feat: add UDP expose reconciliation with Envoy Gateway#2760
feat: add UDP expose reconciliation with Envoy Gateway#2760chance-coleman wants to merge 25 commits into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 24 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
39–371 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 310214cf87feffd86b1f45792c4d2881d12e8af7eaf61621cf27f26606a04ffe
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 24 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
39–371 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 310214cf87feffd86b1f45792c4d2881d12e8af7eaf61621cf27f26606a04ffe
Tip: Customize your compliance reviews with Lula.
Greptile SummaryThis PR adds UDP ingress support to the UDS Package CR via a new
Confidence Score: 5/5The change is safe to merge. Core routing, validation, NetworkPolicy generation, and finalizer cleanup are all correct. All correctness paths are sound: admission validation prevents cross-package and within-package port conflicts, the mutex properly serializes Gateway writes, owner references are correctly scoped, and the finalizer recomputes the shared Gateway on deletion. The three previously-raised threading, port-conflict, and stale-victim concerns are fully addressed. The only findings are performance-oriented nits and a pair of duplicate test cases, none of which affect runtime behavior. No files require special attention. The minor inefficiencies in udp-route-resources.ts and the duplicate tests in udp-route-resources.spec.ts are worth a follow-up but do not block merging. Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant PR as Package Reconciler
participant EGR as envoyGatewayResources
participant Map as defaultListenerMap (in-memory)
participant Mutex as defaultGatewayMutex
participant K8s as Kubernetes API
PR->>EGR: envoyGatewayResources(pkg, ns)
EGR->>K8s: validateDefaultGatewayClass() [per default entry]
EGR->>K8s: K8s(K8sUDPRoute).Apply(udpRoute) [per entry]
EGR->>K8s: purgeOrphans(K8sUDPRoute) [list+delete stale]
EGR->>Map: updateDefaultListenerMap(pkg, entries)
EGR->>Mutex: acquire()
Mutex-->>EGR: locked
EGR->>K8s: K8s(K8sGateway).Apply(gateway) [or Delete if empty]
EGR->>Mutex: release()
Note over PR,K8s: Finalizer path
PR->>Map: removeDefaultListenerMapEntry(pkg)
PR->>Mutex: acquire()
Mutex-->>PR: locked
PR->>K8s: K8s(K8sGateway).Apply/Delete (recompute listeners)
PR->>Mutex: release()
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant PR as Package Reconciler
participant EGR as envoyGatewayResources
participant Map as defaultListenerMap (in-memory)
participant Mutex as defaultGatewayMutex
participant K8s as Kubernetes API
PR->>EGR: envoyGatewayResources(pkg, ns)
EGR->>K8s: validateDefaultGatewayClass() [per default entry]
EGR->>K8s: K8s(K8sUDPRoute).Apply(udpRoute) [per entry]
EGR->>K8s: purgeOrphans(K8sUDPRoute) [list+delete stale]
EGR->>Map: updateDefaultListenerMap(pkg, entries)
EGR->>Mutex: acquire()
Mutex-->>EGR: locked
EGR->>K8s: K8s(K8sGateway).Apply(gateway) [or Delete if empty]
EGR->>Mutex: release()
Note over PR,K8s: Finalizer path
PR->>Map: removeDefaultListenerMapEntry(pkg)
PR->>Mutex: acquire()
Mutex-->>PR: locked
PR->>K8s: K8s(K8sGateway).Apply/Delete (recompute listeners)
PR->>Mutex: release()
Reviews (7): Last reviewed commit: "fix(envoy-gateway): wire real external-L..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 24 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
39–371 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 310214cf87feffd86b1f45792c4d2881d12e8af7eaf61621cf27f26606a04ffe
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 24 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–370 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 66848bc68fa2198eed82a94501816c782412e527b8f0e675b450961cbc49b172
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 23 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–370 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 66848bc68fa2198eed82a94501816c782412e527b8f0e675b450961cbc49b172
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 23 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
51–326 |
src/pepr/operator/controllers/network/policies.ts |
50–327 |
src/pepr/operator/controllers/network/policies.ts |
49–328 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: fed660d0918e668017d64eb40bb93b1bb21feaf238e3d196da5b1e4845de4b0f
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 72f9e63f90f27fa23fe3adfbcbb3d0d743899efbe52f448210233cfe515003ef
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: d6b71d75a51c846c764c16e49090d06f00938c0c8fa246e82560c9616aa69934
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–370 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 66848bc68fa2198eed82a94501816c782412e527b8f0e675b450961cbc49b172
Tip: Customize your compliance reviews with Lula.
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
First pass at this. I didn't get into the gateway reconciliation logic yet and haven't played with this locally yet, but wanted to provide this feedback as it will most likely change the architecture here a bit.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 27 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
89–410 |
src/pepr/operator/controllers/network/policies.ts |
88–411 |
src/pepr/operator/controllers/network/policies.ts |
87–412 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: 905f4f908e21bee60ea13d8b2e0673c8638cd1242afdd5853e3e0bdf50710ef2
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: bf1efc340e4c4be55a65f88bdb3521fc9413c71b30df191947cb07c0f193bf19
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 7ae32a183339a3c68b9eab7c0dbf014fee8af86bae929e220032e938a2b99f94
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
42–358 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: a841dc82d2f9ce560e3eebd132139492aea62a1b3708e84aa2ba36487dcdf392
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–347 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 67667359ef9223aeec97bb3606f0c51e89032edf33493f396470141e43a375d4
Tip: Customize your compliance reviews with Lula.
