feat(controllers) add IngressClass v1

CHANGELOG.md

@@ -48,6 +48,12 @@
 
 > Release date: TBD
 
+#### Added
+
+- Deployment manifests now include an IngressClass resource and permissions to
+ read IngressClass resources.
+ [#2292](https:/Kong/kubernetes-ingress-controller/pull/2292)
+
 #### Fixed
 
 - Unconfigured fields now use their default value according to the Kong proxy

config/base/ingressclass.yaml

@@ -0,0 +1,6 @@
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+ name: kong
+spec:
+ controller: ingress-controllers.konghq.com/kong

config/base/kustomization.yaml

@@ -3,6 +3,7 @@ resources:
 - namespace.yaml
 - ../crd
 - ../rbac
+- ingressclass.yaml
 - service.yaml
 - serviceaccount.yaml
 - validation-service.yaml

config/rbac/role.yaml

@@ -248,6 +248,14 @@ rules:
  - get
  - patch
  - update
+- apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - networking.k8s.io
  resources:

deploy/single/all-in-one-dbless-k4k8s-enterprise.yaml

@@ -1198,6 +1198,14 @@ rules:
  - get
  - patch
  - update
+- apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - networking.k8s.io
  resources:
@@ -1414,3 +1422,10 @@ spec:
  imagePullSecrets:
  - name: kong-enterprise-edition-docker
  serviceAccountName: kong-serviceaccount
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+ name: kong
+spec:
+ controller: ingress-controllers.konghq.com/kong

deploy/single/all-in-one-dbless.yaml

@@ -1198,6 +1198,14 @@ rules:
  - get
  - patch
  - update
+- apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - networking.k8s.io
  resources:
@@ -1407,3 +1415,10 @@ spec:
  successThreshold: 1
  timeoutSeconds: 1
  serviceAccountName: kong-serviceaccount
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+ name: kong
+spec:
+ controller: ingress-controllers.konghq.com/kong

deploy/single/all-in-one-postgres-enterprise.yaml

@@ -1198,6 +1198,14 @@ rules:
  - get
  - patch
  - update
+- apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - networking.k8s.io
  resources:
@@ -1597,3 +1605,10 @@ spec:
  image: busybox
  name: wait-for-postgres
  restartPolicy: OnFailure
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+ name: kong
+spec:
+ controller: ingress-controllers.konghq.com/kong

deploy/single/all-in-one-postgres.yaml

@@ -1198,6 +1198,14 @@ rules:
  - get
  - patch
  - update
+- apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - networking.k8s.io
  resources:
@@ -1522,3 +1530,10 @@ spec:
  image: busybox
  name: wait-for-postgres
  restartPolicy: OnFailure
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+ name: kong
+spec:
+ controller: ingress-controllers.konghq.com/kong

hack/generators/controllers/networking/main.go

@@ -39,6 +39,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "services",
  URL: "\"\"",
  CacheType: "Service",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: false,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -51,6 +52,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "endpoints",
  URL: "\"\"",
  CacheType: "Endpoint",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: false,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"list", "watch"},
@@ -63,6 +65,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "secrets",
  URL: "\"\"",
  CacheType: "Secret",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: false,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"list", "watch"},
@@ -75,10 +78,24 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "ingresses",
  URL: "networking.k8s.io",
  CacheType: "IngressV1",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: true,
  RBACVerbs: []string{"get", "list", "watch"},
  },
+ typeNeeded{
+ PackageImportAlias: "netv1",
+ PackageAlias: "NetV1",
+ Package: netv1,
+ Type: "IngressClass",
+ Plural: "ingressclasses",
+ URL: "networking.k8s.io",
+ CacheType: "IngressV1",
+ NeedsStatusPermissions: false,
+ AcceptsIngressClassNameAnnotation: false,
+ AcceptsIngressClassNameSpec: false,
+ RBACVerbs: []string{"get", "list", "watch"},
+ },
  typeNeeded{
  PackageImportAlias: "netv1beta1",
  PackageAlias: "NetV1Beta1",
@@ -87,6 +104,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "ingresses",
  URL: "networking.k8s.io",
  CacheType: "IngressV1beta1",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: true,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -99,6 +117,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "ingresses",
  URL: "extensions",
  CacheType: "IngressV1beta1",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: true,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -111,6 +130,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "kongingresses",
  URL: "configuration.konghq.com",
  CacheType: "KongIngress",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: false,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -123,6 +143,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "kongplugins",
  URL: "configuration.konghq.com",
  CacheType: "Plugin",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: false,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -135,6 +156,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "kongclusterplugins",
  URL: "configuration.konghq.com",
  CacheType: "ClusterPlugin",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -147,6 +169,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "kongconsumers",
  URL: "configuration.konghq.com",
  CacheType: "Consumer",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -159,6 +182,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "tcpingresses",
  URL: "configuration.konghq.com",
  CacheType: "TCPIngress",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -171,6 +195,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "udpingresses",
  URL: "configuration.konghq.com",
  CacheType: "UDPIngress",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -183,6 +208,7 @@ var inputControllersNeeded = &typesNeeded{
  Plural: "ingresses",
  URL: "networking.internal.knative.dev",
  CacheType: "KnativeIngress",
+ NeedsStatusPermissions: true,
  AcceptsIngressClassNameAnnotation: true,
  AcceptsIngressClassNameSpec: false,
  RBACVerbs: []string{"get", "list", "watch"},
@@ -299,6 +325,10 @@ type typeNeeded struct {
  // AcceptsIngressClassNameSpec indicates the the object indicates the ingress.class that should support it via
  // an attribute in its specification named .IngressClassName
  AcceptsIngressClassNameSpec bool
+
+ // NeedsStatusPermissions indicates whether permissions for the object should also include permissions to update
+ // its status
+ NeedsStatusPermissions bool
 }
 
