filtered or unexported fields
}

func (*GatewayBuilderImpl) CleanTreeUpdates 

func (b *GatewayBuilderImpl) CleanTreeUpdates()

func (*GatewayBuilderImpl) ComputeTreeUpdates 

func (b *GatewayBuilderImpl) ComputeTreeUpdates()

type GatewayBuilderParams 

type GatewayBuilderParams struct {
	// storage.CertificateStorage
	*ControllerStore
	*ReferenceGrantManager
}

type GatewayClass 

type GatewayClass struct {
	// TreeStatus
	TreeStatus TreeUpdate[GatewayClass]
	// K8sResource is the source resource.
	K8sResource *gatewayv1.GatewayClass
	// HugGate is the linked HugGate from ParamsRef
	HugGate *v3.HugGate
	// Conditions include Conditions for the GatewayClass.
	Conditions generic.Conditions
	// CheckParamsRef shows whether the GatewayClass is valid as for ParamsRef
	CheckParamsRef CheckResult
	// Valid is true if the GatewayClass is Valid (versions + haproxy gate paramsRef)
	Valid bool
	// Managed is true if the GatewayClass is Managed (should be always true)
	Managed bool
}

GatewayClass represents the GatewayClass resource.

func NewGatewayClass 

func NewGatewayClass(k8sObject *gatewayv1.GatewayClass) *GatewayClass

func (*GatewayClass) BuildConditions 

func (g *GatewayClass) BuildConditions(controllerStore ControllerStore)

func (*GatewayClass) DeepCopy 

func (g *GatewayClass) DeepCopy() *GatewayClass

func (*GatewayClass) GetCreationTimestamp 

func (g *GatewayClass) GetCreationTimestamp() metav1.Time

func (*GatewayClass) GetName 

func (g *GatewayClass) GetName() string

GetName returns the name of the GatewayClass Kubernetes resource. If the K8sResource is nil (for example a DELETED GatewayClass), it returns an empty string.

func (*GatewayClass) GetNamespace added in v1.1.0 

func (g *GatewayClass) GetNamespace() string

GetNamespace satisfies utils.ObjectWithTimestamp. A GatewayClass is cluster-scoped, so this is always empty; it is defined so that the sort tie-break has a uniform key across resource kinds.

func (*GatewayClass) GetTreeStatus 

func (g *GatewayClass) GetTreeStatus() *TreeUpdate[GatewayClass]

GetTreeStatus returns the TreeStatus of the GatewayClass.

func (*GatewayClass) ResetChecks 

func (g *GatewayClass) ResetChecks()

func (*GatewayClass) SetAsDeleted 

func (g *GatewayClass) SetAsDeleted(logger *slog.Logger)

func (*GatewayClass) SetAsManaged 

func (g *GatewayClass) SetAsManaged(logger *slog.Logger, controllerStore ControllerStore)

func (*GatewayClass) SetAsUnmanaged 

func (g *GatewayClass) SetAsUnmanaged(logger *slog.Logger, controllerStore ControllerStore)

func (*GatewayClass) SetAsUpserted 

func (g *GatewayClass) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1.GatewayClass)

func (*GatewayClass) SetTreeStatus 

func (g *GatewayClass) SetTreeStatus(treeStatus TreeUpdate[GatewayClass])

SetTreeStatus sets the TreeStatus of the GatewayClass.

func (*GatewayClass) UpdateManaged added in v1.1.0 

func (g *GatewayClass) UpdateManaged(controllerName string)

UpdateManaged recomputes whether this GatewayClass is one this controller serves, from the only field that says so: its controllerName.

It runs on every update because the answer changes: a class another controller wrote can be repointed at us, and one of ours can be handed to another controller. Managed used to be set once, when the tree entry was built, and never revisited -- so a class handed over kept its entry in the managed tree, CheckGatewayClassExists kept answering true for its Gateways, and they went on being served here while their class belonged to someone else. The two directions were not even symmetric: the other way round worked, because that is when the tree entry is created.

type GatewayClassBuilderImpl 

type GatewayClassBuilderImpl struct {
	*ControllerStore
}

func (*GatewayClassBuilderImpl) CleanTreeUpdates 

func (b *GatewayClassBuilderImpl) CleanTreeUpdates()

func (*GatewayClassBuilderImpl) ComputeTreeUpdates 

func (b *GatewayClassBuilderImpl) ComputeTreeUpdates()

type GatewayClassBuilderParams 

type GatewayClassBuilderParams struct {
	*ControllerStore
}

type Global added in v0.9.1 

type Global struct {
	// K8sResource is the source resource.
	K8sResource *v3.Global
	// TreeStatus
	TreeStatus TreeUpdate[Global]
}

A Global represents a Kubernetes Global CR

func NewGlobal added in v0.9.1 

func NewGlobal(k8sObject *v3.Global) *Global

NewGlobal creates a new Global for the GateTree.

func (*Global) DeepCopy added in v0.9.1 

func (s *Global) DeepCopy() *Global

DeepCopy creates a deep copy of the Global.

func (*Global) GetTreeStatus added in v0.9.1 

func (s *Global) GetTreeStatus() *TreeUpdate[Global]

GetTreeStatus returns the TreeStatus of the Global.

func (*Global) SetAsDeleted added in v0.9.1 

func (s *Global) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the Global as deleted in the GateTree.

func (*Global) SetAsUpserted added in v0.9.1 

func (s *Global) SetAsUpserted(logger *slog.Logger, newK8sResource *v3.Global)

SetAsUpserted marks the Global CR as upserted in the GateTree.

func (*Global) SetTreeStatus added in v0.9.1 

func (s *Global) SetTreeStatus(treeStatus TreeUpdate[Global])

SetTreeStatus sets the TreeStatus of the Global.

type GrantFrom added in v1.0.3 

type GrantFrom struct {
	Group     string
	Kind      string
	Namespace string
}

GrantFrom identifies the source side of a ReferenceGrant check.

type GrantTo added in v1.0.3 

type GrantTo struct {
	Group     string
	Kind      string
	Namespace string
	Name      string
}

GrantTo identifies the target side of a ReferenceGrant check. An empty Name means the grant applies to any resource name (wildcard).

type HTTPRoute 

type HTTPRoute struct {
	// K8sResource is the source resource.
	K8sResource *gatewayv1.HTTPRoute
	// selected listener
	Listeners utils.KeyMap[gatewayv1.ParentReference, []*Listener] // map[parentRef]
	// Rules
	Rules []*HTTPRouteRule
	// Final Conditions
	Conditions rc.RouteConditions
	// TreeStatus
	TreeStatus     TreeUpdate[HTTPRoute]
	ControllerName string
	// Management Checks
	// CheckParentRefs will only contains conditions for parents (Gateways) managed by us
	CheckParentRefs CheckResultRoute
	// Valid
	Valid bool
	// HTTPRoute from ingress Translation
	IngressTranslated bool
}

A HTTPRoute represents a Kubernetes HTTPRoute

func NewRoute 

func NewRoute(k8sObject *gatewayv1.HTTPRoute, controllerName string) *HTTPRoute

NewRoute creates a new Route for the GateTree.

func (*HTTPRoute) BuildConditions 

func (r *HTTPRoute) BuildConditions()

func (*HTTPRoute) DeepCopy 

func (r *HTTPRoute) DeepCopy() *HTTPRoute

DeepCopy creates a deep copy of the Secret.

func (*HTTPRoute) GetTreeStatus 

func (r *HTTPRoute) GetTreeStatus() *TreeUpdate[HTTPRoute]

GetTreeStatus returns the TreeStatus of the HTTPRoute.

func (*HTTPRoute) ResetChecks 

func (r *HTTPRoute) ResetChecks()

func (*HTTPRoute) SetAsDeleted 

func (r *HTTPRoute) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the Secret as deleted in the GateTree.

func (*HTTPRoute) SetAsUpserted 

func (r *HTTPRoute) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1.HTTPRoute)

SetAsUpserted marks the HTTPRoute as upserted in the GateTree.

func (*HTTPRoute) SetTreeStatus 

func (r *HTTPRoute) SetTreeStatus(treeStatus TreeUpdate[HTTPRoute])

SetTreeStatus sets the TreeStatus of the HTTPRoute.

type HTTPRouteBuilderImpl 

type HTTPRouteBuilderImpl struct {
	*ControllerStore
	// contains filtered or unexported fields
}

func (*HTTPRouteBuilderImpl) CleanTreeUpdates 

func (b *HTTPRouteBuilderImpl) CleanTreeUpdates()

func (*HTTPRouteBuilderImpl) ComputeTreeUpdates 

func (b *HTTPRouteBuilderImpl) ComputeTreeUpdates()

func (*HTTPRouteBuilderImpl) SetAsManaged 

func (b *HTTPRouteBuilderImpl) SetAsManaged(route *HTTPRoute)

func (*HTTPRouteBuilderImpl) SetAsUnmanaged 

func (b *HTTPRouteBuilderImpl) SetAsUnmanaged(route *HTTPRoute)

type HTTPRouteBuilderParams 

type HTTPRouteBuilderParams struct {
	storage.MapsStorage
	*ControllerStore
	*ReferenceGrantManager
	RuntimeUpdate bool
}

type HTTPRouteRule 

type HTTPRouteRule struct {
	K8sResource gatewayv1.HTTPRouteRule
	// CheckBackendRef contains the result of the BackendRef checks for each BackendRef
	CheckBackendRef utils.KeyMap[gatewayv1.BackendObjectReference, CheckResult]
	// CheckFilters holds the result of filter validation for this rule.
	// An invalid result prevents backend creation and surfaces a status condition.
	CheckFilters CheckResult
	// CheckMatches holds the result of match-condition validation (method,
	// headers, query params). An invalid result prevents the rule from being
	// programmed and surfaces a status condition.
	CheckMatches CheckResult
	Valid        bool
}

type HugConfBuilderImpl 

type HugConfBuilderImpl struct {
	*ControllerStore
	// contains filtered or unexported fields
}

func NewHugConfBuilder 

func NewHugConfBuilder(params HugConfBuilderParams) *HugConfBuilderImpl

func (*HugConfBuilderImpl) Build 

func (b *HugConfBuilderImpl) Build()

func (*HugConfBuilderImpl) BuildStatus 

func (*HugConfBuilderImpl) BuildStatus()

type HugConfBuilderParams 

type HugConfBuilderParams struct {
	*ControllerStore
	LogCategoryFilterHandler *logging.CategoryFilterHandler
	HugConfNsName            types.NamespacedName
}

type HugGateParamsRefChecker 

type HugGateParamsRefChecker struct {
	ParamRef      *gatewayv1.ParametersReference
	StoreHugGates map[types.NamespacedName]*v3.HugGate
}

func (*HugGateParamsRefChecker) CheckGateway 

func (c *HugGateParamsRefChecker) CheckGateway() (CheckResult, *v3.HugGate)

func (*HugGateParamsRefChecker) CheckGatewayClass 

func (c *HugGateParamsRefChecker) CheckGatewayClass() (CheckResult, *v3.HugGate)

type IngressBuilderImpl added in v1.1.0 

type IngressBuilderImpl struct {
	*ControllerStore
}

func (*IngressBuilderImpl) CleanTreeUpdates added in v1.1.0 

func (*IngressBuilderImpl) CleanTreeUpdates()

func (*IngressBuilderImpl) ComputeTreeUpdates added in v1.1.0 

func (b *IngressBuilderImpl) ComputeTreeUpdates()

ComputeTreeUpdates translates the Ingress updates of this cycle into synthetic raw HTTPRoute updates and injects them into ClusterStore.Updates.HTTPRoutes. The HTTPRouteBuilder, running afterwards, consumes them like any other HTTPRoute update (raw -> tree conversion, checks, rules, backends, maps), so the whole pipeline is reused without duplication.

