mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 19:47:37 +09:00
Aleksei Sviridkin
d2e851f63b
Replace ingress-nginx as the default ingress layer for cozystack-native
services with Cilium Gateway API, materialised per-tenant via a new
TenantGateway CRD reconciled by cozystack-controller.
The extra/gateway chart renders one gateway.cozystack.io/v1alpha1
TenantGateway per tenant; the controller owns the resulting Gateway,
per-tenant Issuer, Certificate(s), and the http->https redirect
HTTPRoute. This avoids the helm-vs-controller race on
Gateway.spec.listeners when route-driven listeners are added.
publishing.certificates.solver selects HTTP-01 (default; per-app HTTPS
listener + per-app Certificate) or DNS-01 (opt-in; single wildcard
Certificate per apex; providers: cloudflare, route53, digitalocean,
rfc2136). HTTP-01 keeps zero-config per-app onboarding; DNS-01 saves
Let's Encrypt budget on apex-shared clusters.
Security model -- seven independent layers, all admission-time gates
fail-closed:
1. Listener allowedRoutes namespace whitelist via the
kube-apiserver-written kubernetes.io/metadata.name label;
plain-HTTP listener is strictly narrower than HTTPS, and HTTPS /
passthrough listeners restrict allowedRoutes.kinds to
HTTPRoute / TLSRoute respectively.
2. cozystack-gateway-hostname-policy VAP on Gateway.
3. cozystack-gateway-attached-namespaces-policy VAP on Package --
blocks tenant-* in gateway.attachedNamespaces.
4. cozystack-tenant-host-policy VAP on Tenant -- blocks spec.host
writes from non-trusted callers.
5. cozystack-namespace-host-label-policy VAP on Namespace -- blocks
writes to namespace.cozystack.io/host from non-trusted callers.
6. Render-time fail in cozystack-basics for tenant-* in
gateway.attachedNamespaces.
7. cozystack-route-hostname-policy VAP on HTTPRoute / TLSRoute,
scoped to tenant-* namespaces.
Within-apex cross-namespace hostname conflict is resolved at reconcile
time by a HostnameConflict condition (cozy-* namespace wins).
Five reconcile paths refuse to rewrite pre-existing objects with the
controller-derived name but no OwnerReference back to the
TenantGateway: Gateway, redirect HTTPRoute, per-tenant Issuer, wildcard
Certificate, per-listener Certificate.
Derived-apex tenants (tenants whose host is a subdomain of a parent
tenant's) auto-enable Gateway when the platform-level gateway.enabled
is on.
Bonus fix: pkg/registry/apps/application/rest.go was ignoring the
createValidation and deleteValidation callbacks that genericapiserver
hands to every storage method, silently bypassing admission for Create
and Delete on every apps.cozystack.io resource (Tenant, MariaDB,
Postgres, Kubernetes, ...). Aligned with the existing updateValidation
pattern.
Always-on changes: cilium.envoy.enabled + cilium.gatewayAPI.enabled
flip to true (extra cilium-envoy DaemonSet, ~100 MB RAM/node idle),
and the cozystack-api admission-chain fix. Everything else is gated
behind gateway.enabled=false and tenant.spec.gateway=false; existing
clusters see no behavioural change until an operator opts in.
Tests: 60+ Go cases in internal/controller/tenantgateway/, admission-
chain regression tests in pkg/registry/apps/application/, helm-unittest
across 7 charts (extra/gateway, core/platform, apps/tenant,
system/cozystack-basics, system/cert-manager-issuers,
system/cozystack-api, system/dashboard), and 14 e2e bats scenarios in
hack/e2e-apps/gateway.bats. New make test-controllers target wired
into pull-requests.yaml.
Deps: sigs.k8s.io/gateway-api v1.4.1, cert-manager v1.17.4.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
162 lines
6.8 KiB
Makefile
162 lines
6.8 KiB
Makefile
.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests rd-presets-check test-controllers preflight
|
|
|
|
include hack/common-envs.mk
|
|
|
|
build-deps:
|
|
@command -V find docker skopeo jq gh helm > /dev/null
|
|
@yq --version | grep -q "mikefarah" || (echo "mikefarah/yq is required" && exit 1)
|
|
@tar --version | grep -q GNU || (echo "GNU tar is required" && exit 1)
|
|
@sed --version | grep -q GNU || (echo "GNU sed is required" && exit 1)
|
|
@awk --version | grep -q GNU || (echo "GNU awk is required" && exit 1)
|
|
|
|
build: build-deps
|
|
make -C packages/apps/http-cache image
|
|
make -C packages/apps/mariadb image
|
|
make -C packages/apps/clickhouse image
|
|
make -C packages/apps/kubernetes image
|
|
make -C packages/system/monitoring image
|
|
make -C packages/system/cozystack-api image
|
|
make -C packages/system/cozystack-controller image
|
|
make -C packages/system/backup-controller image
|
|
make -C packages/system/backupstrategy-controller image
|
|
make -C packages/system/lineage-controller-webhook image
|
|
make -C packages/system/cilium image
|
|
make -C packages/system/linstor image
|
|
make -C packages/system/linstor-gui image
|
|
make -C packages/system/kubeovn-webhook image
|
|
make -C packages/system/kubeovn-plunger image
|
|
make -C packages/system/dashboard image
|
|
make -C packages/system/metallb image
|
|
make -C packages/system/kamaji image
|
|
make -C packages/system/multus image
|
|
make -C packages/system/bucket image
|
|
make -C packages/system/objectstorage-controller image
|
|
make -C packages/system/grafana-operator image
|
|
make -C packages/core/testing image
|
|
make -C packages/core/talos image
|
|
make -C packages/core/platform image
|
|
make -C packages/core/installer image
|
|
make manifests
|
|
|
|
manifests:
|
|
mkdir -p _out/assets
|
|
cat internal/crdinstall/manifests/*.yaml > _out/assets/cozystack-crds.yaml
|
|
# kubectl-apply install path: render the bare Namespace resource alongside
|
|
# the operator. bareNamespace=true gates a Namespace cozy-system with PSA +
|
|
# identity labels (see packages/core/installer/templates/cozy-system-namespace.yaml).
|
|
# helm install/upgrade users keep the default (false) and use --create-namespace
|
|
# + the pre-install labeler hook.
|
|
# Talos variant (default)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-talos.yaml
|
|
# Generic Kubernetes variant (k3s, kubeadm, RKE2)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--set cozystackOperator.variant=generic \
|
|
--set cozystack.apiServerHost=REPLACE_ME \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-generic.yaml
|
|
# Hosted variant (managed Kubernetes)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--set cozystackOperator.variant=hosted \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-hosted.yaml
|
|
|
|
cozypkg:
|
|
go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg
|
|
|
|
assets: assets-talos assets-cozypkg openapi-json
|
|
|
|
openapi-json:
|
|
mkdir -p _out/assets
|
|
VERSION=$(shell git describe --tags --always 2>/dev/null || echo dev) go run ./tools/openapi-gen/ 2>/dev/null > _out/assets/openapi.json
|
|
|
|
assets-talos:
|
|
make -C packages/core/talos assets
|
|
|
|
assets-cozypkg: assets-cozypkg-linux-amd64 assets-cozypkg-linux-arm64 assets-cozypkg-darwin-amd64 assets-cozypkg-darwin-arm64 assets-cozypkg-windows-amd64 assets-cozypkg-windows-arm64
|
|
(cd _out/assets/ && sha256sum cozypkg-*.tar.gz) > _out/assets/cozypkg-checksums.txt
|
|
|
|
assets-cozypkg-%:
|
|
$(eval EXT := $(if $(filter windows,$(firstword $(subst -, ,$*))),.exe,))
|
|
mkdir -p _out/assets
|
|
GOOS=$(firstword $(subst -, ,$*)) GOARCH=$(lastword $(subst -, ,$*)) go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg-$*/cozypkg$(EXT) ./cmd/cozypkg
|
|
cp LICENSE _out/bin/cozypkg-$*/LICENSE
|
|
tar -C _out/bin/cozypkg-$* -czf _out/assets/cozypkg-$*.tar.gz LICENSE cozypkg$(EXT)
|
|
|
|
test:
|
|
make -C packages/core/testing apply
|
|
make -C packages/core/testing test
|
|
|
|
unit-tests: helm-unit-tests bats-unit-tests go-unit-tests rd-presets-check
|
|
|
|
helm-unit-tests:
|
|
hack/helm-unit-tests.sh
|
|
|
|
# Pin the resourcesPreset enum in every ApplicationDefinition openAPISchema
|
|
# to the canonical 47-value set (40 instance-type names + 7 legacy aliases).
|
|
# Catches the regression where one chart's Makefile forgets to invoke
|
|
# hack/update-crd.sh and that RD's schema drifts from values.schema.json.
|
|
rd-presets-check:
|
|
hack/check-rd-presets.sh
|
|
|
|
# Scoped go test over the cozystack-api surface that this repo owns. Kept
|
|
# narrow intentionally - running `go test ./...` pulls in generated code
|
|
# round-trip suites whose behavior depends on tool versions outside this
|
|
# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised
|
|
# from their generator workflows.
|
|
go-unit-tests:
|
|
go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/...
|
|
|
|
# Go tests for the controllers and supporting packages under ./internal.
|
|
# Excludes ./pkg/... and ./cmd/... — those are run separately by
|
|
# go-unit-tests above (pkg subset) and skipped (cmd) until their tests
|
|
# stabilise. Run as its own step in CI alongside helm/bats unit tests;
|
|
# locally invoke directly (`make test-controllers`) or chain
|
|
# (`make unit-tests test-controllers`).
|
|
test-controllers:
|
|
go test ./internal/... -count=1
|
|
|
|
# Discover every hack/*.bats file that is NOT an e2e test and run it
|
|
# through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
|
|
# up automatically on the next `make unit-tests` run.
|
|
#
|
|
# Caveat: $(wildcard ...) returns space-separated names, so a filename
|
|
# containing a literal space would split into multiple tokens here. All
|
|
# current bats files use hyphen-separated names; if the project ever
|
|
# introduces whitespace-bearing filenames this recipe must be rewritten
|
|
# (e.g. to use `find ... -print0 | xargs -0`).
|
|
BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
|
|
|
|
bats-unit-tests:
|
|
@if [ -z "$(BATS_UNIT_FILES)" ]; then \
|
|
echo "ERROR: no hack/*.bats unit test files found"; \
|
|
exit 1; \
|
|
fi
|
|
@for f in $(BATS_UNIT_FILES); do \
|
|
echo "--- running $$f ---"; \
|
|
hack/cozytest.sh "$$f" || exit 1; \
|
|
done
|
|
|
|
# Operator-facing host preflight check. Warns about a standalone
|
|
# containerd.service or docker.service running alongside the embedded
|
|
# k3s runtime. Safe to run at any time; always exits 0.
|
|
preflight:
|
|
@hack/check-host-runtime.sh
|
|
|
|
prepare-env:
|
|
make -C packages/core/testing apply
|
|
make -C packages/core/testing prepare-cluster
|
|
|
|
generate:
|
|
hack/update-codegen.sh
|
|
|
|
upload_assets: manifests
|
|
hack/upload-assets.sh
|