feat: Add TCPRoute support (#20)

* feat: Add TCPRoute support Signed-off-by: Philipp Plotnikov <[email protected]> * refactor: split plugin.go file content to the several files Signed-off-by: Philipp Plotnikov <[email protected]> * test: change tests Signed-off-by: Philipp Plotnikov <[email protected]> * refactor: run lint Signed-off-by: Philipp Plotnikov <[email protected]> * test: add TCPRoute tests Signed-off-by: Philipp Plotnikov <[email protected]> * docs: add documentation about TCPRoute Signed-off-by: Philipp Plotnikov <[email protected]> * refactor: change the location of httpRoute examples Signed-off-by: Philipp Plotnikov <[email protected]> --------- Signed-off-by: Philipp Plotnikov <[email protected]>
argoproj-labs · Sep 15, 2023 · d8d5410 · d8d5410
1 parent 474fe43
commit d8d5410
Show file tree

Hide file tree

Showing 10 changed files with 788 additions and 348 deletions.
diff --git a/Makefile b/Makefile
@@ -12,3 +12,11 @@ release:
 .PHONY: gateway-api-plugin-build
 gateway-api-plugin-build:
  CGO_ENABLED=0 GOOS=${GOOS} GOARCH=${GOARCH} go build -v -o ${DIST_DIR}/${BIN_NAME} .
+
+.PHONY: local-build
+local-build:
+ go build -gcflags=all="-N -l" -o gatewayapi-plugin
+
+.PHONY: lint
+lint:
+ golangci-lint run --fix
diff --git a/examples/tcproute/README.md b/examples/tcproute/README.md
@@ -0,0 +1,279 @@
+# Using Traefik Gateway API with Argo Rollouts
+
+This guide will describe how to use Traefik proxy an an implementation
+for the Gateway API in order to do split traffic with Argo Rollouts.
+
+Note that Argo Rollouts also [supports Traefik natively](https://argoproj.github.io/argo-rollouts/features/traffic-management/traefik/).
+
+## Step 1 - Enable Gateway Provider and create Gateway entrypoint
+
+Before enabling a Gateway Provider you also need to install Traefik. Follow the official [installation instructions](https://doc.traefik.io/traefik/getting-started/install-traefik/).
+
+You should also read the documentation on how [Traefik implements the Gateway API](https://doc.traefik.io/traefik/providers/kubernetes-gateway/).
+
+1. Register [Gateway API CRD](https://gateway-api.sigs.k8s.io/guides/#install-standard-channel)
+
+```
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v0.6.1/standard-install.yaml
+```
+
+2. Create the same deployment resource with service account
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: traefik
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: argo-rollouts-traefik-lb
+ template:
+ metadata:
+ labels:
+ app: argo-rollouts-traefik-lb
+ spec:
+ serviceAccountName: traefik-controller
+ containers:
+ - name: traefik
+ image: traefik:v2.9
+ args:
+ - --entrypoints.web.address=:80
+ - --entrypoints.websecure.address=:443
+ - --experimental.kubernetesgateway
+ - --providers.kubernetesgateway
+ ports:
+ - name: web
+ containerPort: 80
+```
+
+3. Create the same ServiceAccount
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: traefik-controller
+```
+
+4. Create Cluster Role resource with needed permissions for Gateway API provider.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: traefik-controller-role
+ namespace: aws-local-runtime
+rules:
+ - apiGroups:
+ - "*"
+ resources:
+ - "*"
+ verbs:
+ - "*"
+```
+
+Note that these permission are not very strict. You should lock them down according to your needs.
+
+5. Create Cluster Role Binding
+
+With the following role we allow Traefik to have write access to Http Routes and Gateways.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: traefik-admin
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: traefik-controller-role
+subjects:
+ - namespace: default
+ kind: ServiceAccount
+ name: traefik-controller
+```
+
+## Step 2 - Create GatewayClass and Gateway resources
+
+After we enabled the Gateway API provider in our controller we can create a GatewayClass and Gateway:
+
+- GatewayClass
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: GatewayClass
+metadata:
+ name: argo-rollouts-gateway-class
+spec:
+ controllerName: traefik.io/gateway-controller
+```
+
+- Gateway
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+ name: argo-rollouts-gateway
+spec:
+ gatewayClassName: argo-rollouts-gateway-class
+ listeners:
+ - protocol: TCP
+ name: tcp
+ port: 80 # one of Gateway entrypoint that we created at 1 step
+```
+
+## Step 3 - Create cluster entrypoint and map it with our Gateway entrypoint
+
+In different controllers entry points can be created differently. For Traefik controller we can create entry point like this:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: argo-rollouts-traefik-lb
+spec:
+ type: LoadBalancer
+ selector:
+ app: argo-rollouts-traefik-lb # selector of Gateway provider(step 1)
+ ports:
+ - protocol: TCP
+ port: 8080
+ targetPort: web # map with Gateway entrypoint
+ name: web
+```
+
+This concludes the setup that is specific to Traefik Proxy. The rest of the steps are generic to any implementation of the Gateway API.
+
+## Step 4 - Create TCPRoute that defines a traffic split
+
+Create TCPRoute and connect to the created Gateway resource
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: TCPRoute
+metadata:
+ name: argo-rollouts-tcp-route
+spec:
+ parentRefs:
+ - group: gateway.networking.k8s.io
+ kind: Gateway
+ name: argo-rollouts-gateway
+ sectionName: tcp
+ rules:
+ - backendRefs:
+ - name: argo-rollouts-stable-service
+ port: 80
+ - name: argo-rollouts-canary-service
+ port: 80
+```
+
+## Step 5 - Create canary and stable services for your application
+
+- Canary service
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: argo-rollouts-canary-service
+spec:
+ ports:
+ - port: 80
+ targetPort: http
+ protocol: TCP
+ name: http
+ selector:
+ app: rollouts-demo
+```
+
+- Stable service
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: argo-rollouts-stable-service
+spec:
+ ports:
+ - port: 80
+ targetPort: http
+ protocol: TCP
+ name: http
+ selector:
+ app: rollouts-demo
+```
+## Step 6 - Grant argo-rollouts permissions to view and modify Gateway TCPRoute resources
+
+The argo-rollouts service account needs the ability to be able to view and mofiy TCPRoutes as well as its existing permissions. Edit the `argo-rollouts` cluster role to add the following permissions:
+
+```yaml
+rules:
+- apiGroups:
+ - gateway.networking.k8s.io
+ resources:
+ - tcproutes
+ verbs:
+ - '*'
+```
+
+## Step 7 - Create argo-rollouts resources
+
+We can finally create the definition of the application.
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+ name: rollouts-demo
+spec:
+ replicas: 5
+ strategy:
+ canary:
+ canaryService: argo-rollouts-canary-service # our created canary service
+ stableService: argo-rollouts-stable-service # our created stable service
+ trafficRouting:
+ plugins:
+ argoproj-labs/gatewayAPI:
+ tcpRoute: argo-rollouts-tcp-route # our created tcproute
+ namespace: default # namespace where this rollout resides.
+ steps:
+ - setWeight: 30
+ - pause: {}
+ - setWeight: 40
+ - pause: { duration: 10 }
+ - setWeight: 60
+ - pause: { duration: 10 }
+ - setWeight: 80
+ - pause: { duration: 10 }
+ revisionHistoryLimit: 2
+ selector:
+ matchLabels:
+ app: rollouts-demo
+ template:
+ metadata:
+ labels:
+ app: rollouts-demo
+ spec:
+ containers:
+ - name: rollouts-demo
+ image: argoproj/rollouts-demo:red
+ ports:
+ - name: http
+ containerPort: 8080
+ protocol: TCP
+ resources:
+ requests:
+ memory: 32Mi
+ cpu: 5m
+```
+
+Apply all the yaml files to your cluster
+
+## Step 8 - Test the canary
+
+Perform a deployment like any other Rollout and the Gateway plugin will split the traffic to your canary by instructing Traefik proxy via the Gateway API
+
+
diff --git a/go.mod b/go.mod
@@ -1,69 +1,69 @@
 module github.com/argoproj-labs/rollouts-plugin-trafficrouter-gatewayapi
 
-go 1.19
+go 1.20
 
 require (
- github.com/argoproj/argo-rollouts v1.4.0-rc1.0.20230310073321-5fef78a8e47b
- github.com/hashicorp/go-plugin v1.4.9
- github.com/sirupsen/logrus v1.9.0
- github.com/stretchr/testify v1.8.2
- k8s.io/client-go v0.26.0
- sigs.k8s.io/gateway-api v0.6.1
+ github.com/argoproj/argo-rollouts v1.5.1
+ github.com/hashicorp/go-plugin v1.4.10
+ github.com/sirupsen/logrus v1.9.3
+ github.com/stretchr/testify v1.8.4
+ k8s.io/client-go v0.28.0
+ sigs.k8s.io/gateway-api v0.7.1
 )
 
 require (
  github.com/davecgh/go-spew v1.1.1 // indirect
  github.com/evanphx/json-patch v5.6.0+incompatible // indirect
- github.com/fatih/color v1.12.0 // indirect
+ github.com/fatih/color v1.15.0 // indirect
+ github.com/google/gnostic-models v0.6.8 // indirect
  github.com/google/go-cmp v0.5.9 // indirect
- github.com/hashicorp/go-hclog v0.14.1 // indirect
- github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb // indirect
- github.com/imdario/mergo v0.3.13 // indirect
- github.com/mattn/go-colorable v0.1.12 // indirect
- github.com/mattn/go-isatty v0.0.14 // indirect
- github.com/mitchellh/go-testing-interface v1.0.0 // indirect
+ github.com/google/uuid v1.3.0 // indirect
+ github.com/hashicorp/go-hclog v1.5.0 // indirect
+ github.com/hashicorp/yamux v0.1.1 // indirect
+ github.com/imdario/mergo v0.3.16 // indirect
+ github.com/mattn/go-colorable v0.1.13 // indirect
+ github.com/mattn/go-isatty v0.0.19 // indirect
+ github.com/mitchellh/go-testing-interface v1.14.1 // indirect
  github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
- github.com/oklog/run v1.0.0 // indirect
+ github.com/oklog/run v1.1.0 // indirect
  github.com/pkg/errors v0.9.1 // indirect
  github.com/pmezard/go-difflib v1.0.0 // indirect
  github.com/spf13/pflag v1.0.5 // indirect
- golang.org/x/oauth2 v0.5.0 // indirect
- golang.org/x/term v0.5.0 // indirect
+ golang.org/x/oauth2 v0.11.0 // indirect
+ golang.org/x/term v0.11.0 // indirect
  golang.org/x/time v0.3.0 // indirect
  google.golang.org/appengine v1.6.7 // indirect
- google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
- google.golang.org/grpc v1.53.0 // indirect
- gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+ google.golang.org/genproto/googleapis/rpc v0.0.0-20230815205213-6bfd019c3878 // indirect
+ google.golang.org/grpc v1.57.0 // indirect
  sigs.k8s.io/yaml v1.3.0 // indirect
 )
 
 require (
- github.com/emicklei/go-restful/v3 v3.9.0 // indirect
- github.com/go-logr/logr v1.2.3 // indirect
- github.com/go-openapi/jsonpointer v0.19.5 // indirect
- github.com/go-openapi/jsonreference v0.20.0 // indirect
- github.com/go-openapi/swag v0.21.1 // indirect
+ github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+ github.com/go-logr/logr v1.2.4 // indirect
+ github.com/go-openapi/jsonpointer v0.20.0 // indirect
+ github.com/go-openapi/jsonreference v0.20.2 // indirect
+ github.com/go-openapi/swag v0.22.4 // indirect
  github.com/gogo/protobuf v1.3.2 // indirect
  github.com/golang/protobuf v1.5.3 // indirect
- github.com/google/gnostic v0.6.9 // indirect
  github.com/google/gofuzz v1.2.0 // indirect
  github.com/josharian/intern v1.0.0 // indirect
  github.com/json-iterator/go v1.1.12 // indirect
  github.com/mailru/easyjson v0.7.7 // indirect
  github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
  github.com/modern-go/reflect2 v1.0.2 // indirect
- golang.org/x/net v0.7.0 // indirect
- golang.org/x/sys v0.5.0 // indirect
- golang.org/x/text v0.7.0 // indirect
- google.golang.org/protobuf v1.29.0 // indirect
+ golang.org/x/net v0.14.0 // indirect
+ golang.org/x/sys v0.11.0 // indirect
+ golang.org/x/text v0.12.0 // indirect
+ google.golang.org/protobuf v1.31.0 // indirect
  gopkg.in/inf.v0 v0.9.1 // indirect
  gopkg.in/yaml.v2 v2.4.0 // indirect
  gopkg.in/yaml.v3 v3.0.1 // indirect
- k8s.io/api v0.26.0 // indirect
- k8s.io/apimachinery v0.26.0
- k8s.io/klog/v2 v2.80.1 // indirect
- k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
- k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect
- sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
- sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+ k8s.io/api v0.28.0 // indirect
+ k8s.io/apimachinery v0.28.0
+ k8s.io/klog/v2 v2.100.1 // indirect
+ k8s.io/kube-openapi v0.0.0-20230816210353-14e408962443 // indirect
+ k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+ sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+ sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
 )