Besides the directly-updated Ingresses, it also re-evaluates the Ingresses whose eligibility may have changed because a referenced IngressClass changed in this cycle (see addIngressesForChangedClasses). Nothing else consumes Updates.IngressClasses, so without this an IngressClass deletion would leave a now-ineligible Ingress (and its backends) in the configuration whenever the Ingress re-enqueue did not land in the same batch as the class deletion.

type InstalledVersions 

type InstalledVersions struct {
	// Versions contains the count of installed Gateway API versions.
	Versions map[string]int // map GwApi CRD version -> counter
	Updated  *bool
	Valid    bool
}

type InstalledVersionsBuilderImpl 

type InstalledVersionsBuilderImpl struct {
	*ControllerStore
}

func NewInstalledVersionsBuilder 

func NewInstalledVersionsBuilder(params *ControllerStore) *InstalledVersionsBuilderImpl

func (*InstalledVersionsBuilderImpl) Build 

func (b *InstalledVersionsBuilderImpl) Build()

type Listener 

type Listener struct {
	// K8sGatewayListener is the source resource when the listener comes from the
	// Gateway's own spec. Exactly one of K8sGatewayListener and
	// K8sListenerSetListenerEntry is set.
	K8sGatewayListener *gatewayv1.Listener
	// K8sListenerSetListenerEntry is the source resource when the listener is
	// contributed by a ListenerSet.
	K8sListenerSetListenerEntry *gatewayv1.ListenerEntry
	// Final Conditions
	Conditions     generic.Conditions
	AttachedRoutes AttachedRoutes
	// ListenerKey identifies this listener. Computed once at construction, and read
	// through Key.
	//
	// It has to be exported: DeepCopy round-trips the Listener through JSON, which
	// silently drops unexported fields -- and a copy with a zero key produces a
	// wrong origin prefix, so the map cleanup of the previous state would purge
	// nothing.
	ListenerKey listenerKey
	// OwnerKind is the kind of the resource that declares this listener, "Gateway"
	// or "ListenerSet". Object references the listener holds are resolved and
	// granted against that resource, so the kind is part of the question asked of a
	// ReferenceGrant, not a label.
	//
	// Stamped at construction, together with the key it completes: nothing in a
	// listener's own payload says which kind produced it once the source object is
	// read through the accessors, and the checks must not have to ask.
	OwnerKind gatewayv1.Kind
	// VirtualListenerName is the virtual listener name that this listener is attached to, identified by its port and protocol category
	VirtualListenerName string
	// Checks results
	CheckRouteGroupKind CheckResult
	CheckProtocol       CheckResult
	CheckSecret         CheckResult
	CheckConflict       CheckResult
	CheckPort           CheckResult
	// AllowedRouteKinds is the list of allowed route kinds for this listener.
	AllowedRouteKinds []gatewayv1.RouteGroupKind
	// Valid indicates the listener is fully programmed (Accepted, no conflicts, all refs resolved).
	Valid bool
	// Accepted indicates the listener configuration is accepted (valid protocol, no conflicts).
	// Routes can attach to an accepted listener even if refs are unresolved.
	Accepted bool
	// ExemptFromReferenceGrant lets this listener reach a Secret in another
	// namespace without a ReferenceGrant permitting it. It is set for the listeners
	// of the synthetic Gateway that serves Ingress resources, whose cross-namespace
	// references were already authorised by the Ingress they come from -- there is
	// no user-authored Gateway to write a grant against.
	//
	// Stamped rather than derived from the Gateway's synthetic name: that decision
	// is made once, where the synthetic Gateway is recognised, and re-deriving it
	// here would be a second place to keep in agreement with the first.
	ExemptFromReferenceGrant bool
}

Listener is a listener of the merged list of a Gateway: either one declared in the Gateway's own spec, or one contributed by an attached ListenerSet.

The source object is kept as-is rather than converted, in one of two mutually exclusive fields. gatewayv1.Listener and gatewayv1.ListenerEntry happen to have identical fields today, so a conversion would compile — but relying on that coincidence would silently absorb any future divergence, and the two types already have distinct condition vocabularies. Which field is set also *is* the origin of the listener: there is no separate flag that could drift away from the payload.

Read the shared attributes through the accessors (Name, Port, Protocol, Hostname, TLS, AllowedRoutes) so that the branch exists once per attribute rather than once per call site.

The source object and everything it points at are borrowed from the store and must be treated as read-only, like everything else the tree holds: the store owns the per-event deep copy the controller-runtime cache returns on Get, and several tree nodes alias it.

func (*Listener) AllowedRoutes added in v1.1.0 

func (l *Listener) AllowedRoutes() *gatewayv1.AllowedRoutes

AllowedRoutes returns the listener route-attachment policy, nil when unset.

func (*Listener) BuildConditions 

func (l *Listener) BuildConditions(treeGw *Gateway, previousStatus listenerPreviousStatus)

BuildConditions settles the final conditions of a listener. previousStatus is what the resource declaring it published about it last time -- the Gateway for a listener of its own spec, the ListenerSet for an entry -- since that is where the condition it preserves lives and what its observedGeneration must match.

func (*Listener) DeepCopy 

func (l *Listener) DeepCopy() *Listener

DeepCopy creates a deep copy of the Listener.

func (*Listener) FromListenerSet added in v1.1.0 

func (l *Listener) FromListenerSet() bool

FromListenerSet reports whether this listener was contributed by a ListenerSet rather than declared in the Gateway's own spec.

func (*Listener) Hostname added in v1.1.0 

func (l *Listener) Hostname() *gatewayv1.Hostname

Hostname returns the listener hostname, nil when unset. An unset hostname is a catch-all, and it is a value like any other for conflict purposes: two catch-all listeners on the same port are indistinguishable.

func (*Listener) Key added in v1.0.3 

func (l *Listener) Key() listenerKey

Key returns the identity of this listener. It is stored rather than recomputed: the conflict table is keyed by it, and a second code path rebuilding it would only have to disagree once for a listener to silently get no verdict at all.

func (*Listener) MatchesParentRefPort added in v1.1.0 

func (l *Listener) MatchesParentRefPort(port *gatewayv1.PortNumber) bool

MatchesParentRefPort reports whether a parentRef port, when set, selects this listener.

The port is read through the listener's own accessors, which know which resource declared it: a contributed entry holds no spec listener of any Gateway, so a port read straight off that field would decide nothing -- or panic.

func (*Listener) Name added in v1.1.0 

func (l *Listener) Name() gatewayv1.SectionName

Name returns the listener name. It is unique within the resource that declares it, but NOT across a Gateway and its ListenerSets: the Gateway API explicitly allows the same name on both sides, and on sibling ListenerSets.

func (*Listener) Port added in v1.1.0 

func (l *Listener) Port() gatewayv1.PortNumber

Port returns the listener port.

func (*Listener) Protocol added in v1.1.0 

func (l *Listener) Protocol() gatewayv1.ProtocolType

Protocol returns the listener protocol.

func (*Listener) TLS added in v1.1.0 

func (l *Listener) TLS() *gatewayv1.ListenerTLSConfig

TLS returns the listener TLS configuration, nil when unset. Note that an HTTPS listener without a TLS section passes the CRD validation, so nil must be handled rather than assumed away.

type ListenerEntryStatus added in v1.1.0 

type ListenerEntryStatus struct {
	Name           gatewayv1.SectionName
	Conditions     generic.Conditions
	SupportedKinds []gatewayv1.RouteGroupKind
	AttachedRoutes int32
}

ListenerEntryStatus is a ListenerSet's status.listeners record for one of its entries.

A tree type rather than gatewayv1.ListenerEntryStatus so that conditions stay generic.Conditions inside the tree and the conversion to the API type happens once, where the status is written.

Name keys a listType=map within this ListenerSet's own status, which is safe: names are unique within the resource declaring them. It is deliberately not the merged list that the parent Gateway publishes, where the same bare name can legally appear twice -- that is why the Gateway publishes only its own listeners.

type ListenerSet added in v1.1.0 

type ListenerSet struct {
	K8sResource *gatewayv1.ListenerSet
	// Conditions are this ListenerSet's own Accepted and Programmed conditions.
	// Rebuilt from scratch every cycle by the verdict builder: a status is a
	// conclusion about the whole tree, and the previous one is not an input to it.
	Conditions generic.Conditions
	// TreeStatus
	TreeStatus TreeUpdate[ListenerSet]
	// Entries is status.listeners: one record per entry this ListenerSet declares,
	// in spec order, with the conditions its contributed listener was judged on.
	Entries []ListenerEntryStatus
	// Attachment is what the contribution pass decided: whether this ListenerSet's
	// listeners entered the parent Gateway's merged list, and if not, whether the
	// refusal is this controller's to report. Written once per cycle by the
	// contribution pass, which is the only place the decision is taken -- the pass
	// that reports it must not re-derive it, or the status and the data plane could
	// disagree.
	Attachment listenerSetAttachment
}

ListenerSet is a set of listeners contributed to an existing Gateway.

It holds no listeners of its own in the tree: the listeners it declares are contributed to the merged list of its parent Gateway, which is where they are compared against the others for conflicts and where their conditions are computed. What stays here is the ListenerSet's own status -- whether it is allowed to attach at all, and the roll-up of its entries.

Every field is exported, which DeepCopy requires: it round-trips through JSON and silently drops unexported state.

func NewListenerSet added in v1.1.0 

func NewListenerSet(k8sObject *gatewayv1.ListenerSet) *ListenerSet

func (*ListenerSet) DeepCopy added in v1.1.0 

func (ls *ListenerSet) DeepCopy() *ListenerSet

DeepCopy creates a deep copy of the ListenerSet.

func (*ListenerSet) GetCreationTimestamp added in v1.1.0 

func (ls *ListenerSet) GetCreationTimestamp() metav1.Time

GetCreationTimestamp, GetNamespace and GetName make a tree ListenerSet sortable by SortByCreationTimestamp, which is exactly the precedence the API prescribes for the ListenerSets attached to one Gateway: oldest first, ties broken on "{namespace}/{name}". They return zero values once the resource is gone, which is harmless -- a deleted ListenerSet contributes nothing, so where it sorts does not matter.

func (*ListenerSet) GetName added in v1.1.0 

func (ls *ListenerSet) GetName() string

func (*ListenerSet) GetNamespace added in v1.1.0 

func (ls *ListenerSet) GetNamespace() string

func (*ListenerSet) GetTreeStatus added in v1.1.0 

func (ls *ListenerSet) GetTreeStatus() *TreeUpdate[ListenerSet]

GetTreeStatus returns the TreeStatus of the ListenerSet.

func (*ListenerSet) IsAttachmentReported added in v1.1.0 

func (ls *ListenerSet) IsAttachmentReported() bool

IsAttachmentReported reports whether this ListenerSet owes a status at all.

False means the attachment names a resource of another controller, or none of ours: nothing is contributed and nothing is said, because writing a status there -- even an empty one -- would be commenting on someone else's resource. The reader is the patcher, which has to skip such a ListenerSet rather than publish the empty conditions the silent cases leave behind.

A predicate rather than an exported comparison, because the three attachment values are a vocabulary private to this package and the patcher only ever needs the one distinction. Both reported outcomes answer true: a refusal is reported.

func (*ListenerSet) SetAsDeleted added in v1.1.0 

func (ls *ListenerSet) SetAsDeleted(logger *slog.Logger)

func (*ListenerSet) SetAsUpserted added in v1.1.0 

func (ls *ListenerSet) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1.ListenerSet)

func (*ListenerSet) SetTreeStatus added in v1.1.0 

func (ls *ListenerSet) SetTreeStatus(treeStatus TreeUpdate[ListenerSet])

SetTreeStatus sets the TreeStatus of the ListenerSet.

type ListenerSetContributionBuilder added in v1.1.0 

type ListenerSetContributionBuilder struct {
	*ControllerStore
}

ListenerSetContributionBuilder is the half of ListenerSet support that feeds the rest of the tree: it mirrors the ListenerSets of the cluster store, decides which of them may attach, and hands the listeners of those that may to the Gateway builder, which appends them after each Gateway's own.

Named after what it does rather than where it sits, because "before" is ambiguous in this package: the Builder lists are split on whether a builder runs before or after the reference rebuild, while the split that matters for ListenerSets is before or after the Gateway builder. Only the latter constrains this one, and it is met by its position among the post-builders.

