[codex] Add Gateway endpoint DNS integration

Taskfile.yml

@@ -221,6 +221,7 @@ tasks:
       - task: controller-image:build
       - task: controller-image:load-kind
       - task: cert-manager:install
+      - task: gateway-api:install
       - task: manifests:apply
       - task: controller:rollout-status
 
@@ -249,12 +250,18 @@ tasks:
           --set crds.enabled=true \
           --wait
 
+  gateway-api:install:
+    desc: Install Gateway API CRDs into the current Kubernetes context.
+    cmds:
+      - kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
+      - kubectl wait --for=condition=Established crd/gatewayclasses.gateway.networking.k8s.io crd/gateways.gateway.networking.k8s.io crd/httproutes.gateway.networking.k8s.io --timeout=120s
+
   manifests:apply:
     desc: Generate and apply dns-api manifests to the current Kubernetes context.
     cmds:
       - task: manifests
       - kustomize build app/operator/config/crd | kubectl apply -f -
-      - kubectl wait --for=condition=Established crd/providers.dns.appthrust.io crd/zoneclasses.dns.appthrust.io crd/zones.dns.appthrust.io crd/recordsets.dns.appthrust.io crd/zoneunits.dns.appthrust.io crd/cloudflareidentities.cloudflare.dns.appthrust.io crd/route53identities.route53.dns.appthrust.io --timeout=120s
+      - kubectl wait --for=condition=Established crd/providers.dns.appthrust.io crd/zoneclasses.dns.appthrust.io crd/zones.dns.appthrust.io crd/recordsets.dns.appthrust.io crd/zoneunits.dns.appthrust.io crd/endpointprovidercapabilities.endpoint.dns.appthrust.io crd/endpointrecordsets.endpoint.dns.appthrust.io crd/cloudflareidentities.cloudflare.dns.appthrust.io crd/route53identities.route53.dns.appthrust.io --timeout=120s
       - kustomize build app/operator/config/default | kubectl apply -f -
 
   controller-image:build:
@@ -574,6 +581,7 @@ tasks:
         vars:
           KIND_CLUSTER: '{{.KIND_CLUSTER}}'
       - task: cert-manager:install
+      - task: gateway-api:install
       - task: local-irsa:install
         vars:
           LOCAL_IRSA_NAME: '{{.LOCAL_IRSA_NAME}}'
@@ -614,6 +622,7 @@ tasks:
         vars:
           KIND_CLUSTER: '{{.KIND_CLUSTER}}'
       - task: cert-manager:install
+      - task: gateway-api:install
       - task: manifests:apply
       - task: controller:rollout-status
       - task: controller:webhook-ready

app/operator/cmd/manager/main.go

@@ -4,6 +4,8 @@ import (
 	"flag"
 	"os"
 
+	endpointrecordsetcontroller "github.com/appthrust/dns-api/internal/go/apps/endpoint/controllers/endpointrecordset"
+	gatewayendpointcontroller "github.com/appthrust/dns-api/internal/go/apps/gatewayendpoint/controllers/gateway"
 	zoneunitcontroller "github.com/appthrust/dns-api/internal/go/core/controllers/zoneunit"
 	corewebhook "github.com/appthrust/dns-api/internal/go/core/webhook"
 	cloudflareidentity "github.com/appthrust/dns-api/internal/go/providers/cloudflare/controllers/identity"
@@ -13,9 +15,12 @@ import (
 	route53identity "github.com/appthrust/dns-api/internal/go/providers/route53/controllers/identity"
 	route53zoneclass "github.com/appthrust/dns-api/internal/go/providers/route53/controllers/zoneclass"
 	route53zoneunit "github.com/appthrust/dns-api/internal/go/providers/route53/controllers/zoneunit"
+	route53conversion "github.com/appthrust/dns-api/internal/go/providers/route53/conversion"
 	route53webhook "github.com/appthrust/dns-api/internal/go/providers/route53/webhook"
 	cloudflarev1alpha1 "github.com/appthrust/dns-api/pkg/go/api/cloudflare/v1alpha1"
 	dnsv1alpha1 "github.com/appthrust/dns-api/pkg/go/api/dns/v1alpha1"
+	endpointconversionv1alpha1 "github.com/appthrust/dns-api/pkg/go/api/endpoint/conversion/v1alpha1"
+	endpointv1alpha1 "github.com/appthrust/dns-api/pkg/go/api/endpoint/v1alpha1"
 	route53v1alpha1 "github.com/appthrust/dns-api/pkg/go/api/route53/v1alpha1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -24,11 +29,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
+// +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=create;get;list;update;watch
 // +kubebuilder:rbac:groups=cloudflare.dns.appthrust.io,resources=cloudflareidentities,verbs=get;list;patch;update;watch
 // +kubebuilder:rbac:groups=cloudflare.dns.appthrust.io,resources=cloudflareidentities/status,verbs=get;patch;update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=providers,verbs=get;list;watch
@@ -37,12 +44,19 @@ import (
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zones,verbs=get;list;watch;patch;update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zones/finalizers,verbs=update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zones/status,verbs=get;patch;update
-// +kubebuilder:rbac:groups=dns.appthrust.io,resources=recordsets,verbs=get;list;watch;patch;update
+// +kubebuilder:rbac:groups=dns.appthrust.io,resources=recordsets,verbs=create;delete;get;list;watch;patch;update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=recordsets/finalizers,verbs=update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=recordsets/status,verbs=get;patch;update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zoneunits,verbs=create;delete;get;list;watch;patch;update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zoneunits/finalizers,verbs=update
 // +kubebuilder:rbac:groups=dns.appthrust.io,resources=zoneunits/status,verbs=get;watch;patch;update
+// +kubebuilder:rbac:groups=endpoint.dns.appthrust.io,resources=endpointprovidercapabilities,verbs=get;list;watch
+// +kubebuilder:rbac:groups=endpoint.dns.appthrust.io,resources=endpointrecordsets,verbs=create;delete;get;list;watch;patch;update
+// +kubebuilder:rbac:groups=endpoint.dns.appthrust.io,resources=endpointrecordsets/status,verbs=get;patch;update
+// +kubebuilder:rbac:groups=endpoint.route53.dns.appthrust.io,resources=endpointrecordsetconversions,verbs=create
+// +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=gateways,verbs=get;list;watch
+// +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=httproutes,verbs=get;list;watch;update
+// +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=httproutes/finalizers,verbs=update
 // +kubebuilder:rbac:groups=route53.dns.appthrust.io,resources=route53identities,verbs=get;list;patch;update;watch
 // +kubebuilder:rbac:groups=route53.dns.appthrust.io,resources=route53identities/status,verbs=get;patch;update
 
@@ -52,13 +66,17 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(cloudflarev1alpha1.AddToScheme(scheme))
 	utilruntime.Must(dnsv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(endpointv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(endpointconversionv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(gatewayv1.Install(scheme))
 	utilruntime.Must(route53v1alpha1.AddToScheme(scheme))
 }
 
 func main() {
 	var metricsAddr string
 	var probeAddr string
 	var leaderElection bool
+	endpointRecordSetNamespace := envOrDefault("ENDPOINT_RECORDSET_NAMESPACE", "")
 	route53ControllerName := envOrDefault("ROUTE53_CONTROLLER_NAME", route53zoneunit.DefaultControllerName)
 	route53ProviderName := envOrDefault("ROUTE53_PROVIDER_NAME", route53v1alpha1.ProviderName)
 	route53ProviderVersion := envOrDefault("ROUTE53_PROVIDER_VERSION", route53v1alpha1.ProviderVersion)
@@ -69,6 +87,7 @@ func main() {
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.BoolVar(&leaderElection, "leader-elect", false, "Enable leader election for controller manager.")
+	flag.StringVar(&endpointRecordSetNamespace, "endpoint-recordset-namespace", endpointRecordSetNamespace, "Namespace where generated EndpointRecordSet and RecordSet resources are stored. Defaults to the source namespace.")
 	flag.StringVar(&route53ControllerName, "route53-controller-name", route53ControllerName, "ZoneClass.spec.controllerName handled by the Route 53 controller.")
 	flag.StringVar(&route53ProviderName, "route53-provider-name", route53ProviderName, "Provider.metadata.name handled by the Route 53 controller.")
 	flag.StringVar(&route53ProviderVersion, "route53-provider-version", route53ProviderVersion, "Provider version handled by the Route 53 controller.")
@@ -167,6 +186,25 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err := (&endpointrecordsetcontroller.Reconciler{
+		Client:             mgr.GetClient(),
+		Scheme:             mgr.GetScheme(),
+		RESTConfig:         mgr.GetConfig(),
+		RecordSetNamespace: endpointRecordSetNamespace,
+	}).SetupWithManager(mgr); err != nil {
+		ctrl.Log.Error(err, "unable to set up EndpointRecordSet controller")
+		os.Exit(1)
+	}
+
+	if err := (&gatewayendpointcontroller.Reconciler{
+		Client:                     mgr.GetClient(),
+		Scheme:                     mgr.GetScheme(),
+		EndpointRecordSetNamespace: endpointRecordSetNamespace,
+	}).SetupWithManager(mgr); err != nil {
+		ctrl.Log.Error(err, "unable to set up Gateway Endpoint controller")
+		os.Exit(1)
+	}
+
 	if err := corewebhook.SetupCoreValidationWebhookWithManager(mgr); err != nil {
 		ctrl.Log.Error(err, "unable to set up core validation webhook")
 		os.Exit(1)
@@ -179,6 +217,7 @@ func main() {
 		ctrl.Log.Error(err, "unable to set up Cloudflare validation webhook")
 		os.Exit(1)
 	}
+	route53conversion.NewHandler().Register(mgr.GetWebhookServer())
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		ctrl.Log.Error(err, "unable to set up health check")

app/operator/config/apiservice/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - route53_endpoint_conversion_apiservice.yaml

app/operator/config/apiservice/route53_endpoint_conversion_apiservice.yaml

@@ -0,0 +1,15 @@
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.endpoint.route53.dns.appthrust.io
+  annotations:
+    cert-manager.io/inject-ca-from: dns-api-system/dns-api-webhook-serving-cert
+spec:
+  group: endpoint.route53.dns.appthrust.io
+  version: v1alpha1
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: dns-api-webhook-service
+    namespace: dns-api-system
+    port: 443

app/operator/config/crd/bases/endpoint.dns.appthrust.io_endpointprovidercapabilities.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.2
+  name: endpointprovidercapabilities.endpoint.dns.appthrust.io
+spec:
+  group: endpoint.dns.appthrust.io
+  names:
+    kind: EndpointProviderCapability
+    listKind: EndpointProviderCapabilityList
+    plural: endpointprovidercapabilities
+    singular: endpointprovidercapability
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.provider.name
+      name: Provider
+      type: string
+    - jsonPath: .spec.provider.version
+      name: Version
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: EndpointProviderCapability declares endpoint app support for
+          one Core Provider version.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              conversion:
+                description: |-
+                  Conversion declares the aggregated API resource for provider-specific
+                  endpoint RecordSet conversion.
+                properties:
+                  group:
+                    description: Group is the API group that serves EndpointRecordSetConversion.
+                    minLength: 1
+                    type: string
+                  resource:
+                    description: Resource is the plural resource name, normally endpointrecordsetconversions.
+                    minLength: 1
+                    type: string
+                  version:
+                    description: Version defaults to spec.provider.version when omitted.
+                    type: string
+                required:
+                - group
+                - resource
+                type: object
+              provider:
+                description: Provider references a Core Provider version.
+                properties:
+                  name:
+                    description: Name is the cluster-scoped Provider resource name.
+                    minLength: 1
+                    type: string
+                  version:
+                    description: Version is the Provider version name.
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                - version
+                type: object
+            required:
+            - conversion
+            - provider
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources: {}