PMREQ-821: Add Gateway API support to Manager controller - #5032
Open
vara2504 wants to merge 1 commit into
Open
Conversation
vara2504
force-pushed
the
vara-PMREQ-821-cig-manager
branch
4 times, most recently
from
July 28, 2026 20:50
a64f333 to
4391647
Compare
vara2504
force-pushed
the
vara-PMREQ-821-cig-manager
branch
2 times, most recently
from
July 30, 2026 17:35
5e30953 to
d7953bf
Compare
Add spec.gateway to the Manager CR. When set (and a GatewayAPI CR exists), the manager controller renders Gateway API resources to expose the Manager UI through CIG: an HTTPS Gateway with TLS termination and an operator-provisioned certificate, an HTTPRoute, an Envoy Gateway Backend that re-originates TLS to calico-manager:9443 trusting tigera-ca-bundle, and — for a custom gateway namespace — a ReferenceGrant. A shared pkg/render/gateway package carries the rendering so Whisker can reuse it. Namespace handling: the gateway namespace is user-configurable and created on demand (never deleted — it may hold user workloads). In calico-system the component also renders the proxy ServiceAccount, RoleBinding, and a NetworkPolicy covering the default-deny (ingress on the remapped port 10443, egress to the Gateway controller and Manager). In a custom namespace those are left to the GatewayAPI controller's per-namespace machinery, matching user-brought Gateways; the TLS secret is rendered after the Gateway because the operator only gains secret access there once the GatewayAPI controller sees the Gateway. Cleanup is label-driven: the Gateway carries an operator.tigera.io/gateway label, and each reconcile tears down any labeled Gateway's namespace that no longer matches the spec — covering namespace changes and spec.gateway removal without stored state. On a namespace move the Backend is kept (the new render still routes through it) and the ReferenceGrant is deleted only when moving into the backend namespace. Status follows the design: gateway validation failures (GatewayAPI CR missing, unresolvable class, hostname/managerDomain mismatch) and unhealthy Gateway/HTTPRoute conditions set Degraded and requeue every 30s until Envoy converges; deployed resources are never torn down. The Gateway/HTTPRoute watch uses a name-matching predicate that accepts status-only events, and the gateway TLS secret is watched across namespaces with its truth copy persisted via the CertificateManagement component so the certificate is minted once, not per reconcile. spec.gateway on a multi-tenant tenant Manager sets Degraded(InvalidConfigurationError): resource names and the cleanup label carry no tenant identity, so multi-tenant support needs its own design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
vara2504
force-pushed
the
vara-PMREQ-821-cig-manager
branch
from
July 30, 2026 18:39
d7953bf to
8794908
Compare
vara2504
marked this pull request as ready for review
July 30, 2026 18:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
New feature (PMREQ-821): adds
spec.gatewayto the Manager CR, exposing the Manager UI through Calico Ingress Gateway (CIG).Design: https://github.com/tigera/designs/pull/73
GatewaySpectype (api/v1/gateway_types.go) withhostname,gatewayNamespace, andgatewayClassName— reusable by Whisker later.pkg/render/gatewayproducing Gateway, HTTPRoute, Backend (Envoy Gateway), ReferenceGrant, and TLS Secret. Proxy SA/RoleBinding/NetworkPolicy are rendered only when the Gateway runs in the backend namespace; custom namespaces are left to the GatewayAPI controller, matching user-brought Gateways.Authentication.spec.managerDomain(scheme/port ignored), provisions a TLS keypair (persisted in the truth namespace), and provisions custom gateway namespaces.operator.tigera.io/gateway): removingspec.gatewayor moving namespaces tears down exactly the leftover resources, with no stored state.spec.gatewaywithInvalidConfigurationError.Components affected: Manager controller, new
pkg/render/gatewaypackage, Manager CRD.Companion PRs:
spec.gatewaymust reach calico-private manifests (pending; API servers prune the field until then).Testing:
pkg/render/gateway/component_test.go)managerDomainHost)Manual OIDC testing:
Release Note
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.