bzp2010 opened a new pull request, #2890: URL: https://github.com/apache/apisix-ingress-controller/pull/2890
<!-- Please answer these questions before submitting a pull request --> ### Type of change: - [x] New feature provided ### What this PR does / why we need it: Part of #2877, the first feature slice after the store groundwork in #2880, #2883, #2884 and #2885. The rest of #2877 lands as separate PRs on top of this one, each with its own e2e. Today one resource the data plane rejects fails the whole sync for its GatewayProxy, so every other ApisixRoute, Ingress or Gateway API route under the same GatewayProxy stops updating until someone fixes it. With this change only the rejected resource is dropped. - When ADC reports a rejection on a service, or on a route, stream route or named upstream inside one, the service (one Kubernetes rule) is added to a skip table and left out of every following push. The rest of the config is pushed and the sync converges. - The resource that owns the service reports why: `Accepted=False` with reason `SyncFailed` for the ApisixRoute and Gateway API kinds, and a Warning event for an Ingress, which has no conditions to carry it. The GatewayProxy no longer reports the sync as failed for a rejection that names a resource. - An excluded service comes back when its owner is written again with different content. Rewriting identical content, which unrelated reconciles do all the time, does not retry a known-bad resource. A failure reported against content that has since been replaced is ignored, so a fix can never be excluded by a stale report. Both checks use store revisions, which only advance when what the store holds actually changes. - A round that excluded something new pushes again right away instead of waiting for the retry backoff, since that push carries every other resource's pending changes. What it does not do yet, all in follow-up PRs: dropping just one bad route of a service, reporting a partially served resource as `PartiallyInvalid`, and isolating consumers, credentials, certificates, global rules, GatewayProxy plugins and Gateway listener certificates. Rejections of those types are reported as before. Until the partial reporting lands, an ApisixRoute with several rules where only one is rejected is reported `Accepted=False` with the dropped rule named in the message, while its other rules are served. e2e covers a rejected route, an upstream configuration the data plane rejects, a rejected named upstream, a rejected stream route and a rejected Ingress, each applied together with a valid resource in the same first sync and then fixed to check that everything converges. ### Pre-submission checklist: - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [x] Have you added corresponding test cases? - [ ] Have you modified the corresponding document? - [x] Is this PR backward compatible? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
