HttpRoutes in different namespace

[gid-fieldcode]

Hello,

Following this: https://gateway-api.sigs.k8s.io/guides/multiple-ns/ we have enabled a selector and labels that will allow httproutes from namespace B to attach to a gateway on namespace A. So we have put such settings in place like this:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: apps
  namespace: test
spec:
  gatewayClassName: eg
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              shared-gateway-access: "true"
    - name: https
      protocol: HTTP
      port: 443
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              shared-gateway-access: "true"

...along with:

apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: current
    shared-gateway-access: "true"
  name: current
spec:
  finalizers:
  - kubernetes
status:
  phase: Active
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: test
    shared-gateway-access: "true"
  name: test
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

And yet a httproute that we create in namespace=current, pointing to a service in the same namespace, fails to work.

Our question is, are we missing something, or is this a feature that EG is not currently supporting?

As a work-around we have defined the exact same httproute on the same namespace as the gateway (test namespace), and it works fine.
We also have ReferenceGrants in place to allow routes in "test" to call services in "upcoming".

Thanks!

[arkodg]

can you also share the HTTPRoutes ?

[gid-fieldcode]

This is what they have to look like in order to work. With the arrow we are showing the salient point.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: connect-ui-auth-httproute-upcoming
  namespace: test   <---- this is ideally supposed to be "upcoming", not "test"
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
  hostnames:
    - "upcoming---our.acme.club"
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
        method: PUT
      - path:
          type: PathPrefix
          value: /
        method: GET
      - path:
          type: PathPrefix
          value: /
        method: POST
      - path:
          type: PathPrefix
          value: /
        method: PATCH
      - path:
          type: PathPrefix
          value: /
        method: DELETE
      timeouts:
        request: "60s"
        backendRequest: "58s"
      backendRefs:
        - group: ""
          kind: Service
          name: connect-ui
          namespace: upcoming
          port: 4900
          weight: 1
    - filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: "https"
              - name: X-Forwarded-Port
                value: "443"
              - name: X-Forwarded-Host
                value: "%REQ(Host)%"
            add:
              - name: "X-Content-Type-Options"
                value: "nosniff"
              - name: "X-Xss-Protection"
                value: "1; mode=block"
              - name: "X-Frame-Options"
                value: "SAMEORIGIN"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: connect-ui-noauth-httproute-upcoming
  namespace: test  <---- this is ideally supposed to be "upcoming", not "test"
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
  hostnames:
    - "upcoming---our.acme.club"
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /api/public/otti-web-service
        method: OPTIONS
      - path:
          type: PathPrefix
          value: /api/public/otti-web-service
        method: HEAD
      timeouts:
        request: "60s"
        backendRequest: "58s"
      backendRefs:
        - group: ""
          kind: Service
          name: connect-ui
          namespace: upcoming
          port: 4900
          weight: 1
    - filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: "https"
              - name: X-Forwarded-Port
                value: "443"
              - name: X-Forwarded-Host
                value: "%REQ(Host)%"
            add:
              - name: "X-Content-Type-Options"
                value: "nosniff"
              - name: "X-Xss-Protection"
                value: "1; mode=block"
              - name: "X-Frame-Options"
                value: "SAMEORIGIN"

[arkodg]

there is no Namespace called upcoming, only current and test, based on what's shared

[arkodg]

you also need to set the namespace of the Gateway in the parentRefs section
https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.CommonRouteSpec
by default it infers to the namespace of the HTTPRoute which is not what you want

[gid-fieldcode]

Thank you. This is something we ought to have noticed ourselves.