@joelmccoy Moved proxies into their own Gateway's namespace (matches how Istio does it). For custom gateways, that namespace just needs to be Zarf-managed + mesh-enrolled. same other workload, not new complexity. K3D_EXTRA_ARGS is wired through, and the new e2e test sends UDP through the real external path now (not just pod-to-pod). Had to route it through the node's NodePort since MetalLB's LB IP isn't reachable outside docker on k3d. |
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
Looking pretty good but a couple more overarching things I discovered in local testing we probably want to fix:
- The
envoy-default-gatewayshould be a separate zarf component and helm chart with the namespace declared in zarf (not in raw k8s manfests) - We should avoid using nodeport for the tests. This skips the loadbalancer and defeats the path we actually want to test.
- The e2e tests should probably swap to a call/response verification so that they are less likely to produce false positives the way they are written.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–347 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 97c7e41a66b318a54bff5eb417ed24d4a7f5a1800e3b78139fd718b484a8b575
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
| File | Lines Changed |
|---|---|
src/pepr/operator/reconcilers/package-reconciler.ts |
38–347 |
UUID: 5c6d86fa-5206-4bb5-a685-62ec52ff5694
sha256: 97c7e41a66b318a54bff5eb417ed24d4a7f5a1800e3b78139fd718b484a8b575
Tip: Customize your compliance reviews with Lula.
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
Looking pretty good. Playing around with this a bit more locally. But we should also make a couple docs updates:
-
https://github.com/defenseunicorns/uds-core/blob/main/docs/how-to-guides/networking/configure-non-http-ingress.mdx#L18
States "UDP ingress is not currently supported by Istio," which currently reads as "UDS Core can't do UDP." This should include a callout directing users to the native UDP expose path through Envoy Gateway and clarify that this guide only covers TCP over Istio. -
There is no mention of the
protocolfield or UDP exposes. At a minimum, this guide should include a section describing protocol selection or link to documentation covering UDP exposure via Envoy Gateway. -
New how-to guide for UDP expose: enable the components, create a Package CR with protocol: UDP, verify. Cover default-Gateway mode vs user-managed mode and the security implications (no Istio mTLS/AuthorizationPolicy).
We also need to add the new optional component in our IAC bundles like in the latest commit. We want to definitely verify the e2e tests on all our IAC before merging this in
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
Ok - happy with my testing locally. validated with multiple UDP servers and packages and the reconciliation and expose network paths work great. However the e2e tests still need a small modification to make our UDP server resiliient. We should not rely on killing the process on the pod to reset. This is very simple with the -w 1 on nc. I made these changes locally to validate a more resilient udp server. I would recommend incorporating these: https://github.com/defenseunicorns/uds-core/compare/chance/core-506...joel-udp-2?expand=1
After that is done and:
- Docs updated
- IAC bundles updated with new optional component and tests run
We should be good to get this in.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
Tip: Customize your compliance reviews with Lula.
Superseded by a new Lula compliance review.
There was a problem hiding this comment.
Lula Compliance Overview
Please review the changes to ensure they meet compliance standards.
Reviewed Changes
Lula reviewed 30 files changed that affect compliance.
| File | Lines Changed |
|---|---|
src/pepr/operator/controllers/network/policies.ts |
59–354 |
src/pepr/operator/controllers/network/policies.ts |
58–355 |
src/pepr/operator/controllers/network/policies.ts |
57–356 |
UUID: a9d420a8-1ad2-479f-a438-aa4ca0f57473
sha256: bf259cfadd4eb96690a9744154647ab7a93d869541336615cc9987433fff56fa
UUID: cd540e07-153b-424c-90e0-c0daec56b18f
sha256: 956c9ef9122fcb025658af2df233de90342d1240a04fe969e17615407c0354ee
UUID: cd540e07-153b-424c-90e0-c0daec56b16a
sha256: 135b7005987501c4678b3d3983883e12fa88b88d69935d0d6165b366d6dcb25b
Tip: Customize your compliance reviews with Lula.
2 participants
Description
Adds UDP ingress support to the Package CR's
spec.network.expose[]viaprotocol: HTTP | UDP. UDP entries route through Envoy Gateway instead of Istio.Schema:
protocol: HTTP | UDPon expose entriesanyOfrestructured:hostrequired only on HTTP branchesOperator:
udp-route-resources.tscontroller createsUDPRoute(Gateway API v1alpha2) and UDP ingress NetworkPolicy per expose entryGateway/envoy-default-gatewayinenvoy-default-gatewaywith port-based listeners,allowedRoutesscoped to declaring namespacegatewayfield, generates UDPRoute + NetworkPolicy onlycreationTimestampwins, ties broken by lexicographicuidEnvoyGatewayDefaultDisabled,UDPPortConflict(Phase.Failed)Package/envoy-gatewayinenvoy-gateway-systemfor availability flagIstio/Network:
E2E:
Related Issue
Relates to CORE-504, CORE-507
Type of change
Checklist before merging