Skip to content
This repository was archived by the owner on Oct 20, 2023. It is now read-only.
This repository was archived by the owner on Oct 20, 2023. It is now read-only.

Depreciation of TrafficRoutes in favor of supporting Kubernetes Gateway API - WIP #249

Description

@nicholasjackson

This issue is to discuss the overlaps between SMI and Kubernetes Gateway API and the possibility that where there is an overlap SMI adopts Gateway API in replacement for its own resources concentrating purely on service mesh specific resources.

Gateway API Spec:
https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io

TrafficSpecs Comparison

The below example shows comparable functionality as could be implemented using SMI or Gateway spec, the core difference in this specification is that SMI TrafficTarget controls service to service authorization.

kind: HTTPRouteGroup
metadata:
  name: the-routes
spec:
  matches:
  - name: metrics
    pathRegex: "/metrics"
    methods:
    - GET
  - name: health
    pathRegex: "/ping"
    methods: ["*"]

---
kind: TrafficTarget
metadata:
  name: path-specific
  namespace: default
spec:
  destination:
    kind: ServiceIdentity
    name: my-api
    namespace: default
  rules:
  - kind: HTTPRouteGroup
    name: the-routes
    matches:
    - metrics
  sources:
  - kind: ServiceIdentity
    name: my-service
    namespace: gateway-api-example-ns1
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
  name: my-route
  namespace: gateway-api-example-ns2
spec:
  parentRefs:
  - kind: ServiceIdentity
    name: my-service
    namespace: gateway-api-example-ns1
  rules:
  - backendRefs:
    - name: my-api
      port: 8080
  matches:
    - path:
        value: "/metrics"
      method: GET
    - path:
        value: "/ping"

Notes:

  • Investigate if parentRefs could relate to proposed ServiceIdentity, Gateway spec seems loose enough
  • How would service to service authorization be implemented with Gateway spec
  • In the instance that Gateway spec is used to control a Kubernetes ingress controller, how do you determine if HTTPRoute should configure a gateway or east west service mesh traffic

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions