532 stabilize shadow pod networking lifecycle and add optional tls ingress support#538
Conversation
…consistency; updated namespace computation cleanup
…ing the establish of websocket tunnel
…bilize-shadow-pod-networking-lifecycle-and-add-optional-tls-ingress-support
✅ Deploy Preview for interlink-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR stabilizes the wstunnel-based shadow pod networking lifecycle in pkg/virtualkubelet by improving resource naming and reliability, and adds optional TLS support for generated ingress endpoints (including cert-manager ClusterIssuer selection). It also updates templates, tests, and documentation to align with the new naming/TLS behavior.
Changes:
- Add
IngressTLS/IngressClusterIssuerconfiguration and propagate it through template data, templates, and defaulting (includingwss://...:443defaults). - Centralize wstunnel resource naming via a shared identity helper and improve handling of long names.
- Improve full-mesh
mesh.shrobustness (download retries, readiness checks, restart logic) and add tests/docs for the new behaviors.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/virtualkubelet/virtualkubelet.go | Adds TLS-aware default command selection, embeds the wireguard template, and uses a shared resource identity for naming/cleanup. |
| pkg/virtualkubelet/virtualkubelet_mesh_test.go | Adds tests for TLS ingress rendering, wireguard template selection, identity computation, and mesh script behavior. |
| pkg/virtualkubelet/templates/wstunnel-wireguard-template.yaml | Adds optional TLS + cert-manager annotations to the wireguard ingress. |
| pkg/virtualkubelet/templates/wstunnel-template.yaml | Adds optional TLS + cert-manager annotations and updates ingress host naming pattern. |
| pkg/virtualkubelet/templates/mesh.sh | Adds retry/readiness/restart logic for full mesh networking and improves unshare/slirp4netns handling. |
| pkg/virtualkubelet/mesh.go | Introduces wstunnelResourceIdentity, isShadowSameNamespace, and new/updated naming logic; makes full-mesh scripts TLS-aware. |
| pkg/virtualkubelet/config.go | Adds IngressTLS and IngressClusterIssuer config fields. |
| pkg/virtualkubelet/config_test.go | Extends config tests and adds defaulting tests for TLS/ClusterIssuer and TLS default command. |
| docs/docs/guides/10-wstunnel-configuration.mdx | Documents TLS ingress options and updates examples to the new naming/hostname pattern. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo $$ > "$TMPDIR/netns.pid" | ||
|
|
||
| export WG_SOCKET_DIR="$TMPDIR" |
There was a problem hiding this comment.
Derived TMPDIR from slirp.sh's own location ($(cd "$(dirname "$0")" && pwd)) at the top of the script, before first use, so it works when run under unshare without an exported TMPDIR. Fixed in 3b8c1e1.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Giulio <34304760+Bianco95@users.noreply.github.com>
|
@Bianco95 e2e tests are failing, don't know why, but cannot merge without being sure it won't brake current e2e tests |
…-manager-provisioned <name>-tls secret Signed-off-by: Giulio Bianchini <giulio.bianchini@hotmail.it>
This pull request introduces several improvements and new features to the wstunnel mesh configuration, focusing on TLS support for ingress, improved resource naming, enhanced reliability, and better documentation. The main changes are grouped into new features, documentation updates, and reliability improvements.
New Features: TLS Support for Ingress
IngressTLSandIngressClusterIssueroptions to theNetworkstruct and configuration, enabling TLS on generated wstunnel ingresses and support for cert-manager ClusterIssuer selection. The default client command now useswss://...:443when TLS is enabled. [1] [2] [3] [4]ws/wss) and port (80/443) for ingress endpoints, based on theIngressTLSsetting. [1] [2] [3] [4]Documentation Updates
IngressTLSandIngressClusterIssueroptions, including configuration tables, example hostnames, and command-line usage. [1] [2]{pod-name}-{namespace}-{namespace}-wstunnel) instead of the oldws-{pod-name}-wstunnelformat, ensuring consistency and clarity. [1] [2] [3] [4] [5] [6] [7] [8] [9]Reliability and Robustness Improvements
mesh.sh) to include retry logic for binary downloads, robust readiness checks for the wstunnel server, automatic restarts on failure, and proxy support for wstunnel. [1] [2]These changes together provide more secure and reliable wstunnel mesh networking, better documentation for users, and improved maintainability.
Open item for discussion: shadow pod readiness gating
While this PR improves the reliability and stability of the wstunnel mesh networking, there is still an open item worth discussing.
In the current flow, the remote pod is not submitted until the shadow pod exists and has been assigned an IP. This is a reasonable proxy for "scheduled/running", but it is not gated on the shadow pod being Ready, nor on the tunnel/mesh actually being established. As a result, if a workload connects back through the tunnel immediately on startup, there is a race window.
The retry logic added to mesh.sh mitigates this since it now retries the wstunnel connection multiple time, but it isn't a complete guarantee: if the source Kubernetes cluster is slow to schedule and start the shadow pod, the retries could still be exhausted before the tunnel is up.
The possible follow-up could be a gate remote submission on the shadow pod's Ready condition (and, for FullMesh, on a signal that the mesh is actually established) rather than just on IP assignment.