 func (t *typeNeeded) generate(contents *bytes.Buffer) error {
@@ -394,7 +424,9 @@ func (r *{{.PackageAlias}}{{.Type}}Reconciler) SetupWithManager(mgr ctrl.Manager
 }
 
 //+kubebuilder:rbac:groups={{.URL}},resources={{.Plural}},verbs={{ .RBACVerbs | join ";" }}
+{{- if .NeedsStatusPermissions}}
 //+kubebuilder:rbac:groups={{.URL}},resources={{.Plural}}/status,verbs=get;update;patch
+{{- end}}
 
 // Reconcile processes the watched objects
 func (r *{{.PackageAlias}}{{.Type}}Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

internal/manager/config.go

@@ -69,6 +69,7 @@ type Config struct {
  IngressExtV1beta1Enabled bool
  IngressNetV1beta1Enabled bool
  IngressNetV1Enabled bool
+ IngressClassNetV1Enabled bool
  UDPIngressEnabled bool
  TCPIngressEnabled bool
  KongIngressEnabled bool
@@ -155,6 +156,7 @@ func (c *Config) FlagSet() *pflag.FlagSet {
 
  // Kubernetes API toggling
  flagSet.BoolVar(&c.IngressNetV1Enabled, "enable-controller-ingress-networkingv1", true, "Enable the networking.k8s.io/v1 Ingress controller.")
+ flagSet.BoolVar(&c.IngressClassNetV1Enabled, "enable-controller-ingress-class-networkingv1", true, "Enable the networking.k8s.io/v1 IngressClass controller.")
  flagSet.BoolVar(&c.IngressNetV1beta1Enabled, "enable-controller-ingress-networkingv1beta1", true, "Enable the networking.k8s.io/v1beta1 Ingress controller.")
  flagSet.BoolVar(&c.IngressExtV1beta1Enabled, "enable-controller-ingress-extensionsv1beta1", true, "Enable the extensions/v1beta1 Ingress controller.")
  flagSet.BoolVar(&c.UDPIngressEnabled, "enable-controller-udpingress", true, "Enable the UDPIngress controller.")

internal/manager/controllerdef.go

@@ -83,6 +83,16 @@ func setupControllers(mgr manager.Manager, proxy proxy.Proxy, c *Config, feature
  IngressClassName: c.IngressClassName,
  },
  },
+ {
+ Enabled: c.IngressClassNetV1Enabled,
+ AutoHandler: ingressPicker.IsNetV1,
+ Controller: &configuration.NetV1IngressClassReconciler{
+ Client: mgr.GetClient(),
+ Log: ctrl.Log.WithName("controllers").WithName("IngressClass").WithName("netv1"),
+ Scheme: mgr.GetScheme(),
+ Proxy: proxy,
+ },
+ },
  {
  Enabled: c.IngressNetV1beta1Enabled,
  AutoHandler: ingressPicker.IsNetV1beta1,