Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

layered future: indicate whether a policy is implemented by the waypoint #3014

Open
ilrudie opened this issue Dec 5, 2023 · 7 comments
Open
Assignees

Comments

@ilrudie
Copy link

ilrudie commented Dec 5, 2023

Describe the feature request

Implementations with variance from stock MUST adopt the mechanism used by the Gateway API specification to indicate whether a policy is successfully implemented by a Waypoint. See PolicyAncestorStatus and in particular PolicyConditionReason. For clarity stock OSS Istio will adopt the same mechanism and use the ACCEPTED state to indicate support for its own APIs.

Describe alternatives you've considered

Affected product area (please put an X in all that apply)

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[X] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience

Additional context
Istio’s Layered Future, Policy and Conformance

@ilrudie
Copy link
Author

ilrudie commented Dec 7, 2023

It looks like the way to do this might be to add new functionality to our generation tooling to support a flag like "pasgwstatus".

// +cue-gen:VirtualService:subresource:pasgwstatus

@howardjohn
Copy link
Member

The k8s gw status stuff is not a new subresource, just a new struct within status

@howardjohn
Copy link
Member

So just a new field in IstioStatus

@ilrudie
Copy link
Author

ilrudie commented Dec 7, 2023

Thanks John. The intent was to find a way to selectively add it. Are we OK with all the Istio resources getting these fields and we'll just ignore them if they're not useful then?

@howardjohn
Copy link
Member

The crd is just

          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true

anyways.

Also your example was for VirtualService -- I assume we actually want it for almost everything but VS (and GW/DR)?

@ilrudie
Copy link
Author

ilrudie commented Dec 7, 2023

Yeah, Virtual service is not where we want it. It was just a proto where I found the marker for a (admittedly sloppy) copy/paste example. Sorry for the confusion there.

@mikemorris
Copy link
Member

This seems good - would we additionally want to consider implementing https://gateway-api.sigs.k8s.io/geps/gep-2162/ on the istio-waypoint GatewayClass if that hasn't been done already, and encourage implementing it for any pluggable waypoint implementations, to advertise which features are supported?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants