Skip to content

Commit b8ad65c

Browse files
JorresJorres
authored
Add GRPC Service port configuration (#301)
1 parent 95ebf5b commit b8ad65c

File tree

21 files changed

+447
-34
lines changed

21 files changed

+447
-34
lines changed

‎.changes/unreleased/Added-20250512-140119.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
kind: Added
2+
body: '`insecurePort` can be specified in GRPC Service spec to create a Service with a second port (for non-tls grpc port in storage)'
3+
time: 2025-05-12T14:01:19.020259248+02:00

‎.changes/unreleased/Added-20250512-143551.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
kind: Added
2+
body: Default 2135 port on the GRPC service can now be overridden
3+
time: 2025-05-12T14:35:51.255373275+02:00

‎.changes/unreleased/Fixed-20250513-113445.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
kind: Fixed
2+
body: '[development] mutating\validating webhooks now run during medium tests (previously e2e only)'
3+
time: 2025-05-13T11:34:45.560660001+02:00

‎.github/workflows/run-tests.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,18 @@ jobs:
2828
- name: setup-go
2929
uses: actions/setup-go@v3
3030
with:
31-
go-version: '1.20'
31+
go-version: '1.23'
3232
- name: setup-medium-test-class-binaries
3333
run: |
3434
# This installs kube-apiserver and etcd binaries for `medium`
3535
# class tests. Refer to the writing tests docs for more info.
3636
make envtest
3737
KUBEBUILDER_ASSETS=$(./bin/setup-envtest use 1.26 -p path)
3838
echo "KUBEBUILDER_ASSETS=$KUBEBUILDER_ASSETS" >> $GITHUB_ENV
39+
- name: render-webhook-manifests
40+
run: |
41+
# This renders webhook manifests to ./config/webhook
42+
make manifests
3943
- name: setup-gotestsum
4044
run: |
4145
go install gotest.tools/gotestsum@v1.12.0
@@ -76,7 +80,7 @@ jobs:
7680
- name: setup-go
7781
uses: actions/setup-go@v3
7882
with:
79-
go-version: '1.20'
83+
go-version: '1.23'
8084
- name: install-dependencies
8185
run: |
8286
sudo apt-get update

‎api/v1alpha1/const.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,12 @@ const (
99
DefaultDomainName = "cluster.local"
1010
DNSDomainAnnotation = "dns.domain"
1111

12-
GRPCPort = 2135
13-
GRPCServicePortName = "grpc"
14-
GRPCProto = "grpc://"
15-
GRPCSProto = "grpcs://"
16-
GRPCServiceFQDNFormat = "%s-grpc.%s.svc.%s"
12+
GRPCPort = 2135
13+
GRPCServicePortName = "grpc"
14+
GRPCServiceInsecurePortName = "insecure-grpc"
15+
GRPCProto = "grpc://"
16+
GRPCSProto = "grpcs://"
17+
GRPCServiceFQDNFormat = "%s-grpc.%s.svc.%s"
1718

1819
InterconnectPort = 19001
1920
InterconnectServicePortName = "interconnect"

‎api/v1alpha1/service_types.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ type TLSConfiguration struct {
2020
type GRPCService struct {
2121
Service `json:""`
2222

23+
InsecurePort int32 `json:"insecurePort,omitempty"`
24+
Port int32 `json:"port,omitempty"`
25+
2326
TLSConfiguration *TLSConfiguration `json:"tls,omitempty"`
2427
ExternalHost string `json:"externalHost,omitempty"`
2528
ExternalPort int32 `json:"externalPort,omitempty"`

‎api/v1alpha1/storage_webhook.go

Lines changed: 110 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,15 +67,7 @@ func (r *Storage) GetGRPCServiceEndpoint() string {
6767
}
6868

6969
func (r *Storage) GetHostFromConfigEndpoint() string {
70-
var rawYamlConfiguration string
71-
// skip handle error because we already checked in webhook
72-
success, dynConfig, _ := ParseDynConfig(r.Spec.Configuration)
73-
if success {
74-
config, _ := yaml.Marshal(dynConfig.Config)
75-
rawYamlConfiguration = string(config)
76-
} else {
77-
rawYamlConfiguration = r.Spec.Configuration
78-
}
70+
rawYamlConfiguration := r.getRawYamlConfiguration()
7971

8072
configuration, _ := ParseConfiguration(rawYamlConfiguration)
8173
randNum := rand.Intn(len(configuration.Hosts)) // #nosec G404
@@ -443,6 +435,115 @@ func (r *Storage) ValidateUpdate(old runtime.Object) error {
443435
return crdCheckError
444436
}
445437

