Documentation
¶
Overview ¶
Package ingressctl reconciles the ingress route table from the service store and resolves upstream targets from the dataplane endpoint cache.
This is the consumer side of the RUNE-066 wiring whose producer half lives in pkg/orchestrator/controllers/instance_controller.go (PublishService -> OrderedLog -> dataplane.Cache). Without this controller, the ingress Subsystem's Router stays empty and every inbound request to an `expose.host` returns 404.
Index ¶
Constants ¶
const ManualLogRepeat = 5 * time.Minute
ManualLogRepeat is how often we re-emit "still failing" warnings for a misconfigured manual-TLS Secret. First failure logs immediately; subsequent failures of the same (host, errKind) are suppressed until this interval elapses. A successful push clears the dedup entry so the next failure logs immediately again.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Router is the ingress route table to keep in sync. Required.
Router *ingress.Router
// Store is the agent's local state store. Required.
Store store.Store
// Cache is the dataplane endpoint cache used by Resolve to
// answer ingress.UpstreamResolver lookups. Required.
Cache *dataplane.Cache
// ACME is the optional certificate orchestrator. When non-nil,
// the controller submits a Request for every service whose
// Expose.TLS asks for ACME on each reconcile.
ACME *acme.Orchestrator
// Secrets, when set, lets the controller resolve `tls.mode:
// manual` exposes by reading the named Secret and pushing its
// `tls.crt` / `tls.key` data into Certs on each reconcile (so
// secret rotation flows through without operator action).
Secrets *repos.SecretRepo
// Certs is the same CertStore the ACME orchestrator + ingress
// cert loader are wired against. Required to enable manual
// mode; nil disables manual-mode handling.
Certs acme.CertStore
// ClientCAs is the per-host client-CA registry shared with the
// ingress listener for inbound mTLS. When set (and Secrets is
// available), the controller resolves each exposed service's
// clientCert.caSecret into a pool and pushes it here. nil disables
// clientCert handling.
ClientCAs *ingress.ClientCARegistry
// Logger is the structured logger. Defaults to "ingressctl".
Logger log.Logger
// ReconcilePeriod is how often the controller rebuilds the
// route table from the store as a safety net. Defaults to 2s.
ReconcilePeriod time.Duration
// ReservedHostPorts are host ports owned by the edge ingress
// listener (typically 80/443). The dataplane does not open VIP
// listeners on these ports, so Resolve must dial container
// endpoints from the cache instead of the service VIP.
ReservedHostPorts []int
}
Config bundles the controller's required dependencies.
type Controller ¶
type Controller struct {
// contains filtered or unexported fields
}
Controller reconciles ingress routes from the service store and implements ingress.UpstreamResolver against the dataplane cache.
func New ¶
func New(cfg Config) *Controller
New constructs a Controller. Logger and ReconcilePeriod default.
func (*Controller) Resolve ¶
func (c *Controller) Resolve(namespace, service string, port int) (string, bool)
Resolve implements ingress.UpstreamResolver. It prefers the service cluster VIP (dataplane proxy) so ingress does not dial stale container IPs after restarts. The dataplane cache is keyed by service ID; when no VIP is assigned yet, it falls back to the first healthy cached endpoint for that ID.
func (*Controller) Run ¶
func (c *Controller) Run(ctx context.Context)
Run blocks until ctx is done, periodically rebuilding the route table from the service store. Safe to call once per Controller.
Source Files