mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Aleksei Sviridkin
d2e851f63b
Replace ingress-nginx as the default ingress layer for cozystack-native
services with Cilium Gateway API, materialised per-tenant via a new
TenantGateway CRD reconciled by cozystack-controller.
The extra/gateway chart renders one gateway.cozystack.io/v1alpha1
TenantGateway per tenant; the controller owns the resulting Gateway,
per-tenant Issuer, Certificate(s), and the http->https redirect
HTTPRoute. This avoids the helm-vs-controller race on
Gateway.spec.listeners when route-driven listeners are added.
publishing.certificates.solver selects HTTP-01 (default; per-app HTTPS
listener + per-app Certificate) or DNS-01 (opt-in; single wildcard
Certificate per apex; providers: cloudflare, route53, digitalocean,
rfc2136). HTTP-01 keeps zero-config per-app onboarding; DNS-01 saves
Let's Encrypt budget on apex-shared clusters.
Security model -- seven independent layers, all admission-time gates
fail-closed:
1. Listener allowedRoutes namespace whitelist via the
kube-apiserver-written kubernetes.io/metadata.name label;
plain-HTTP listener is strictly narrower than HTTPS, and HTTPS /
passthrough listeners restrict allowedRoutes.kinds to
HTTPRoute / TLSRoute respectively.
2. cozystack-gateway-hostname-policy VAP on Gateway.
3. cozystack-gateway-attached-namespaces-policy VAP on Package --
blocks tenant-* in gateway.attachedNamespaces.
4. cozystack-tenant-host-policy VAP on Tenant -- blocks spec.host
writes from non-trusted callers.
5. cozystack-namespace-host-label-policy VAP on Namespace -- blocks
writes to namespace.cozystack.io/host from non-trusted callers.
6. Render-time fail in cozystack-basics for tenant-* in
gateway.attachedNamespaces.
7. cozystack-route-hostname-policy VAP on HTTPRoute / TLSRoute,
scoped to tenant-* namespaces.
Within-apex cross-namespace hostname conflict is resolved at reconcile
time by a HostnameConflict condition (cozy-* namespace wins).
Five reconcile paths refuse to rewrite pre-existing objects with the
controller-derived name but no OwnerReference back to the
TenantGateway: Gateway, redirect HTTPRoute, per-tenant Issuer, wildcard
Certificate, per-listener Certificate.
Derived-apex tenants (tenants whose host is a subdomain of a parent
tenant's) auto-enable Gateway when the platform-level gateway.enabled
is on.
Bonus fix: pkg/registry/apps/application/rest.go was ignoring the
createValidation and deleteValidation callbacks that genericapiserver
hands to every storage method, silently bypassing admission for Create
and Delete on every apps.cozystack.io resource (Tenant, MariaDB,
Postgres, Kubernetes, ...). Aligned with the existing updateValidation
pattern.
Always-on changes: cilium.envoy.enabled + cilium.gatewayAPI.enabled
flip to true (extra cilium-envoy DaemonSet, ~100 MB RAM/node idle),
and the cozystack-api admission-chain fix. Everything else is gated
behind gateway.enabled=false and tenant.spec.gateway=false; existing
clusters see no behavioural change until an operator opts in.
Tests: 60+ Go cases in internal/controller/tenantgateway/, admission-
chain regression tests in pkg/registry/apps/application/, helm-unittest
across 7 charts (extra/gateway, core/platform, apps/tenant,
system/cozystack-basics, system/cert-manager-issuers,
system/cozystack-api, system/dashboard), and 14 e2e bats scenarios in
hack/e2e-apps/gateway.bats. New make test-controllers target wired
into pull-requests.yaml.
Deps: sigs.k8s.io/gateway-api v1.4.1, cert-manager v1.17.4.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
135 lines
6.0 KiB
AMPL
135 lines
6.0 KiB
AMPL
// This is a generated file. Do not edit directly.
|
|
|
|
module github.com/cozystack/cozystack
|
|
|
|
go 1.26.2
|
|
|
|
require (
|
|
github.com/cert-manager/cert-manager v1.17.4
|
|
github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1
|
|
github.com/emicklei/dot v1.10.0
|
|
github.com/fluxcd/helm-controller/api v1.4.3
|
|
github.com/fluxcd/source-controller/api v1.7.4
|
|
github.com/fluxcd/source-watcher/api/v2 v2.0.3
|
|
github.com/go-logr/logr v1.4.3
|
|
github.com/go-logr/zapr v1.3.0
|
|
github.com/go-task/slim-sprig/v3 v3.0.0
|
|
github.com/google/gofuzz v1.2.0
|
|
github.com/onsi/ginkgo/v2 v2.23.3
|
|
github.com/onsi/gomega v1.37.0
|
|
github.com/prometheus/client_golang v1.23.0
|
|
github.com/robfig/cron/v3 v3.0.1
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/vmware-tanzu/velero v1.17.1
|
|
go.uber.org/zap v1.27.0
|
|
k8s.io/api v0.34.1
|
|
k8s.io/apiextensions-apiserver v0.34.1
|
|
k8s.io/apimachinery v0.34.2
|
|
k8s.io/apiserver v0.34.1
|
|
k8s.io/client-go v0.34.1
|
|
k8s.io/component-base v0.34.1
|
|
k8s.io/klog/v2 v2.130.1
|
|
k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3
|
|
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
|
|
sigs.k8s.io/container-object-storage-interface-api v0.1.0
|
|
sigs.k8s.io/controller-runtime v0.22.4
|
|
sigs.k8s.io/gateway-api v1.4.1
|
|
sigs.k8s.io/structured-merge-diff/v6 v6.3.0
|
|
sigs.k8s.io/yaml v1.6.0
|
|
)
|
|
|
|
require (
|
|
cel.dev/expr v0.25.1 // indirect
|
|
github.com/NYTimes/gziphandler v1.1.1 // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/blang/semver/v4 v4.0.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/coreos/go-semver v0.3.1 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
|
|
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
|
|
github.com/fluxcd/pkg/apis/kustomize v1.13.0 // indirect
|
|
github.com/fluxcd/pkg/apis/meta v1.23.0 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.2 // indirect
|
|
github.com/go-openapi/jsonreference v0.21.0 // indirect
|
|
github.com/go-openapi/swag v0.23.1 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/btree v1.1.3 // indirect
|
|
github.com/google/cel-go v0.26.0 // indirect
|
|
github.com/google/gnostic-models v0.7.0 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/mailru/easyjson v0.9.0 // indirect
|
|
github.com/moby/spdystream v0.5.1 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.65.0 // indirect
|
|
github.com/prometheus/procfs v0.17.0 // indirect
|
|
github.com/spf13/pflag v1.0.7 // indirect
|
|
github.com/stoewer/go-strcase v1.3.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
go.etcd.io/etcd/api/v3 v3.6.4 // indirect
|
|
go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
|
|
go.etcd.io/etcd/client/v3 v3.6.4 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
|
|
go.opentelemetry.io/otel v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.2 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.50.0 // indirect
|
|
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
|
|
golang.org/x/net v0.52.0 // indirect
|
|
golang.org/x/oauth2 v0.35.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.43.0 // indirect
|
|
golang.org/x/term v0.42.0 // indirect
|
|
golang.org/x/text v0.36.0 // indirect
|
|
golang.org/x/time v0.12.0 // indirect
|
|
golang.org/x/tools v0.43.0 // indirect
|
|
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
|
|
google.golang.org/grpc v1.80.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
k8s.io/kms v0.34.1 // indirect
|
|
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
|
|
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
)
|
|
|
|
// See: issues.k8s.io/135537
|
|
replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c
|