Open arch #115

alexsnaps · 2025-03-05T14:09:28Z

No description provided.

Signed-off-by: Alex Snaps <[email protected]>

thomasmaas · 2025-03-06T14:31:16Z

rfcs/0000-open-arch.md

+Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/), and as such will be
+managed by some controller. But unlike a regular [Kubernetes
+Controller](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#custom-controllers),
+it also needs to reconcile when changes to properties of the Gateway API it uses are observed. For that reason, the


Suggested change

it also needs to reconcile when changes to properties of the Gateway API it uses are observed. For that reason, the

it also needs to reconcile when it observes changes to properties of the Gateway API it uses. For that reason, the

Or is it not the metapolicy controller that observes the changes?

In the case it's the KuadrantController that observes the changes I would make that explicit:

Suggested change

it also needs to reconcile when changes to properties of the Gateway API it uses are observed. For that reason, the

it also needs to reconcile when changes to properties of the Gateway API it uses are observed by the `KuadrantController`. For that reason, the

thomasmaas · 2025-03-06T14:40:11Z

rfcs/0000-open-arch.md

+      deployment: embedded
+```
+
+The `UserMetaPolicy` will need to be packaged with a custom Docker image containing the plugin. It'll be automatically


If a plugin contains one MetaPolicy, do we need to distinguish? Or you're think plugins might contain other "things" in the future?

The Plugin in this case is the extension point that the Kuadrant controller needs to know about. It so happens that this extension is a "metacontroller" that effectively cares about changes to its own resources, e.g. UserMetaPolicy CRs and the changes to relevant Gateway API resources (i.e. the DAG).

Now there is no reason the Plugin couldn't be more or something entirely different than a "metacontroller". It simply formalizes the API that such a plugin talks with the Kuadrant controller. That, and "sandboxes" it, so that plugins failing don't affect each other.

Because in this case the Plugin is "embedded", the Kuadrant controller will also be responsible to start it, shut it down, and keep it running.

maleck13 · 2025-03-07T10:43:44Z

rfcs/0000-open-arch.md

+  return reconcile.Result{}, nil
+}
+```
+It on differs in three ways from the original example:


Suggested change

It on differs in three ways from the original example:

It only differs in three ways from the original example:

maleck13 · 2025-03-07T10:44:41Z

rfcs/0000-open-arch.md

+1. It uses the `evaluateExpression` to resolve the CEL expression `kuadrant.gatewaysFor(self)[0].metadata.name` instead
+   of using a fixed string for the label's value.
+
+Because that expression is evaluated upon creation, the `KuadrantRuntime` will make sure to reconcile whenever that cel


Suggested change

Because that expression is evaluated upon creation, the `KuadrantRuntime` will make sure to reconcile whenever that cel

Because that expression is evaluated upon creation, the `KuadrantRuntime` will make sure to reconcile whenever that CEL

maleck13 · 2025-03-07T10:47:24Z

rfcs/0000-open-arch.md

+  }
+
+  // resolve the CEL expression using the `KuadrantContext`
+  label := kuadrant.evaluateExpression("kuadrant.gatewaysFor(self)[0].metadata.name")


self here would be the metapolicy object?

yes... where gatewaysFor would probably provide "overloads", as CEL calls them, to act upon certain types. I don't know actually that we can do it, in this case, for anything that has targetRef, a la structural typing... so, might have to be gatewaysFor(self.targetRef), where that then resolves to a known-type for which there is an overload.

maleck13 · 2025-03-07T12:34:01Z

rfcs/0000-open-arch.md

+### Deployment
+
+> [!IMPORTANT]
+> This would initially be deployed as their own processes running alongside the kuadrant controller. They'd communicate


When you say along side. Does that mean in the same pod and as part of the same deployment object? So for example the Kuadrant Operator would add in the new container to the existing deployment. The plugin(s) would then read from the socket and act on the streamed data.

