Httpproxy routes to services in different namespaces

[yangyy93]

Please describe the problem you have [A clear, concise, description of the problem you are facing. What is the problem that feature X would solve for you?] In httpproxy, .spec.routes.service only contains the name of the service, and can only route to services in the same namespace as Httpproxy. How about adding a namespace option that allows specifying routes to services on other namespaces. There is a ReferenceGrant in the Gateway to allow this kind of operation. If I have a requirement to route half of the traffic to service A and half of the traffic to service B, service A is in namespace C and service B is in namespace D.Now it is not possible to achieve it using httpproxy

apiVersion: projectcontour.io/v1
kind: HTTPProxy
metadata:
  name: route-diffnamespace
  namespace: testb
spec:
  virtualhost:
    fqdn: example.com
  routes:
    - conditions:
        - prefix: /test
      services:
        - name: httpbin
          port: 80
          namespace: testb
        - name: httpbin
          port: 80
          namespace: testa

[sunjayBhatia]

For at least part of what you want, you can use HTTPProxy inclusion: https://projectcontour.io/docs/v1.21.0/config/inclusion-delegation/#inclusion-across-namespaces (which is some of where the Gateway API feature came from!)

You may have a root HTTPProxy in one namespace and "include" one in another to route to service(s) in another namespace

We might be able to think of something creative that could work, but we don't yet support exactly what you describe, which is a single match, and splitting traffic to multiple services in different namespaces

[yangyy93]

I think it's a good feature to split traffic to multiple services in different namespaces, if no namespace is configured, the default route to the service in the namespace where httpproxy resides, if one is configured, traffic is allowed to be routed to a service in a different namespace. Of course, we can restrict the namespace of traffic routing to one of the namespaces configured in root-namespace.

[youngnick]

Yes, we built mechanisms in Gateway to handle exactly this situation (allowedRoutes in the Gateway itself, and ReferenceGrant for the Service backends).

At this point, I don't think we're likely to backport these features to HTTPProxy, I'd rather spend that effort to improve Gateway API support.

[github-actions[bot]]

The Contour project currently lacks enough contributors to adequately respond to all Issues.

This bot triages Issues according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, the Issue is closed

You can:

• Mark this Issue as fresh by commenting
• Close this Issue
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

[github-actions[bot]]

The Contour project currently lacks enough contributors to adequately respond to all Issues.

This bot triages Issues according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, the Issue is closed

You can:

• Mark this Issue as fresh by commenting
• Close this Issue
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack