Services (static) + ReferenceGrant (controller-managed) #29

Merged

ginjiruu merged 1 commit from feat/services-referencedgrant into master

2026-09-15 16:24:00 +00:00

ginjiruu commented

2026-09-15 04:55:34 +00:00

Owner

Closes #20

The in-cluster wiring that lets Apps (in many namespaces) route to the Bridge:

The three fixed Services (authz-bridge-callback :8082, authz-bridge-oidc :8083, authz-bridge-exchange :8084 in authz-bridge-system) as static config: new config/services/ kustomize directory wired into config/default, selector control-plane: controller-manager, matching the manager's bind addresses; the manager Deployment declares the three containerPorts.
A new controller (internal/controller/routegrant) watches HTTPRoutes and GRPCRoutes across namespaces and owns a ReferenceGrant (authz-bridge-grants in the Bridge's namespace) granting each Route's namespace (deduped, sorted spec.from) permission to reference the three Services (spec.to); idempotent upsert, re-fetch before update, the grant is deleted when the last Route disappears.
RBAC via markers + make manifests (purely additive role.yaml diff); wired in cmd/main.go on the existing --registry-namespace; sigs.k8s.io/gateway-api v1.6.2.

Verified TDD-first via the existing envtest + Ginkgo/Gomega suite pattern (Seam B, with the gateway-api standard-channel CRDs committed at test/crds/gateway-api/): 6 specs (no-Routes delete path, HTTPRoute namespace + exact spec.to assertion, GRPCRoute namespace, dedup, last-Route deletion, appear-in-new-namespace update + idempotent no-op), RED before implementation and GREEN after. kustomize build config/default verified for the three Services. Full suite green (-p 1). Two-axis code review: no hard standard violations; noted for follow-up — the gateway CRDs are test-only (a Gateway implementation is expected in-cluster), and the watch-trigger path is exercised by code reading (matching the existing suite pattern).

Closes #20 The in-cluster wiring that lets Apps (in many namespaces) route to the Bridge: - The three fixed Services (`authz-bridge-callback` :8082, `authz-bridge-oidc` :8083, `authz-bridge-exchange` :8084 in `authz-bridge-system`) as static config: new `config/services/` kustomize directory wired into `config/default`, selector `control-plane: controller-manager`, matching the manager's bind addresses; the manager Deployment declares the three containerPorts. - A new controller (`internal/controller/routegrant`) watches `HTTPRoute`s and `GRPCRoute`s across namespaces and owns a `ReferenceGrant` (`authz-bridge-grants` in the Bridge's namespace) granting each Route's namespace (deduped, sorted `spec.from`) permission to reference the three Services (`spec.to`); idempotent upsert, re-fetch before update, the grant is deleted when the last Route disappears. - RBAC via markers + `make manifests` (purely additive role.yaml diff); wired in `cmd/main.go` on the existing `--registry-namespace`; `sigs.k8s.io/gateway-api v1.6.2`. Verified TDD-first via the existing envtest + Ginkgo/Gomega suite pattern (Seam B, with the gateway-api standard-channel CRDs committed at `test/crds/gateway-api/`): 6 specs (no-Routes delete path, HTTPRoute namespace + exact `spec.to` assertion, GRPCRoute namespace, dedup, last-Route deletion, appear-in-new-namespace update + idempotent no-op), RED before implementation and GREEN after. `kustomize build config/default` verified for the three Services. Full suite green (`-p 1`). Two-axis code review: no hard standard violations; noted for follow-up — the gateway CRDs are test-only (a Gateway implementation is expected in-cluster), and the watch-trigger path is exercised by code reading (matching the existing suite pattern).

ginjiruu added 1 commit

2026-09-15 04:55:34 +00:00

add static services + route-referencedgrant controller: cross-namespace backendref authorization

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled