Merge branch 'main' into 709

Signed-off-by: spacewander <spacewanderlzx@gmail.com>

.github/workflows/lint.yml

@@ -107,6 +107,7 @@ jobs:
         reporter: github-pr-review
         path: "."
         pattern: "*.sh"
+        fail_on_error: true
 
     - name: lint dockerfile
       uses: hadolint/hadolint-action@v3.1.0

.github/workflows/website.yml

@@ -18,9 +18,6 @@ jobs:
   check:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./site
     steps:
     - uses: actions/checkout@v4
 
@@ -33,7 +30,15 @@ jobs:
           ./site/tmp
         key: ${{ runner.os }}-${{ hashFiles('./Makefile') }}
 
+    - name: lint cjk
+      run: |
+        if ! make lint-cjk; then
+          echo "Please run 'make fix-cjk', edit the detected files and commit changes."
+          exit 1
+        fi
+
     - name: build
+      working-directory: ./site
       run: |
         set -euo pipefail
         make build

Makefile

@@ -64,7 +64,7 @@ dev-tools:
 build-dev-tools:
 	# before running this task, please run `make build-dev-tools-local` and check if the image work locally
 	docker buildx build --platform=linux/amd64,linux/arm64 \
-		--network=host --build-arg GOPROXY=${GOPROXY} -t ${DEV_TOOLS_IMAGE} --push -f tools/Dockerfile.dev ./tools
+		--network=host --build-arg GOPROXY=${GOPROXY} -t ${REAL_DEV_TOOLS_IMAGE} --push -f tools/Dockerfile.dev ./tools
 
 .PHONY: build-dev-tools-local
 build-dev-tools-local:
@@ -159,16 +159,35 @@ lint-editorconfig: $(LOCALBIN)
 	test -x $(LOCALBIN)/editorconfig-checker || GOBIN=$(LOCALBIN) go install github.com/editorconfig-checker/editorconfig-checker/cmd/editorconfig-checker@2.7.2
 	$(LOCALBIN)/editorconfig-checker
 
+.PHONY: lint-cjk
+lint-cjk: dev-tools
+	docker run --rm -v $(PWD):/go/src/${PROJECT_NAME} -w /go/src/${PROJECT_NAME} \
+		${DEV_TOOLS_IMAGE} \
+		autocorrect --lint ./site/content/zh-hans
+
+.PHONY: fix-cjk
+fix-cjk: dev-tools
+	docker run --rm -v $(PWD):/go/src/${PROJECT_NAME} -w /go/src/${PROJECT_NAME} \
+		${DEV_TOOLS_IMAGE} \
+		autocorrect --fix ./site/content/zh-hans
+
+# we don't add this to the umbrella `lint` task because it requires the website to be generated first
+.PHONY: lint-website
+lint-website: $(LOCALBIN)
+	test -x $(LOCALBIN)/htmltest || GOBIN=$(LOCALBIN) go install github.com/wjdp/htmltest@v0.17.0
+	$(LOCALBIN)/htmltest --conf ./.htmltest.yml ./public | grep  -E '(target does not exist|Non-OK status: 404)' \
+		&& exit 1 || true
+
 .PHONY: lint-remain
 lint-remain:
 	grep '>>>>>>' $(shell git ls-files .) | grep -v 'Makefile:' && exit 1 || true
 	go run tools/cmd/linter/main.go
 
 .PHONY: lint
-lint: lint-go lint-proto lint-license lint-spell lint-editorconfig lint-remain
+lint: lint-go lint-proto lint-license lint-spell lint-editorconfig lint-cjk lint-remain
 
 .PHONY: fmt
-fmt: fmt-go fmt-proto
+fmt: fmt-go fmt-proto fix-spell fix-cjk
 
 .PHONY: verify-example
 verify-example:

common.mk

@@ -31,7 +31,8 @@ BUILD_IMAGE     ?= $(DOCKER_MIRROR)docker.io/library/golang:1.21-bullseye
 # We don't use istio/proxyv2 because it is not designed to be run separately (need to work around permission issue).
 PROXY_IMAGE     ?= $(DOCKER_MIRROR)docker.io/envoyproxy/envoy:contrib-v1.29.5
 # We may need to use timestamp if we need to update the image in one PR
-DEV_TOOLS_IMAGE ?= $(DOCKER_MIRROR)ghcr.io/mosn/htnn-dev-tools:2024-03-05
+REAL_DEV_TOOLS_IMAGE ?= ghcr.io/mosn/htnn-dev-tools:2024-07-12
+DEV_TOOLS_IMAGE ?= $(DOCKER_MIRROR)$(REAL_DEV_TOOLS_IMAGE)
 
 ISTIO_VERSION = 1.21.3
 GATEWAY_API_VERSION = 1.0.0

controller/internal/controller/filterpolicy_controller.go

@@ -277,9 +277,9 @@ func (r *FilterPolicyReconciler) resolveWithVirtualService(ctx context.Context,
 		// For reducing the write to K8S API server and reconciliation,
 		// we don't add `gateway.networking.k8s.io/PolicyAffected` to the affected resource.
 		// If people want to check whether the VirtualService/HTTPRoute is affected, they can
-		// check whether there is an EnvoyFilter named `httn-h-$host` (the `$host` is one of the resources' hosts).
+		// check whether there is an EnvoyFilter named `htnn-h-$host` (the `$host` is one of the resources' hosts).
 		// For wildcard host, the `*.` is converted to `-`. For example, `*.example.com` results in
-		// EnvoyFilter name `htnn-h--example.com`, and `www.example.com` results in `httn-h-www.example.com`.
+		// EnvoyFilter name `htnn-h--example.com`, and `www.example.com` results in `htnn-h-www.example.com`.
 	} else {
 		policy.SetAccepted(gwapiv1a2.PolicyReasonTargetNotFound, "all gateways are not found or unsupported")
 	}

e2e/pkg/suite/suite.go

@@ -82,7 +82,7 @@ func New(opt Options) *Suite {
 func (suite *Suite) Run(t *testing.T) {
 	k8s.Prepare(t, suite.Opt.Client, "base/default.yml")
 	k8s.Prepare(t, suite.Opt.Client, "base/nacos.yml")
-	suite.waitNacos(t)
+	suite.waitDeployments(t)
 	suite.startPortForward(t)
 	defer suite.stopPortForward(t)
 	for _, test := range tests {
@@ -116,24 +116,21 @@ func (suite *Suite) Run(t *testing.T) {
 	}
 }
 
-func (suite *Suite) waitNacos(t *testing.T) {
-	cmdline := "kubectl wait --timeout=5m -n e2e deployment/nacos --for=condition=Available"
-	cmd := strings.Fields(cmdline)
-	wait := exec.Command(cmd[0], cmd[1:]...)
-	err := wait.Run()
-	require.NoError(t, err)
-}
-
-// We use port-forward so that both Linux and Mac can expose port in the same way
-func (suite *Suite) startPortForward(t *testing.T) {
+func (suite *Suite) waitDeployments(t *testing.T) {
 	// TODO: rewrite 'kubectl wait' with Go code
 	for _, cond := range []struct {
 		name string
 		ns   string
 	}{
 		{name: "istio-ingressgateway", ns: k8s.IstioRootNamespace},
+		{name: "backend", ns: k8s.IstioRootNamespace},
+
 		{name: "default-istio", ns: k8s.DefaultNamespace},
+		{name: "backend", ns: k8s.DefaultNamespace},
+		{name: "nacos", ns: k8s.DefaultNamespace},
+
 		{name: "default-istio", ns: k8s.AnotherNamespace},
+		{name: "backend", ns: k8s.AnotherNamespace},
 	} {
 		cmdline := fmt.Sprintf("kubectl wait --timeout=5m -n %s deployment/%s --for=condition=Available",
 			cond.ns, cond.name)
@@ -142,7 +139,10 @@ func (suite *Suite) startPortForward(t *testing.T) {
 		err := wait.Run()
 		require.NoError(t, err, "wait for deployment %s in namespace %s", cond.name, cond.ns)
 	}
+}
 
+// We use port-forward so that both Linux and Mac can expose port in the same way
+func (suite *Suite) startPortForward(t *testing.T) {
 	cmdline := "./port-forward.sh"
 	dests := []string{"istio-ingressgateway", "istio-ingressgateway-tcp",
 		"k8s-gateway-api", "k8s-gateway-api-tcp",

examples/quick_start/backend.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: istio-system
+spec:
+  selector:
+    app: backend
+  ports:
+  - protocol: TCP
+    port: 8080
+    targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  labels:
+    app: backend
+  namespace: istio-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+  template:
+    metadata:
+      labels:
+        app: backend
+    spec:
+      containers:
+      - name: backend
+        image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231013-v0.8.1-133-g3959576a
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        resources:
+          requests:
+            cpu: 10m

examples/quick_start/redis.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: istio-system
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - name: redis
+        image: m.daocloud.io/docker.io/library/redis:latest
+        ports:
+        - containerPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: istio-system
+spec:
+  selector:
+    app: redis
+  ports:
+    - protocol: TCP
+      port: 6379
+      targetPort: 6379

examples/quick_start/route.yaml

@@ -0,0 +1,36 @@
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+  - hosts:
+    - '*'
+    name: http
+    port:
+      name: http
+      number: 18000
+      protocol: HTTP
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: vs
+  namespace: istio-system
+spec:
+  gateways:
+  - default
+  hosts:
+  - "default.local"
+  http:
+  - match:
+    - uri:
+        prefix: /
+    route:
+    - destination:
+        host: backend
+        port:
+          number: 8080

examples/quick_start/route_gateway_api.yaml

@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  gatewayClassName: istio
+  listeners:
+  - name: default
+    port: 18001
+    protocol: HTTP
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: route
+  namespace: istio-system
+spec:
+  parentRefs:
+  - name: default
+    namespace: istio-system
+  hostnames: ["default.local"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: backend
+      port: 8080

go.work

@@ -23,5 +23,6 @@ use (
 	./e2e
 	./plugins
 	./site
+	./tools
 	./types
 )

manifests/images/cp/Dockerfile

@@ -26,7 +26,7 @@ WORKDIR /workspace
 # Copy the source
 
 COPY go.* ./
-RUN sed -i 's/.\/site/.\/external\/istio/' go.work && sed -i '/.\/e2e/d' go.work # remove this in release
+RUN sed -i 's/.\/site/.\/external\/istio/' go.work && sed -i '/.\/e2e/d' go.work && sed -i '/.\/tools/d' go.work # remove this in release
 # use single layer to copy only works on files, so we have to list all the directories
 COPY api/ api/
 COPY types/ types/

manifests/images/dp/Dockerfile

@@ -26,7 +26,7 @@ WORKDIR /workspace
 # Copy the source
 
 COPY go.* ./
-RUN sed -i 's/.\/site/.\/external\/istio/' go.work && sed -i '/.\/e2e/d' go.work
+RUN sed -i 's/.\/site/.\/external\/istio/' go.work && sed -i '/.\/e2e/d' go.work && sed -i '/.\/tools/d' go.work # remove this in release
 COPY api/ api/
 COPY types/ types/
 COPY plugins/ plugins/

patch/istio/1.21/20240410-embed-htnn-controller-go-code.patch

@@ -1149,7 +1149,7 @@ index 0000000..75de3a5
 +		return warnings, err
 +	})
 +
-+func validateHTTNAnntation(cfg *config.Config, gk schema.GroupKind) error {
++func validateHTNNAnnotation(cfg *config.Config, gk schema.GroupKind) error {
 +	if cfg.Annotations == nil {
 +		return nil
 +	}
@@ -1203,7 +1203,7 @@ index db201a3..c976633 100644
  		name := cfg.Name
 
 +		if features.EnableHTNN {
-+			err := validateHTTNAnntation(&cfg, schema.GroupKind{Group: "networking.istio.io", Kind: "Gateway"})
++			err := validateHTNNAnnotation(&cfg, schema.GroupKind{Group: "networking.istio.io", Kind: "Gateway"})
 +			if err != nil {
 +				return nil, err
 +			}
@@ -1218,7 +1218,7 @@ index db201a3..c976633 100644
  		}
 +
 +		if features.EnableHTNN {
-+			err := validateHTTNAnntation(&cfg, schema.GroupKind{Group: "networking.istio.io", Kind: "VirtualService"})
++			err := validateHTNNAnnotation(&cfg, schema.GroupKind{Group: "networking.istio.io", Kind: "VirtualService"})
 +			if err != nil {
 +				return nil, err
 +			}

site/Makefile

@@ -31,9 +31,3 @@ clean:
 publish:
 	# FIXME: change baseURL to real link
 	docker run --rm -v $(PWD):/src --name docsy htnn-docsy -- hugo --minify --gc --baseURL https://mosn.io/
-
-.PHONY: lint-website
-lint-website: $(LOCALBIN)
-	test -x $(LOCALBIN)/htmltest || GOBIN=$(LOCALBIN) go install github.com/wjdp/htmltest@v0.17.0
-	$(LOCALBIN)/htmltest --conf ./.htmltest.yml ./public | grep  -E '(target does not exist|Non-OK status: 404)' \
-		&& exit 1 || true