Skip to content

Commit c67bcd5

Browse files
rahulanand16novmaleck13eguzki
authored
Merge new-api-impl into main (Kuadrant#84)
* add API and RateLimitPolicy resource * add new apis' controller * Add finalizer (Kuadrant#74) * add API and RateLimitPolicy resource * add new apis' controller * add owner and finalizer for ratelimit policy Co-authored-by: Rahul Anand <[email protected]> * update RateLimitPolicy and API design (Kuadrant#75) * example: add virtualservice resource to toystore example * update ratelimitpolicy and API design * update samples for RLP and API resource * tie networking and ratelimit using annotations (Kuadrant#76) * tie networking and ratelimit using annotations * move network selection into spec from annotations * reuse ClusterEnvoyPatch from istioprovider * create AuthorizationPolicy using VirtualService (Kuadrant#79) * create AuthorizationPolicy using VirtualService * just log if reconciling w/o provider annotation * move orphan check into the reconcile logic * pass logger from main reconciler and small fix * use predicate funcs to filter events for virtualservice * make preauth as the first and postauth as the last filter (Kuadrant#80) * cleanup API APIProduct CRDs (Kuadrant#81) * cleanup API APIProduct CRDs * fix tests * remove duplicated constants * Harden RateLimitPolicy implementation (Kuadrant#82) * harden RateLimitPolicy implementation * change finalizer's name * fix typo and use correct gateway labels * fix lint before merging into main Co-authored-by: Craig Brookes <[email protected]> Co-authored-by: Eguzki Astiz Lezaun <[email protected]>
1 parent a484324 commit c67bcd5

File tree

87 files changed

+2297
-8005
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+2297
-8005
lines changed

‎PROJECT

+9-7
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,19 @@ resources:
1212
- api:
1313
crdVersion: v1
1414
namespaced: true
15-
domain: networking.kuadrant.io
15+
controller: true
16+
domain: kuadrant.io
17+
group: apim
1618
kind: API
17-
path: github.com/kuadrant/kuadrant-controller/apis/networking/v1beta1
18-
version: v1beta1
19+
path: github.com/kuadrant/kuadrant-controller/apis/apim/v1alpha1
20+
version: v1alpha1
1921
- api:
2022
crdVersion: v1
2123
namespaced: true
2224
controller: true
2325
domain: kuadrant.io
24-
group: networking
25-
kind: APIProduct
26-
path: github.com/kuadrant/kuadrant-controller/apis/networking/v1beta1
27-
version: v1beta1
26+
group: apim
27+
kind: RateLimitPolicy
28+
path: github.com/kuadrant/kuadrant-controller/apis/apim/v1alpha1
29+
version: v1alpha1
2830
version: "3"

‎README.md

+1-42
Original file line numberDiff line numberDiff line change
@@ -46,51 +46,10 @@ The kuadrant controller acts on the following [CRDs](https://kubernetes.io/docs/
4646

4747
| CRD | Description |
4848
| --- | --- |
49-
| [APIProduct](apis/networking/v1beta1/apiproduct_types.go) | Customer-facing APIs. APIProduct facilitates the creation of strong and simplified offerings for API consumers |
50-
| [API](apis/networking/v1beta1/api_types.go) | Internal APIs bundled in a product. Kuadrant API objects grant API providers the freedom to map their internal API organization structure to kuadrant |
49+
| [RateLimitPolicy](apis/apim/v1alpha1/ratelimitpolicy_types.go) | Enable access control on workloads based on HTTP rate limiting |
5150

5251
For a detailed description of the CRDs above, refer to the [Architecture](doc/architecture.md) page.
5352

54-
## List of features
55-
56-
| Feature | Description | Stage |
57-
| --- | --- | --- |
58-
| [OpenAPI 3.x](https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.2.md) | OpenAPI driven configuration. The document can be read from a configmap or served from the upstream API service | *Ready* |
59-
| *Path Match* based routing | HTTP routing rules will be configured based on request path expressions. Accepted values are `Exact`, `Prefix` and `RegularExpression` | *Ready* |
60-
| [Service Discovery](doc/service-discovery.md) | kubernetes [annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) and [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) for a seamless integration | *Ready* |
61-
| **AuthN** based on API key | Protect your service with a simple API key based authentication mechanism | *Ready* |
62-
| **AuthN** based on [OpenID Connect (OIDC)](https://openid.net/connect/) | Kuadrant can verify OIDC (JWTs) tokens to authenticate users | *Ready* |
63-
| Global Rate Limiting | Single global rate limit for all requests. Main use case for protecting infrastructure resources | *Ready* |
64-
| Rate Limiting Per Remote IP | Rate limit configuration per each remote IP address. Main use case for protecting infrastructure resources | *Ready* |
65-
| Authenticated Rate Limiting | Rate limit configuration per each authenticated client | *Ready* |
66-
| Server TLS | TLS termination for downstream connections | Planned |
67-
| Upstream TLS | Client certificates upstream connections | Planned |
68-
| mTLS | Mutual TLS termination for downstream connections | Planned |
69-
| [Gateway API](https://gateway-api.sigs.k8s.io/) | Implementation of kuadrant features on top of the Gateway API | Planned |
70-
| Monitoring and Alerting | Observability based on [Grafana](https://grafana.com/) and [Prometheus](https://prometheus.io/) | Planned |
71-
72-
For a detailed description of the features above, refer to the [Architecture](doc/architecture.md) page.
73-
74-
## Architecture
75-
76-
The [Architecture](doc/architecture.md) section of the docs covers the details of protecting your APIs with Kuadrant.
77-
78-
## [Getting started](doc/getting-started.md)
79-
80-
## User Guides
81-
82-
### [HTTP routing rules from OpenAPI stored in a configmap](doc/service-discovery-oas-configmap.md)
83-
84-
### [HTTP routing rules from OpenAPI served by the service](doc/service-discovery-oas-service.md)
85-
86-
### [HTTP routing rules with path matching](doc/service-discovery-path-match.md)
87-
88-
### [AuthN based on API key](doc/authn-api-key.md)
89-
90-
### [AuthN based on OpenID Connect](doc/authn-oidc.md)
91-
92-
### [Rate limiting](doc/rate-limit.md)
93-
9453
## Contributing
9554

9655
The [Development guide](doc/development.md) describes how to build the kuadrant controller and

‎apis/apim/v1alpha1/api_types.go

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
Copyright 2021 Red Hat, Inc.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
v1 "k8s.io/api/core/v1"
21+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
22+
)
23+
24+
type OPARef struct {
25+
URL string `json:"URL,omitempty"`
26+
ConfigMap *v1.LocalObjectReference `json:"configMap,omitempty"`
27+
}
28+
29+
type APIMetadata struct {
30+
Version string `json:"version"`
31+
Title string `json:"title"`
32+
Description string `json:"description,omitempty"`
33+
OpenAPIRef OPARef `json:"openAPIRef,omitempty"`
34+
}
35+
36+
type APISpec struct {
37+
Info APIMetadata `json:"info"`
38+
}
39+
40+
// +kubebuilder:object:root=true
41+
// API is the Schema for the apis API
42+
type API struct {
43+
metav1.TypeMeta `json:",inline"`
44+
metav1.ObjectMeta `json:"metadata,omitempty"`
45+
46+
Spec APISpec `json:"spec"`
47+
}
48+
49+
// +kubebuilder:object:root=true
50+
51+
// APIList contains a list of API
52+
type APIList struct {
53+
metav1.TypeMeta `json:",inline"`
54+
metav1.ListMeta `json:"metadata,omitempty"`
55+
Items []API `json:"items"`
56+
}
57+
58+
func init() {
59+
SchemeBuilder.Register(&API{}, &APIList{})
60+
}

‎apis/networking/v1beta1/groupversion_info.go ‎apis/apim/v1alpha1/groupversion_info.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
1414
limitations under the License.
1515
*/
1616

17-
// Package v1beta1 contains API Schema definitions for the networking v1beta1 API group
18-
// +kubebuilder:object:generate=true
19-
// +groupName=networking.kuadrant.io
20-
package v1beta1
17+
// Package v1alpha1 contains API Schema definitions for the apim v1alpha1 API group
18+
//+kubebuilder:object:generate=true
19+
//+groupName=apim.kuadrant.io
20+
package v1alpha1
2121

2222
import (
2323
"k8s.io/apimachinery/pkg/runtime/schema"
@@ -26,7 +26,7 @@ import (
2626

2727
var (
2828
// GroupVersion is group version used to register these objects
29-
GroupVersion = schema.GroupVersion{Group: "networking.kuadrant.io", Version: "v1beta1"}
29+
GroupVersion = schema.GroupVersion{Group: "apim.kuadrant.io", Version: "v1alpha1"}
3030

3131
// SchemeBuilder is used to add go types to the GroupVersionKind scheme
3232
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}

‎apis/apim/v1alpha1/ratelimitpolicy_types.go

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
/*
2+
Copyright 2021 Red Hat, Inc.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
limitadorv1alpha1 "github.com/kuadrant/limitador-operator/api/v1alpha1"
21+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
22+
)
23+
24+
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
25+
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
26+
27+
type RLGenericKey struct {
28+
DescriptorKey string `json:"descriptor_key"`
29+
DescriptorValue string `json:"descriptor_value"`
30+
}
31+
32+
type ActionSpecifier struct {
33+
GenericKey RLGenericKey `json:"generic_key"`
34+
}
35+
36+
// +kubebuilder:validation:Enum=PREAUTH;POSTAUTH;BOTH
37+
type RateLimitStage string
38+
39+
// +kubebuilder:validation:Enum=HTTPRoute;VirtualService
40+
type NetworkingRefType string
41+
42+
const (
43+
RateLimitStagePREAUTH RateLimitStage = "PREAUTH"
44+
RateLimitStagePOSTAUTH RateLimitStage = "POSTAUTH"
45+
RateLimitStageBOTH RateLimitStage = "BOTH"
46+
47+
NetworkingRefTypeHR NetworkingRefType = "HTTPRoute"
48+
NetworkingRefTypeVS NetworkingRefType = "VirtualService"
49+
)
50+
51+
var RateLimitStageName = map[int32]string{
52+
0: "PREAUTH",
53+
1: "POSTAUTH",
54+
2: "BOTH",
55+
}
56+
57+
var RateLimitStageValue = map[RateLimitStage]int32{
58+
"PREAUTH": 0,
59+
"POSTAUTH": 1,
60+
"BOTH": 2,
61+
}
62+
63+
type Route struct {
64+
// name of the route present in the virutalservice
65+
Name string `json:"name"`
66+
// Definfing phase at which rate limits will be applied.
67+
// Valid values are: PREAUTH, POSTAUTH, BOTH
68+
Stage RateLimitStage `json:"stage"`
69+
// rule specific actions
70+
Actions []*ActionSpecifier `json:"actions,omitempty"`
71+
}
72+
73+
type NetworkingRef struct {
74+
Type NetworkingRefType `json:"type"`
75+
Name string `json:"name"`
76+
}
77+
78+
// RateLimitPolicySpec defines the desired state of RateLimitPolicy
79+
type RateLimitPolicySpec struct {
80+
//+listType=map
81+
//+listMapKey=type
82+
//+listMapKey=name
83+
NetworkingRef []NetworkingRef `json:"networkingRef,omitempty"`
84+
// route specific staging and actions
85+
//+listType=map
86+
//+listMapKey=name
87+
Routes []Route `json:"routes,omitempty"`
88+
// these actions are used for all of the matching rules
89+
Actions []*ActionSpecifier `json:"actions,omitempty"`
90+
Limits []limitadorv1alpha1.RateLimitSpec `json:"limits,omitempty"`
91+
}
92+
93+
//+kubebuilder:object:root=true
94+
95+
// RateLimitPolicy is the Schema for the ratelimitpolicies API
96+
type RateLimitPolicy struct {
97+
metav1.TypeMeta `json:",inline"`
98+
metav1.ObjectMeta `json:"metadata,omitempty"`
99+
100+
Spec RateLimitPolicySpec `json:"spec,omitempty"`
101+
}
102+
103+
//+kubebuilder:object:root=true
104+
105+
// RateLimitPolicyList contains a list of RateLimitPolicy
106+
type RateLimitPolicyList struct {
107+
metav1.TypeMeta `json:",inline"`
108+
metav1.ListMeta `json:"metadata,omitempty"`
109+
Items []RateLimitPolicy `json:"items"`
110+
}
111+
112+
func init() {
113+
SchemeBuilder.Register(&RateLimitPolicy{}, &RateLimitPolicyList{})
114+
}

0 commit comments

Comments
 (0)