Repository navigation
feat: expose Ascender and the mesh ingress through the Gateway API - #63
Open
ssimpson89 wants to merge 1 commit into
Open
ssimpson89 wants to merge 1 commit into
ssimpson89 wants to merge 1 commit into
Conversation
ingress_type gains httproute on the Ascender and AWX kinds and tlsroute on the mesh ingress kinds. Each creates a gateway.networking.k8s.io/v1 route attached to a Gateway the cluster already runs, named by gateway_parent_refs. The operator never creates the Gateway; its listeners and certificates belong to whoever operates it. Hostnames come from ingress_hosts or hostname and the path from ingress_path, as for an Ingress. The mesh ingress gains external_port, the port remote nodes dial, defaulting to 443. When ingress_type changes, the object the previous value created is deleted once the new one is in place, if this CR owns it. A switch to a route waits for every Gateway named to accept it first, and fails with the route's conditions, keeping the old object, if they do not. The value last reconciled is kept in status.ingressType, so a CR reconciled for the first time deletes nothing, and a change to none deletes nothing either. Existing CRs that keep their ingress_type render exactly what they did before. hack/migrate-awx-to-ascender.sh carries Routes and HTTPRoutes across to the new owner. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The new Gateway resources do not guarantee the required owner and repository metadata tags.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds Gateway API exposure for Ascender web traffic and mesh ingress, with safe cleanup when changing ingress types.
Changes:
- Adds HTTPRoute and TLSRoute generation, validation, RBAC, and CRD fields.
- Tracks the reconciled ingress type and removes superseded owned resources.
- Documents Gateway configuration and updates migration support.
| File | Description |
|---|---|
roles/mesh_ingress/templates/ingress.yml.j2 |
Generates TLSRoutes. |
roles/mesh_ingress/tasks/creation.yml |
Validates and reconciles mesh routes. |
roles/mesh_ingress/defaults/main.yml |
Adds Gateway and external-port defaults. |
roles/installer/templates/networking/ingress.yaml.j2 |
Generates HTTPRoutes. |
roles/installer/tasks/install.yml |
Validates and reconciles HTTPRoutes. |
roles/installer/defaults/main.yml |
Adds Gateway defaults. |
roles/common/tasks/remove_previous_ingress.yml |
Removes superseded ingress resources. |
roles/common/tasks/check_gateway_api.yml |
Checks Gateway API availability. |
hack/migrate-awx-to-ascender.sh |
Includes supported route resources during migration. |
docs/user-guide/network-and-tls-configuration.md |
Documents HTTPRoute usage and switching. |
docs/user-guide/advanced-configuration/mesh-ingress.md |
Documents TLSRoute mesh ingress. |
config/rbac/role.yaml |
Grants route-management permissions. |
config/manifests/bases/awx-operator.clusterserviceversion.yaml |
Exposes new operator fields. |
config/crd/bases/awx.ansible.com_awxs.yaml |
Extends the AWX schema. |
config/crd/bases/awx.ansible.com_awxmeshingresses.yaml |
Extends the AWX mesh schema. |
config/crd/bases/ascender.ansible.com_ascenders.yaml |
Extends the Ascender schema. |
config/crd/bases/ascender.ansible.com_ascendermeshingresses.yaml |
Extends the Ascender mesh schema. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Kubernetes Gateway API as a way to expose Ascender, alongside the existing
ingressandrouteoptions.ingress_type: httproutecreates anHTTPRoutefor the web UI, andingress_type: tlsroutecreates aTLSRoutewith TLS passthrough for mesh ingress, both attached to an existing Gateway named ingateway_parent_refs. The operator never creates the Gateway. Wheningress_typechanges, the Ingress or Route the operator created for the previous value is deleted once the Gateway has accepted the new route; existing deployments are unchanged. Tested end to end on k3s with Traefik as the Gateway.🤖 Generated with Claude Code