Its counterpart runs after the Gateway builder and reports verdicts: conditions the ListenerSet can only learn once the merged list has been compared and each listener judged. The two are separate builders rather than one registered twice, which would run the tree update twice over the same cluster updates.

No condition is computed here: an entry is judged by the same checks and programmed by the same feedback as a Gateway's own listener, and what this pass decides about a ListenerSet is recorded on its Attachment for the reporting pass to turn into conditions. The two halves stay apart because one decides and the other reports, which is what keeps a status from disagreeing with the data plane.

func (*ListenerSetContributionBuilder) CleanTreeUpdates added in v1.1.0 

func (b *ListenerSetContributionBuilder) CleanTreeUpdates()

func (*ListenerSetContributionBuilder) ComputeTreeUpdates added in v1.1.0 

func (b *ListenerSetContributionBuilder) ComputeTreeUpdates()

type ListenerSetVerdictBuilder added in v1.1.0 

type ListenerSetVerdictBuilder struct {
	*ControllerStore
}

ListenerSetVerdictBuilder is the counterpart of ListenerSetContributionBuilder: it runs after the Gateway and route builders and reports on each ListenerSet what could only be known once the merged list existed, each listener was judged, and the routes had updated their attachments.

The two passes are separate builders rather than one registered twice because their positions are on either side of the Gateway builder: the contribution must run before it, the reporting after, and the build loop runs each builder once.

It is also the only place a ListenerSet's status is decided. The contribution pass records a decision (attachment) and computes nothing; this pass derives the conditions from the tree and never re-reads `allowedListeners`, so the status and the data plane cannot disagree about who contributed.

Nothing here reaches Kubernetes: the conditions and per-entry records are stored on the tree, and a dedicated patcher publishes them.

func (*ListenerSetVerdictBuilder) CleanTreeUpdates added in v1.1.0 

func (*ListenerSetVerdictBuilder) CleanTreeUpdates()

CleanTreeUpdates owns nothing: ListenerSets are mirrored, and reaped when deleted, by the contribution pass, which is the one that puts them in the tree.

func (*ListenerSetVerdictBuilder) ComputeTreeUpdates added in v1.1.0 

func (b *ListenerSetVerdictBuilder) ComputeTreeUpdates()

type ObservedGenerations added in v1.1.0 

type ObservedGenerations map[ObservedOwner]int64

ObservedGenerations maps each resource a frontend was programmed against to the generation that programming was made from.

type ObservedOwner added in v1.1.0 

type ObservedOwner struct {
	Kind gatewayv1.Kind
	Key  types.NamespacedName
}

ObservedOwner names a resource a frontend was programmed against: the Gateway it serves, or the ListenerSet that declared one of the entries it serves.

func (ObservedOwner) MarshalText added in v1.1.0 

func (o ObservedOwner) MarshalText() ([]byte, error)

MarshalText is what lets a map of owners be marshalled at all.

The apply result is logged as a whole, and it travels to the controller as this map, and encoding/json refuses a map whose member name is not a string: without this the log reports "object member name must be a string" instead of the generations it was handed. The old shape -- a map keyed by NamespacedName, which has no MarshalText either -- had the same failure, so this is not new to the per-owner routing.

func (ObservedOwner) String added in v1.1.0 

func (o ObservedOwner) String() string

String names an owner in one token: its kind, then its namespaced name.

type ReferenceGrant added in v1.0.3 

type ReferenceGrant struct {
	// K8sResource is the source resource.
	K8sResource *gatewayv1beta1.ReferenceGrant
	// TreeStatus
	TreeStatus TreeUpdate[ReferenceGrant]
}

func NewReferenceGrant added in v1.0.3 

func NewReferenceGrant(k8sObject *gatewayv1beta1.ReferenceGrant) *ReferenceGrant

func (*ReferenceGrant) DeepCopy added in v1.0.3 

func (rg *ReferenceGrant) DeepCopy() *ReferenceGrant

DeepCopy creates a deep copy of the ReferenceGrant.

func (*ReferenceGrant) GetTreeStatus added in v1.0.3 

func (rg *ReferenceGrant) GetTreeStatus() *TreeUpdate[ReferenceGrant]

GetTreeStatus returns the TreeStatus of the ReferenceGrant.

func (*ReferenceGrant) SetAsDeleted added in v1.0.3 

func (rg *ReferenceGrant) SetAsDeleted(logger *slog.Logger)

func (*ReferenceGrant) SetAsUpserted added in v1.0.3 

func (rg *ReferenceGrant) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1beta1.ReferenceGrant)

func (*ReferenceGrant) SetTreeStatus added in v1.0.3 

func (rg *ReferenceGrant) SetTreeStatus(treeStatus TreeUpdate[ReferenceGrant])

SetTreeStatus sets the TreeStatus of the ReferenceGrant.

type ReferenceGrantBuilderImpl added in v1.0.3 

type ReferenceGrantBuilderImpl struct {
	// contains filtered or unexported fields
}

func (*ReferenceGrantBuilderImpl) CleanTreeUpdates added in v1.0.3 

func (b *ReferenceGrantBuilderImpl) CleanTreeUpdates()

func (*ReferenceGrantBuilderImpl) ComputeTreeUpdates added in v1.0.3 

func (b *ReferenceGrantBuilderImpl) ComputeTreeUpdates()

type ReferenceGrantManager added in v1.0.3 

type ReferenceGrantManager struct {
	// contains filtered or unexported fields
}

ReferenceGrantManager tracks which cross-namespace references are permitted by ReferenceGrant resources. It maintains three maps:

  • toReferenceGrantFrom: for each target (GrantTo), which ReferenceGrants cover it and from which source types (GrantFrom). Used to incrementally update toFrom.

  • referenceGrantsTo: inverse index — for each ReferenceGrant, which targets (GrantTo) it covers. Required to efficiently remove all entries for a deleted grant.

  • toFrom: the resolved flat map consumed by IsAccessGranted. Rebuilt from toReferenceGrantFrom by ComputeToFrom after each reconcile cycle.

func NewReferenceGrantManager added in v1.0.3 

func NewReferenceGrantManager() *ReferenceGrantManager

NewReferenceGrantManager returns an initialised ReferenceGrantManager with all internal maps allocated.

func (*ReferenceGrantManager) ComputeToFrom added in v1.0.3 

func (mgr *ReferenceGrantManager) ComputeToFrom()

ComputeToFrom rebuilds the toFrom map from toReferenceGrantFrom. It must be called after all UpsertReferenceGrant and RemoveReferenceGrant calls for a reconcile cycle have completed, and before any IsAccessGranted call consults the result.

func (*ReferenceGrantManager) IsAccessGranted added in v1.0.3 

func (mgr *ReferenceGrantManager) IsAccessGranted(from GrantFrom, to GrantTo) bool

IsAccessGranted reports whether the resource described by from may reference the resource described by to. Same-namespace references are always permitted. Cross-namespace access requires a matching entry in toFrom, covering both named grants and wildcard grants (empty Name).

func (*ReferenceGrantManager) RemoveReferenceGrant added in v1.0.3 

func (mgr *ReferenceGrantManager) RemoveReferenceGrant(referenceGrant ReferenceGrant)

RemoveReferenceGrant removes all entries for a deleted ReferenceGrant.

func (*ReferenceGrantManager) UpsertReferenceGrant added in v1.0.3 

func (mgr *ReferenceGrantManager) UpsertReferenceGrant(referenceGrant ReferenceGrant)

UpsertReferenceGrant registers or updates the access grants defined by the given ReferenceGrant. It clears any previous entries for the grant before inserting the current Spec, so that updates are handled correctly without diffing old vs new rules. toReferenceGrantFrom and referenceGrantsTo are updated; call ComputeToFrom afterwards to reflect the change in IsAccessGranted.

type ReferenceGrantNamespacedName added in v1.0.3 

type ReferenceGrantNamespacedName types.NamespacedName

ReferenceGrantNamespacedName is the namespace/name key of a ReferenceGrant.

func ConvertReferenceGrantNamespacedName added in v1.0.3 

func ConvertReferenceGrantNamespacedName(referenceGrant ReferenceGrant) ReferenceGrantNamespacedName

ConvertReferenceGrantNamespacedName extracts the namespace/name identity of a ReferenceGrant from its K8sResource. K8sResource must not be nil.

type ReferenceManager 

type ReferenceManager struct {
	*ControllerStore
}

func NewReferenceManager 

func NewReferenceManager(controllerStore *ControllerStore) *ReferenceManager

func (*ReferenceManager) UpdateRefences 

func (rm *ReferenceManager) UpdateRefences()

UpdateRefences refreshes the Secret references derived from Gateway listener TLS certificateRefs (consumed by the CertificateBuilder via ReferencedSecrets).

The previous snapshot is taken on every call so the CertificateBuilder's current-vs-previous diff stays correct even on cycles without a rebuild. The reference set itself is fully rebuilt from the current Gateways only when a Gateway changed this cycle: a stateless rebuild avoids maintaining the reverse index incrementally, and the cost stays in-memory (the cert I/O is made incremental by the diff downstream).

type ReferencedObjects 

type ReferencedObjects struct {
	//  ReferencedSecrets includes the GatewayClasses that are references by Gateways Listeners
	// Owners are Listeners
	ReferencedSecrets         references.ReferencedBy[listenerKey]
	PreviousReferencedSecrets references.ReferencedBy[listenerKey]
}

func NewReferencedObjects 

func NewReferencedObjects() *ReferencedObjects

type RouteGroupKind 

type RouteGroupKind struct {
	// Group is the group of the RouteGroupKind.
	Group gatewayv1.Group `json:"group,omitempty"`
	// Kind is the kind of the RouteGroupKind.
	Kind gatewayv1.Kind `json:"kind"`
}

type Secret 

type Secret struct {
	// K8sResource is the source resource.
	K8sResource *v1.Secret
	// TreeStatus
	TreeStatus TreeUpdate[Secret]
}

A Secret represents a Kubernetes Secret

func NewSecret 

func NewSecret(k8sObject *v1.Secret) *Secret

NewSecret creates a new Secret for the GateTree.

func (*Secret) DeepCopy 

func (s *Secret) DeepCopy() *Secret

DeepCopy creates a deep copy of the Secret.

func (*Secret) GetTreeStatus 

func (s *Secret) GetTreeStatus() *TreeUpdate[Secret]

GetTreeStatus returns the TreeStatus of the Secret.

func (*Secret) SetAsDeleted 

func (s *Secret) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the Secret as deleted in the GateTree.

func (*Secret) SetAsManaged 

func (s *Secret) SetAsManaged(logger *slog.Logger, cs ControllerStore)

SetAsManaged moves the Secret to the managed GateTree.

func (*Secret) SetAsUpserted 

func (s *Secret) SetAsUpserted(logger *slog.Logger, newK8sResource *v1.Secret)

SetAsUpserted marks the Secret as upserted in the GateTree.

func (*Secret) SetTreeStatus 

func (s *Secret) SetTreeStatus(treeStatus TreeUpdate[Secret])

SetTreeStatus sets the TreeStatus of the Secret.

type SecretBuilderImpl 

type SecretBuilderImpl struct {
	*ControllerStore
}

func (*SecretBuilderImpl) CleanTreeUpdates 

func (b *SecretBuilderImpl) CleanTreeUpdates()

func (*SecretBuilderImpl) ComputeTreeUpdates 

func (b *SecretBuilderImpl) ComputeTreeUpdates()

type Service 

type Service struct {
	// K8sResource is the source resource.
	K8sResource *v1.Service
	// TreeStatus
	TreeStatus TreeUpdate[Service]
}

A Service represents a Kubernetes Service

func NewService 

func NewService(k8sObject *v1.Service) *Service

NewService creates a new Service for the GateTree.

func (*Service) DeepCopy 

func (s *Service) DeepCopy() *Service

DeepCopy creates a deep copy of the Service.

func (*Service) GetTreeStatus 

func (s *Service) GetTreeStatus() *TreeUpdate[Service]

GetTreeStatus returns the TreeStatus of the Service.

func (*Service) SetAsDeleted 

func (s *Service) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the Service as deleted in the GateTree.

func (*Service) SetAsManaged 

func (s *Service) SetAsManaged(logger *slog.Logger, cs ControllerStore)

SetAsManaged moves the Service to the managed GateTree.

func (*Service) SetAsUpserted 

func (s *Service) SetAsUpserted(logger *slog.Logger, newK8sResource *v1.Service)

SetAsUpserted marks the Service as upserted in the GateTree.

func (*Service) SetTreeStatus 

func (s *Service) SetTreeStatus(treeStatus TreeUpdate[Service])

SetTreeStatus sets the TreeStatus of the Service.

type ServiceBuilderImpl 

type ServiceBuilderImpl struct {
	*ControllerStore
}

func (*ServiceBuilderImpl) CleanTreeUpdates 

func (b *ServiceBuilderImpl) CleanTreeUpdates()

func (*ServiceBuilderImpl) ComputeTreeUpdates 

func (b *ServiceBuilderImpl) ComputeTreeUpdates()

type SupportedVersions 

type SupportedVersions []string

func (SupportedVersions) String 

func (s SupportedVersions) String() string

type SyntheticGatewayBuilderImpl added in v1.1.0 

type SyntheticGatewayBuilderImpl struct {
	*ControllerStore
}

func (*SyntheticGatewayBuilderImpl) CleanTreeUpdates added in v1.1.0 

func (*SyntheticGatewayBuilderImpl) CleanTreeUpdates()

func (*SyntheticGatewayBuilderImpl) ComputeTreeUpdates added in v1.1.0 

func (b *SyntheticGatewayBuilderImpl) ComputeTreeUpdates()

type TCPRoute added in v1.1.0 

type TCPRoute struct {
	// K8sResource is the source resource.
	K8sResource *gatewayv1.TCPRoute
	// selected listener
	Listeners utils.KeyMap[gatewayv1.ParentReference, []*Listener] // map[parentRef]
	// Rules
	Rules []*TCPRouteRule
	// Final Conditions
	Conditions rc.RouteConditions
	// TreeStatus
	TreeStatus     TreeUpdate[TCPRoute]
	ControllerName string
	// CheckParentRefs will only contains conditions for parents (Gateways) managed by us
	CheckParentRefs CheckResultRoute
	// Valid
	Valid bool
}

TCPRoute mirrors TLSRoute's lifecycle minus the hostname machinery: a TCP listener carries no hostname, so listener acceptance is the whole matching.

func NewTCPRoute added in v1.1.0 

func NewTCPRoute(k8sObject *gatewayv1.TCPRoute, controllerName string) *TCPRoute

func (*TCPRoute) BuildConditions added in v1.1.0 

func (r *TCPRoute) BuildConditions()

func (*TCPRoute) DeepCopy added in v1.1.0 

func (r *TCPRoute) DeepCopy() *TCPRoute

func (*TCPRoute) GetTreeStatus added in v1.1.0 

func (r *TCPRoute) GetTreeStatus() *TreeUpdate[TCPRoute]

func (*TCPRoute) ResetChecks added in v1.1.0 

func (r *TCPRoute) ResetChecks()

func (*TCPRoute) SetAsDeleted added in v1.1.0 

func (r *TCPRoute) SetAsDeleted(logger *slog.Logger)

func (*TCPRoute) SetAsUpserted added in v1.1.0 

func (r *TCPRoute) SetAsUpserted(logger *slog.Logger, newK8sResource *gatewayv1.TCPRoute)

SetAsUpserted marks the TCPRoute as upserted in the GateTree.

func (*TCPRoute) SetTreeStatus added in v1.1.0 

func (r *TCPRoute) SetTreeStatus(treeStatus TreeUpdate[TCPRoute])

SetTreeStatus sets the TreeStatus of the TCPRoute.

type TCPRouteBuilderImpl added in v1.1.0 

type TCPRouteBuilderImpl struct {
	*ControllerStore
	// contains filtered or unexported fields
}

func (*TCPRouteBuilderImpl) CleanTreeUpdates added in v1.1.0 

func (b *TCPRouteBuilderImpl) CleanTreeUpdates()

func (*TCPRouteBuilderImpl) ComputeTreeUpdates added in v1.1.0 

func (b *TCPRouteBuilderImpl) ComputeTreeUpdates()

func (*TCPRouteBuilderImpl) SetAsManaged added in v1.1.0 

func (b *TCPRouteBuilderImpl) SetAsManaged(tcpRoute *TCPRoute)

func (*TCPRouteBuilderImpl) SetAsUnmanaged added in v1.1.0 

func (b *TCPRouteBuilderImpl) SetAsUnmanaged(tcpRoute *TCPRoute)

type TCPRouteBuilderParams added in v1.1.0 

type TCPRouteBuilderParams struct {
	storage.MapsStorage
	*ControllerStore
	*ReferenceGrantManager
}

type TCPRouteRule added in v1.1.0 

type TCPRouteRule struct {
	// CheckBackendRef contains the result of the BackendRef checks for each BackendRef
	CheckBackendRef utils.KeyMap[gatewayv1.BackendObjectReference, CheckResult]
	K8sResource     gatewayv1.TCPRouteRule
	Valid           bool
}

type TLSRoute added in v0.8.0 

type TLSRoute struct {
	// K8sResource is the source resource.
	K8sResource *v1alpha2.TLSRoute
	// selected listener
	Listeners utils.KeyMap[gatewayv1.ParentReference, []*Listener] // map[parentRef]
	// Rules
	Rules []*TLSRouteRule
	// Final Conditions
	Conditions rc.RouteConditions
	// TreeStatus
	TreeStatus     TreeUpdate[TLSRoute]
	ControllerName string
	// Management Checks
	// CheckParentRefs will only contains conditions for parents (Gateways) managed by us
	CheckParentRefs CheckResultRoute
	// Valid
	Valid bool
}

func NewTLSRoute added in v0.8.0 

func NewTLSRoute(k8sObject *v1alpha2.TLSRoute, controllerName string) *TLSRoute

func (*TLSRoute) BuildConditions added in v0.8.0 

func (r *TLSRoute) BuildConditions()

func (*TLSRoute) DeepCopy added in v0.8.0 

func (r *TLSRoute) DeepCopy() *TLSRoute

func (*TLSRoute) GetTreeStatus added in v0.8.0 

func (r *TLSRoute) GetTreeStatus() *TreeUpdate[TLSRoute]

func (*TLSRoute) ResetChecks added in v0.8.0 

func (r *TLSRoute) ResetChecks()

func (*TLSRoute) SetAsDeleted added in v0.8.0 

func (r *TLSRoute) SetAsDeleted(logger *slog.Logger)

func (*TLSRoute) SetAsUpserted added in v0.8.0 

func (r *TLSRoute) SetAsUpserted(logger *slog.Logger, newK8sResource *v1alpha2.TLSRoute)

SetAsUpserted marks the HTTPRoute as upserted in the GateTree.

func (*TLSRoute) SetTreeStatus added in v0.8.0 

func (r *TLSRoute) SetTreeStatus(treeStatus TreeUpdate[TLSRoute])

SetTreeStatus sets the TreeStatus of the HTTPRoute.

type TLSRouteBuilderImpl added in v0.8.0 

type TLSRouteBuilderImpl struct {
	*ControllerStore
	// contains filtered or unexported fields
}

func (*TLSRouteBuilderImpl) CleanTreeUpdates added in v0.8.0 

func (b *TLSRouteBuilderImpl) CleanTreeUpdates()

func (*TLSRouteBuilderImpl) ComputeTreeUpdates added in v0.8.0 

func (b *TLSRouteBuilderImpl) ComputeTreeUpdates()

func (*TLSRouteBuilderImpl) SetAsManaged added in v0.8.0 

func (b *TLSRouteBuilderImpl) SetAsManaged(tlsRoute *TLSRoute)

func (*TLSRouteBuilderImpl) SetAsUnmanaged added in v0.8.0 

func (b *TLSRouteBuilderImpl) SetAsUnmanaged(tlsRoute *TLSRoute)

type TLSRouteBuilderParams added in v0.8.0 

type TLSRouteBuilderParams struct {
	storage.MapsStorage
	*ControllerStore
	*ReferenceGrantManager
}

type TLSRouteRule added in v0.8.0 

type TLSRouteRule struct {
	// CheckBackendRef contains the result of the BackendRef checks for each BackendRef
	CheckBackendRef utils.KeyMap[gatewayv1.BackendObjectReference, CheckResult]
	K8sResource     v1alpha2.TLSRouteRule
	Valid           bool
}

type TreeObject 

type TreeObject[T TreeResource] interface {
	GetTreeStatus() *TreeUpdate[T]
	SetTreeStatus(TreeUpdate[T])
	DeepCopy() *T
}

type TreeResource 

type TreeResource interface {
	GatewayClass | Gateway | Secret | HTTPRoute | Service | TLSRoute | TCPRoute | Global | DefaultsCR | ReferenceGrant | ListenerSet
}

TreeResource is a constraint that permits any of the tree's resource types.

type TreeResourcePointer 

type TreeResourcePointer[T TreeResource] interface {
	*T
	TreeObject[T]
}

TreeResourcePointer is a constraint for a pointer to a tree resource that implements the TreeObject interface.

type TreeUpdate 

type TreeUpdate[T any] struct {
	OldTreeResource *T
	Status          store.Status
}

type VirtualListener added in v0.9.0 

type VirtualListener struct {
	ProtocolCategory protocols.ProtocolCategory
	Name             string
	// Status
	Status    store.Status
	Listeners []*Listener
	Port      v1.PortNumber
}

func NewVirtualListener added in v0.9.0 

func NewVirtualListener(protocolCategory protocols.ProtocolCategory, port v1.PortNumber) *VirtualListener

func (*VirtualListener) DeepCopy added in v0.9.0 

func (vl *VirtualListener) DeepCopy() *VirtualListener

DeepCopy creates a deep copy of the VirtualListener using JSON marshalling.

func (*VirtualListener) Equal added in v0.9.0 

func (vl *VirtualListener) Equal(other *VirtualListener) bool

func (*VirtualListener) GoneListeners added in v1.1.0 

func (vl *VirtualListener) GoneListeners(previous *VirtualListener) []*Listener

Equal checks if two VirtualListeners are equal by comparing ProtocolCategory, Port, and each Listener's K8sResource. GoneListeners returns the listeners this frontend served in the previous cycle and no longer serves.

A frontend outlives the loss of one of its listeners -- the others share its port -- so nothing else recognises the listener as gone, and the map entries it wrote (its hostname match, and the routes it carried) would stay on disk and keep serving. The comparison is by listener key: a listener that only moved within the list is not gone, and an entry of a deleted ListenerSet is recognised without its own object still being in the store.

func (*VirtualListener) SetAsCreated added in v0.9.0 

func (vl *VirtualListener) SetAsCreated(logger *slog.Logger)

SetAsCreated marks the VirtualListener as created.

func (*VirtualListener) SetAsDeleted added in v0.9.0 

func (vl *VirtualListener) SetAsDeleted(logger *slog.Logger)

SetAsDeleted marks the VirtualListener as deleted.

func (*VirtualListener) SetAsUpserted added in v0.9.0 

func (vl *VirtualListener) SetAsUpserted(logger *slog.Logger)

SetAsUpserted marks the VirtualListener as upserted.

type VirtualListenerBuilderImpl added in v0.9.0 

type VirtualListenerBuilderImpl struct {
	*ControllerStore
}

func (*VirtualListenerBuilderImpl) CleanTreeUpdates added in v0.9.0 

func (b *VirtualListenerBuilderImpl) CleanTreeUpdates()

func (*VirtualListenerBuilderImpl) ComputeTreeUpdates added in v0.9.0 

func (b *VirtualListenerBuilderImpl) ComputeTreeUpdates()

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.