438+
if err := r.validateGrpcPorts(); err != nil {
439+
return err
440+
}
441+
442+
return nil
443+
}
444+
445+
func (r *Storage) getRawYamlConfiguration() string {
446+
var rawYamlConfiguration string
447+
// skip handle error because we already checked in webhook
448+
success, dynConfig, _ := ParseDynConfig(r.Spec.Configuration)
449+
if success {
450+
config, _ := yaml.Marshal(dynConfig.Config)
451+
rawYamlConfiguration = string(config)
452+
} else {
453+
rawYamlConfiguration = r.Spec.Configuration
454+
}
455+
456+
return rawYamlConfiguration
457+
}
458+
459+
func (r *Storage) validateGrpcPorts() error {
460+
// There are three possible ways to configure grpc ports:
461+
462+
// service:
463+
// grpc: == this means one insecure port, tls is disabled
464+
// port: 2135
465+
466+
// service:
467+
// grpc:
468+
// port: 2136 == this means one secure port, tls is enabled
469+
// tls:
470+
// enabled: true
471+
472+
// service:
473+
// grpc:
474+
// insecurePort: 2135 == this means two ports, one secure \ one insecure
475+
// port: 2136
476+
// tls:
477+
// enabled: true
478+
479+
rawYamlConfiguration := r.getRawYamlConfiguration()
480+
configuration, err := ParseConfiguration(rawYamlConfiguration)
481+
if err != nil {
482+
return fmt.Errorf("failed to parse configuration immediately after building it, should not happen, %w", err)
483+
}
484+
configurationPort := int32(GRPCPort)
485+
if configuration.GrpcConfig.Port != 0 {
486+
configurationPort = configuration.GrpcConfig.Port
487+
}
488+
configurationSslPort := int32(0)
489+
if configuration.GrpcConfig.SslPort != 0 {
490+
configurationSslPort = configuration.GrpcConfig.SslPort
491+
}
492+
493+
if !r.Spec.Service.GRPC.TLSConfiguration.Enabled {
494+
// there should be only 1 port, both in service and in config, insecure
495+
servicePort := int32(GRPCPort)
496+
if r.Spec.Service.GRPC.Port != 0 {
497+
servicePort = r.Spec.Service.GRPC.Port
498+
}
499+
if configurationPort != servicePort {
500+
return fmt.Errorf(
501+
"inconsistent grpc ports: spec.service.grpc.port (%v) != configuration.grpc_config.port (%v)",
502+
servicePort,
503+
configurationPort,
504+
)
505+
}
506+
507+
if r.Spec.Service.GRPC.InsecurePort != 0 {
508+
return fmt.Errorf(
509+
"spec.service.grpc.tls.enabled is false, use `port` instead of `insecurePort` field to assign non-tls grpc port",
510+
)
511+
}
512+
return nil
513+
}
514+
515+
// otherwise, there might be 1 (secure only) port...
516+
servicePort := int32(GRPCPort)
517+
if r.Spec.Service.GRPC.Port != 0 {
518+
servicePort = r.Spec.Service.GRPC.Port
519+
}
520+
if configurationSslPort == 0 {
521+
return fmt.Errorf(
522+
"configuration.grpc_config.ssl_port is absent in cluster configuration, but spec.service.grpc has tls enabled and port %v",
523+
servicePort,
524+
)
525+
}
526+
if configurationSslPort != servicePort {
527+
return fmt.Errorf(
528+
"inconsistent grpc ports: spec.service.grpc.port (%v) != configuration.grpc_config.ssl_port (%v)",
529+
servicePort,
530+
configurationSslPort,
531+
)
532+
}
533+
534+
// or, optionally, one more: insecure port
535+
if r.Spec.Service.GRPC.InsecurePort != 0 {
536+
serviceInsecurePort := r.Spec.Service.GRPC.InsecurePort
537+
538+
if configurationPort != serviceInsecurePort {
539+
return fmt.Errorf(
540+
"inconsistent grpc insecure ports: spec.service.grpc.insecure_port (%v) != configuration.grpc_config.port (%v)",
541+
serviceInsecurePort,
542+
configurationPort,
543+
)
544+
}
545+
}
546+
446547
return nil
447548
}
448549

‎deploy/ydb-operator/crds/database.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4078,6 +4078,9 @@ spec:
40784078
externalPort:
40794079
format: int32
40804080
type: integer
4081+
insecurePort:
4082+
format: int32
4083+
type: integer
40814084
ipDiscovery:
40824085
properties:
40834086
enabled:
@@ -4103,6 +4106,9 @@ spec:
41034106
description: IPFamilyPolicy represents the dual-stack-ness
41044107
requested or required by a Service
41054108
type: string
4109+
port:
4110+
format: int32
4111+
type: integer
41064112
tls:
41074113
properties:
41084114
CA:

‎deploy/ydb-operator/crds/databasenodeset.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2690,6 +2690,9 @@ spec:
26902690
externalPort:
26912691
format: int32
26922692
type: integer
2693+
insecurePort:
2694+
format: int32
2695+
type: integer
26932696
ipDiscovery:
26942697
properties:
26952698
enabled:
@@ -2715,6 +2718,9 @@ spec:
27152718
description: IPFamilyPolicy represents the dual-stack-ness
27162719
requested or required by a Service
27172720
type: string
2721+
port:
2722+
format: int32
2723+
type: integer
27182724
tls:
27192725
properties:
27202726
CA:

‎deploy/ydb-operator/crds/remotedatabasenodeset.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2691,6 +2691,9 @@ spec:
26912691
externalPort:
26922692
format: int32
26932693
type: integer
2694+
insecurePort:
2695+
format: int32
2696+
type: integer
26942697
ipDiscovery:
26952698
properties:
26962699
enabled:
@@ -2716,6 +2719,9 @@ spec:
27162719
description: IPFamilyPolicy represents the dual-stack-ness
27172720
requested or required by a Service
27182721
type: string
2722+
port:
2723+
format: int32
2724+
type: integer
27192725
tls:
27202726
properties:
27212727
CA:

0 commit comments

Comments
 (0)