Actually re-reading I think I answered my own question:
"in-pod/embedded"

One consideration may be limiting the resources that such a container can have. I think we would also want to understand to protect the kuadrant operator from a bad plugin crashing and potentially causing the pod to get restarted

https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-restarts

@maleck13 if you want a little more hands-on details, I started some work here, but tl;dr this would be orthogonal. They'd be "out of process" (for the reasons you mention), and they would all be isolated from the operator and from each other. The Kuadrant operator lifecycles them. But in anycase, the advantage I see is that it's "non binding", i.e. given it's gRPC over a unix socket, we can perfectly have RemotePlugins that would communicate using a tcp/ip socket.

maleck13 · 2025-03-07T12:51:57Z

rfcs/0000-open-arch.md

+> Later, we could support different deployment models, as all that'd be needed is being able to use gRPC essentially.
+
+- [ ] Known location for plugins to live in; one per directory
+- [ ] Unix socket opened within the same location?


Possibly use a volume mount of type emptyDir. Th https://kubernetes.io/docs/concepts/storage/volumes/#emptydir

I was, for now certainly, not looking into making this a "first class citizen" per se, so you'd probably docker compose the base image to add e.g. the /plugins/myPlugin/myPlugin executable to the kuadrant operator.

david-martin · 2025-03-11T14:58:20Z

rfcs/0000-open-arch.md

+> Discuss prior art, both the good and the bad, in relation to this proposal.
+> A few examples of what this can include are:
+>
+> - Does another project have a similar feature?


Similar to ext_proc in envoy proxy? https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_proc_filter

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps added 8 commits February 26, 2025 11:33

Open arch start

4bc5eef

Signed-off-by: Alex Snaps <[email protected]>

gRPC internals

2ee9b91

Signed-off-by: Alex Snaps <[email protected]>

wip: plugin

ca4c1ff

Signed-off-by: Alex Snaps <[email protected]>

corrections

42179c5

Signed-off-by: Alex Snaps <[email protected]>

Example

fec804a

Signed-off-by: Alex Snaps <[email protected]>

Deployment

a9dd655

Signed-off-by: Alex Snaps <[email protected]>

todos

96d57ac

Signed-off-by: Alex Snaps <[email protected]>

Format go code

c4e1713

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps mentioned this pull request Mar 5, 2025

OpenIDConnect Policy RFC #114

Open

thomasmaas reviewed Mar 6, 2025

View reviewed changes

maleck13 reviewed Mar 7, 2025

View reviewed changes

david-martin reviewed Mar 11, 2025

View reviewed changes

alexsnaps mentioned this pull request Mar 25, 2025

Extension Mechanism (aka plugins) Kuadrant/kuadrant-operator#1235

Open

6 tasks

feat(rfc): Changes related to the latest explorations

47369d7

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps force-pushed the open-arch branch from 789f2ad to 47369d7 Compare April 4, 2025 13:14

Boomatang mentioned this pull request Apr 25, 2025

Remove topology configmap on kuadrant operator uninstall Kuadrant/kuadrant-operator#896

Open

alexsnaps mentioned this pull request Jul 23, 2025

Custom Meta Policy SDK Kuadrant/kuadrant-operator#1447

Open

	it also needs to reconcile when changes to properties of the Gateway API it uses are observed. For that reason, the
	it also needs to reconcile when it observes changes to properties of the Gateway API it uses. For that reason, the

	It on differs in three ways from the original example:
	It only differs in three ways from the original example:

	Because that expression is evaluated upon creation, the `KuadrantRuntime` will make sure to reconcile whenever that cel
	Because that expression is evaluated upon creation, the `KuadrantRuntime` will make sure to reconcile whenever that CEL

Open arch #115

Are you sure you want to change the base?

Open arch #115

Uh oh!

Conversation

alexsnaps commented Mar 5, 2025

Uh oh!

thomasmaas Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thomasmaas Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexsnaps Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexsnaps Mar 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maleck13 Mar 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

thomasmaas Mar 6, 2025 •

edited

Loading

thomasmaas Mar 6, 2025 •

edited

Loading

alexsnaps Mar 6, 2025 •

edited

Loading

alexsnaps Mar 7, 2025 •

edited

Loading

maleck13 Mar 7, 2025 •

edited

Loading