[rlp-v2] WasmPlugin reconciliation

api/v1beta2/ratelimitpolicy_types.go

@@ -25,7 +25,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gatewayapiv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatewayapiv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 )
 
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
@@ -40,13 +39,14 @@ import (
 // +kubebuilder:validation:MaxLength=253
 type ContextSelector string
 
-// +kubebuilder:validation:Enum:=eq;neq;startswith;incl;excl;matches
+// +kubebuilder:validation:Enum:=eq;neq;startswith;endswith;incl;excl;matches
 type WhenConditionOperator string
 
 const (
 	EqualOperator      WhenConditionOperator = "eq"
 	NotEqualOperator   WhenConditionOperator = "neq"
 	StartsWithOperator WhenConditionOperator = "startswith"
+	EndsWithOperator   WhenConditionOperator = "endswith"
 	IncludeOperator    WhenConditionOperator = "incl"
 	ExcludeOperator    WhenConditionOperator = "excl"
 	MatchesOperator    WhenConditionOperator = "matches"
@@ -83,20 +83,6 @@ type WhenCondition struct {
 	Value string `json:"value"`
 }
 
-// RouteSelector defines semantics for matching an HTTP request based on conditions
-// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
-type RouteSelector struct {
-	// Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request
-	// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
-	// +optional
-	Hostnames []gatewayapiv1beta1.Hostname `json:"hostnames,omitempty"`
-
-	// Matches define conditions used for matching the rule against incoming HTTP requests.
-	// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
-	// +optional
-	Matches []gatewayapiv1beta1.HTTPRouteMatch `json:"matches,omitempty"`
-}
-
 // Limit represents a complete rate limit configuration
 type Limit struct {
 	// RouteSelectors defines semantics for matching an HTTP request based on conditions
@@ -197,6 +183,15 @@ func (r *RateLimitPolicy) Validate() error {
 		return fmt.Errorf("invalid targetRef.Namespace %s. Currently only supporting references to the same namespace", *r.Spec.TargetRef.Namespace)
 	}
 
+	// prevents usage of routeSelectors in a gateway RLP
+	if r.Spec.TargetRef.Kind == gatewayapiv1alpha2.Kind("Gateway") {
+		for _, limit := range r.Spec.Limits {
+			if len(limit.RouteSelectors) > 0 {
+				return fmt.Errorf("route selectors not supported when targetting a Gateway")
+			}
+		}
+	}
+
 	return nil
 }
 

api/v1beta2/route_selectors.go

@@ -0,0 +1,52 @@
+package v1beta2
+
+import (
+	gatewayapiv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+
+	orderedmap "github.com/elliotchance/orderedmap/v2"
+
+	"github.com/kuadrant/kuadrant-operator/pkg/common"
+)
+
+// RouteSelector defines semantics for matching an HTTP request based on conditions
+// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
+type RouteSelector struct {
+	// Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request
+	// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
+	// +optional
+	Hostnames []gatewayapiv1beta1.Hostname `json:"hostnames,omitempty"`
+
+	// Matches define conditions used for matching the rule against incoming HTTP requests.
+	// https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec
+	// +optional
+	Matches []gatewayapiv1beta1.HTTPRouteMatch `json:"matches,omitempty"`
+}
+
+// SelectRules returns, from a HTTPRoute, all HTTPRouteRules that either specify no HTTRouteMatches or that contain at
+// least one HTTRouteMatch whose statements expressly include (partially or totally) the statements of at least one of
+// the matches of the selector. If the selector does not specify any matches, then all HTTPRouteRules are selected.
+//
+// Additionally, if the selector specifies a non-empty list of hostnames, a non-empty intersection between the literal
+// hostnames of the selector and set of hostnames specified in the HTTPRoute must exist. Otherwise, the function
+// returns nil.
+func (s *RouteSelector) SelectRules(route *gatewayapiv1beta1.HTTPRoute) (rules []gatewayapiv1beta1.HTTPRouteRule) {
+	rulesIndices := orderedmap.NewOrderedMap[int, gatewayapiv1beta1.HTTPRouteRule]()
+	if len(s.Hostnames) > 0 && !common.Intersect(s.Hostnames, route.Spec.Hostnames) {
+		return nil
+	}
+	if len(s.Matches) == 0 {
+		return route.Spec.Rules
+	}
+	for _, routeSelectorMatch := range s.Matches {
+		for idx, rule := range route.Spec.Rules {
+			rs := common.HTTPRouteRuleSelector{HTTPRouteMatch: &routeSelectorMatch}
+			if rs.Selects(rule) {
+				rulesIndices.Set(idx, rule)
+			}
+		}
+	}
+	for el := rulesIndices.Front(); el != nil; el = el.Next() {
+		rules = append(rules, el.Value)
+	}
+	return
+}

api/v1beta2/route_selectors_test.go

@@ -0,0 +1,211 @@
+//go:build unit
+
+package v1beta2
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gatewayapiv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+
+	"github.com/kuadrant/kuadrant-operator/pkg/common"
+)
+
+func TestRouteSelectors(t *testing.T) {
+	gatewayHostnames := []gatewayapiv1beta1.Hostname{
+		"*.toystore.com",
+	}
+
+	gateway := &gatewayapiv1beta1.Gateway{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "my-gateway",
+		},
+	}
+
+	for _, hostname := range gatewayHostnames {
+		gateway.Spec.Listeners = append(gateway.Spec.Listeners, gatewayapiv1beta1.Listener{Hostname: &hostname})
+	}
+
+	route := &gatewayapiv1beta1.HTTPRoute{
+		Spec: gatewayapiv1beta1.HTTPRouteSpec{
+			CommonRouteSpec: gatewayapiv1beta1.CommonRouteSpec{
+				ParentRefs: []gatewayapiv1beta1.ParentReference{
+					{
+						Name: gatewayapiv1beta1.ObjectName(gateway.Name),
+					},
+				},
+			},
+			Hostnames: []gatewayapiv1beta1.Hostname{"api.toystore.com"},
+			Rules: []gatewayapiv1beta1.HTTPRouteRule{
+				{
+					Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+						// get /toys*
+						{
+							Path: &gatewayapiv1beta1.HTTPPathMatch{
+								Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+								Value: &[]string{"/toy"}[0],
+							},
+							Method: &[]gatewayapiv1beta1.HTTPMethod{gatewayapiv1beta1.HTTPMethod("GET")}[0],
+						},
+						// post /toys*
+						{
+							Path: &gatewayapiv1beta1.HTTPPathMatch{
+								Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+								Value: &[]string{"/toy"}[0],
+							},
+							Method: &[]gatewayapiv1beta1.HTTPMethod{gatewayapiv1beta1.HTTPMethod("POST")}[0],
+						},
+					},
+				},
+				{
+					Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+						// /assets*
+						{
+							Path: &gatewayapiv1beta1.HTTPPathMatch{
+								Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+								Value: &[]string{"/assets"}[0],
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	testCases := []struct {
+		name          string
+		routeSelector RouteSelector
+		route         *gatewayapiv1beta1.HTTPRoute
+		expected      []gatewayapiv1beta1.HTTPRouteRule
+	}{
+		{
+			name:          "empty route selector selects all HTTPRouteRules",
+			routeSelector: RouteSelector{},
+			route:         route,
+			expected:      route.Spec.Rules,
+		},
+		{
+			name: "route selector selects the HTTPRouteRules whose set of HTTPRouteMatch is a perfect match",
+			routeSelector: RouteSelector{
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+							Value: &[]string{"/assets"}[0],
+						},
+					},
+				},
+			},
+			route:    route,
+			expected: []gatewayapiv1beta1.HTTPRouteRule{route.Spec.Rules[1]},
+		},
+		{
+			name: "route selector selects the HTTPRouteRules whose set of HTTPRouteMatch contains at least one match",
+			routeSelector: RouteSelector{
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+							Value: &[]string{"/toy"}[0],
+						},
+						Method: &[]gatewayapiv1beta1.HTTPMethod{gatewayapiv1beta1.HTTPMethod("POST")}[0],
+					},
+				},
+			},
+			route:    route,
+			expected: []gatewayapiv1beta1.HTTPRouteRule{route.Spec.Rules[0]},
+		},
+		{
+			name: "route selector with missing part of a HTTPRouteMatch still selects the HTTPRouteRules that match",
+			routeSelector: RouteSelector{
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+							Value: &[]string{"/toy"}[0],
+						},
+					},
+				},
+			},
+			route:    route,
+			expected: []gatewayapiv1beta1.HTTPRouteRule{route.Spec.Rules[0]},
+		},
+		{
+			name: "route selector selects no HTTPRouteRule when no criterion matches",
+			routeSelector: RouteSelector{
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchExact}[0],
+							Value: &[]string{"/toy"}[0],
+						},
+					},
+				},
+			},
+			route:    route,
+			expected: nil,
+		},
+		{
+			name: "route selector selects the HTTPRouteRules whose HTTPRoute's hostnames match the selector",
+			routeSelector: RouteSelector{
+				Hostnames: []gatewayapiv1beta1.Hostname{"api.toystore.com"},
+			},
+			route:    route,
+			expected: route.Spec.Rules,
+		},
+		{
+			name: "route selector selects the HTTPRouteRules whose HTTPRoute's hostnames match the selector additionally to other criteria",
+			routeSelector: RouteSelector{
+				Hostnames: []gatewayapiv1beta1.Hostname{"api.toystore.com"},
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+							Value: &[]string{"/toy"}[0],
+						},
+					},
+				},
+			},
+			route:    route,
+			expected: []gatewayapiv1beta1.HTTPRouteRule{route.Spec.Rules[0]},
+		},
+		{
+			name: "route selector does not select HTTPRouteRules whose HTTPRoute's hostnames do not match the selector",
+			routeSelector: RouteSelector{
+				Hostnames: []gatewayapiv1beta1.Hostname{"www.toystore.com"},
+			},
+			route:    route,
+			expected: nil,
+		},
+		{
+			name: "route selector does not select HTTPRouteRules whose HTTPRoute's hostnames do not match the selector even when other criteria match",
+			routeSelector: RouteSelector{
+				Hostnames: []gatewayapiv1beta1.Hostname{"www.toystore.com"},
+				Matches: []gatewayapiv1beta1.HTTPRouteMatch{
+					{
+						Path: &gatewayapiv1beta1.HTTPPathMatch{
+							Type:  &[]gatewayapiv1beta1.PathMatchType{gatewayapiv1beta1.PathMatchPathPrefix}[0],
+							Value: &[]string{"/toy"}[0],
+						},
+					},
+				},
+			},
+			route:    route,
+			expected: nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			rules := tc.routeSelector.SelectRules(tc.route)
+			rulesToStringSlice := func(rules []gatewayapiv1beta1.HTTPRouteRule) []string {
+				return common.Map(common.Map(rules, common.HTTPRouteRuleToString), func(r string) string { return fmt.Sprintf("{%s}", r) })
+			}
+			if !reflect.DeepEqual(rules, tc.expected) {
+				t.Errorf("expected %v, got %v", rulesToStringSlice(tc.expected), rulesToStringSlice(rules))
+			}
+		})
+	}
+}

bundle/manifests/kuadrant.io_ratelimitpolicies.yaml

@@ -270,6 +270,7 @@ spec:
                             - eq
                             - neq
                             - startswith
+                            - endswith
                             - incl
                             - excl
                             - matches

config/crd/bases/kuadrant.io_ratelimitpolicies.yaml

@@ -269,6 +269,7 @@ spec:
                             - eq
                             - neq
                             - startswith
+                            - endswith
                             - incl
                             - excl
                             - matches