feat: add support for ingress backed GlooEdge Gateway #5909

cucxabong · 2025-10-16T16:41:48Z

What does it do ?

More

Yes, this PR title follows Conventional Commits
Yes, I added unit tests
Yes, I updated end user documentation accordingly

k8s-ci-robot · 2025-10-16T16:41:56Z

Welcome @cucxabong!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-10-16T16:41:58Z

Hi @cucxabong. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

AndrewCharlesHay · 2025-10-16T17:02:04Z

lgtm

ivankatliarchuk

Was it tested on real cluster? What was your kubernetes manifests and results?

docs/annotations/annotations.md

ivankatliarchuk · 2025-10-17T09:33:41Z

/ok-to-test

coveralls · 2025-10-17T09:44:40Z

Pull Request Test Coverage Report for Build 18816420063

Details

0 of 0 changed or added relevant lines in 0 files are covered.
48 unchanged lines in 2 files lost coverage.
Overall coverage decreased (-0.05%) to 78.617%

Files with Coverage Reduction	New Missed Lines	%
openshift_route.go	1	79.49%
gloo_proxy.go	47	74.18%

Totals
Change from base Build 18815330014:	-0.05%
Covered Lines:	15912
Relevant Lines:	20240

💛 - Coveralls

k8s-ci-robot · 2025-10-17T10:37:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from ivankatliarchuk. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

cucxabong · 2025-10-17T10:40:52Z

@ivankatliarchuk yes, I did a test on our sandbox env in dry-run mode and observed the expected behaviour

docs/annotations/annotations.md

source/gloo_proxy.go

cucxabong · 2025-10-22T18:50:33Z

all tests are green, please help to review again. Thank you @ivankatliarchuk

mloiseleur · 2025-10-22T21:49:22Z

@cucxabong For the chart update, the Changelog has to be updated in the unreleased section

ivankatliarchuk · 2025-10-24T08:10:02Z

Could you share similar results for this PR #5085 (comment). Need to make sure it works before we merge, I'll try to smoke test right after as well.

cucxabong · 2025-10-25T20:32:33Z

Please find more details below. I tried to run with --dry-run option in our EKS clusters.

Deploy external-dns with Helm. Deployment run with args: -log-level=debug --source=gloo-proxy --domain-filter=external-dns-example.com --provider=aws --dry-run --aws-zone-type=public
Deploy GlooEdge related resources

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/healthcheck-path: /
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    alb.ingress.kubernetes.io/success-codes: 200-499
    alb.ingress.kubernetes.io/target-type: ip
    meta.helm.sh/release-name: gloo-proxy
    meta.helm.sh/release-namespace: gloo-system
  finalizers:
  - ingress.k8s.aws/resources
  generation: 1
  labels:
    app: gloo
    app.kubernetes.io/managed-by: Helm
    gateway-proxy-id: external-dns-demo-proxy
    gloo: gateway-proxy
  name: external-dns-demo-proxy
  namespace: gloo-system
spec:
  ingressClassName: alb
....
status:
  loadBalancer:
    ingress:
    - hostname: k8s-gloosyst-1ee31790ed-444154078.us-east-1.elb.amazonaws.com
---
apiVersion: gateway.solo.io/v1
kind: Gateway
metadata:
  labels:
    app: gloo
  name: external-dns-demo-proxy
  namespace: gloo-system
spec:
  bindAddress: '::'
  bindPort: 8080
  httpGateway:
    virtualServiceNamespaces:
    - gloo-system
  proxyNames:
  - external-dns-demo-proxy
  ssl: false
  useProxyProto: false
---
apiVersion: gloo.solo.io/v1
kind: Proxy
metadata:
  labels:
    created_by: gloo-gateway
  name: external-dns-demo-proxy
  namespace: gloo-system
spec:
  listeners:
  - bindAddress: '::'
    bindPort: 8080
    httpListener:
      virtualHosts:
      - domains:
        - example-api.external-dns-example.com
        - example-api.excluded-dns-zone.com
        metadataStatic:
          sources:
          - observedGeneration: "33"
            resourceKind: '*v1.VirtualService'
            resourceRef:
              name: example-api
              namespace: gloo-system
        name: gloo-system.example-api
        routes:
        - matchers:
          - prefix: /
          metadataStatic:
            sources:
            - observedGeneration: "33"
              resourceKind: '*v1.VirtualService'
              resourceRef:
                name: example-api
                namespace: gloo-system
          options:
            extauth:
              customAuth: {}
          routeAction:
            single:
              upstream:
                name: example-api
                namespace: gloo-system
    metadataStatic:
      sources:
      - observedGeneration: "103"
        resourceKind: '*v1.Gateway'
        resourceRef:
          name: external-dns-demo-proxy
          namespace: gloo-system
    name: listener-::-8080
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: gloo-proxy
    meta.helm.sh/release-namespace: gloo-system
  labels:
    app: gloo
    app.kubernetes.io/managed-by: Helm
    gateway-proxy-id: external-dns-demo-proxy
    gloo: gateway-proxy
  name: external-dns-demo-proxy
  namespace: gloo-system
spec:
  clusterIP: 172.20.190.44
  clusterIPs:
  - 172.20.190.44
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    gateway-proxy: live
    gateway-proxy-id: external-dns-demo-proxy
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}

ExternalDNS logs

external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Refreshing zones list cache","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Considering zone: /hostedzone/Z022760OD8DZQNWIO (domain: external-dns-example.com.)","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"dedupSource: collecting endpoints and removing duplicates","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"multiSource: collecting endpoints from 1 child sources and removing duplicates","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo: Find external-dns-demo-proxy proxy","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"gateway":"external-dns-demo-proxy","level":"warning","msg":"Gloo: Proxy service type not supported","service":{"metadata":{"name":"external-dns-demo-proxy","namespace":"gloo-system","uid":"ab954ce1-3042-454f-a650-615253ab95c5","resourceVersion":"1092588789","creationTimestamp":"2025-10-23T12:18:43Z","labels":{"app":"gloo","app.kubernetes.io/managed-by":"Helm","gateway-proxy-id":"external-dns-demo-proxy","gloo":"gateway-proxy"},"annotations":{"meta.helm.sh/release-name":"gloo-proxy","meta.helm.sh/release-namespace":"gloo-system"},"managedFields":[{"manager":"helm","operation":"Update","apiVersion":"v1","time":"2025-10-23T12:18:43Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:meta.helm.sh/release-name":{},"f:meta.helm.sh/release-namespace":{}},"f:labels":{".":{},"f:app":{},"f:app.kubernetes.io/managed-by":{},"f:gateway-proxy-id":{},"f:gloo":{}}},"f:spec":{"f:internalTrafficPolicy":{},"f:ports":{".":{},"k:{\"port\":8080,\"protocol\":\"TCP\"}":{".":{},"f:name":{},"f:port":{},"f:protocol":{},"f:targetPort":{}}},"f:selector":{},"f:sessionAffinity":{},"f:type":{}}}}]},"spec":{"ports":[{"name":"http","protocol":"TCP","port":8080,"targetPort":8080}],"selector":{"gateway-proxy":"live","gateway-proxy-id":"external-dns-demo-proxy"},"clusterIP":"172.20.190.44","clusterIPs":["172.20.190.44"],"type":"ClusterIP","sessionAffinity":"None","ipFamilies":["IPv4"],"ipFamilyPolicy":"SingleStack","internalTrafficPolicy":"Cluster"},"status":{"loadBalancer":{}}},"time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo[external-dns-demo-proxy]: Find 0 target(s) ()","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo[external-dns-demo-proxy]: Generate 0 endpoint(s)","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Refreshing zones list cache","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Considering zone: /hostedzone/Z022760OD8DZQNWIO (domain: external-dns-example.com.)","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Applying provider record filter for domains: [external-dns-example.com. .external-dns-example.com.]","time":"2025-10-25T19:55:09Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"All records are already up to date","time":"2025-10-25T19:55:09Z"}

Adding external-dns.alpha.kubernetes.io/ingress=external-dns-demo-proxy to Gateway object

apiVersion: gateway.solo.io/v1
kind: Gateway
metadata:
  annotations:
    external-dns.alpha.kubernetes.io/ingress: external-dns-demo-proxy
....

Observing external-dns Pods's logs

external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Refreshing zones list cache","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Considering zone: /hostedzone/Z022760OD8DZQNWIO (domain: external-dns-example.com.)","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"dedupSource: collecting endpoints and removing duplicates","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"multiSource: collecting endpoints from 1 child sources and removing duplicates","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo: Find external-dns-demo-proxy proxy","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo[external-dns-demo-proxy]: Find 1 target(s) (k8s-gloosyst-1ee31790ed-444154078.us-east-1.elb.amazonaws.com)","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Gloo[external-dns-demo-proxy]: Generate 2 endpoint(s)","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Modifying endpoint: example-api.external-dns-example.com 0 IN CNAME  k8s-gloosyst-1ee31790ed-444154078.us-east-1.elb.amazonaws.com [], setting alias=true","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Modifying endpoint: example-api.excluded-dns-zone.com 0 IN CNAME  k8s-gloosyst-1ee31790ed-444154078.us-east-1.elb.amazonaws.com [], setting alias=true","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Refreshing zones list cache","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Considering zone: /hostedzone/Z022760OD8DZQNWIO (domain: external-dns-example.com.)","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Applying provider record filter for domains: [external-dns-example.com. .external-dns-example.com.]","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"ignoring record example-api.excluded-dns-zone.com that does not match domain filter","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"ignoring record example-api.excluded-dns-zone.com that does not match domain filter","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Refreshing zones list cache","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Considering zone: /hostedzone/Z022760OD8DZQNWIO (domain: external-dns-example.com.)","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Adding example-api.external-dns-example.com. to zone external-dns-example.com. [Id: /hostedzone/Z022760OD8DZQNWIO]","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Adding example-api.external-dns-example.com. to zone external-dns-example.com. [Id: /hostedzone/Z022760OD8DZQNWIO]","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Adding cname-example-api.external-dns-example.com. to zone external-dns-example.com. [Id: /hostedzone/Z022760OD8DZQNWIO]","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Adding aaaa-example-api.external-dns-example.com. to zone external-dns-example.com. [Id: /hostedzone/Z022760OD8DZQNWIO]","time":"2025-10-25T19:59:11Z"}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Desired change: CREATE aaaa-example-api.external-dns-example.com TXT","profile":"default","time":"2025-10-25T19:59:11Z","zoneID":"/hostedzone/Z022760OD8DZQNWIO","zoneName":"external-dns-example.com."}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Desired change: CREATE cname-example-api.external-dns-example.com TXT","profile":"default","time":"2025-10-25T19:59:11Z","zoneID":"/hostedzone/Z022760OD8DZQNWIO","zoneName":"external-dns-example.com."}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Desired change: CREATE example-api.external-dns-example.com A","profile":"default","time":"2025-10-25T19:59:11Z","zoneID":"/hostedzone/Z022760OD8DZQNWIO","zoneName":"external-dns-example.com."}
external-dns-548c84f74f-6tbwp external-dns {"level":"info","msg":"Desired change: CREATE example-api.external-dns-example.com AAAA","profile":"default","time":"2025-10-25T19:59:11Z","zoneID":"/hostedzone/Z022760OD8DZQNWIO","zoneName":"external-dns-example.com."}
external-dns-548c84f74f-6tbwp external-dns {"level":"debug","msg":"Dry run mode, skipping change submission","profile":"default","time":"2025-10-25T19:59:11Z","zoneID":"/hostedzone/Z022760OD8DZQNWIO","zoneName":"external-dns-example.com."}

mloiseleur · 2025-10-26T09:16:56Z

docs/sources/gloo-proxy.md

+
+## Gateway Annotation
+
+To support setups where an Ingress resource is used provision an external LB you can add the following annotation to your Gateway


Suggested change

To support setups where an Ingress resource is used provision an external LB you can add the following annotation to your Gateway

To support setups where an Ingress resource is used to provision an external LB you can add the following annotation to your Gateway

mloiseleur · 2025-10-26T09:19:30Z

go.mod

 	github.com/prometheus/common v0.65.0
 	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.34
 	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.9.1


🤔 Why there are those changes on go.mod ? I see nothing related with changes in go source code.
Would you please explain or remove this change ?

That's the output after I run go mod tidy (in go version go1.25.3 darwin/arm64)? Should we keep that output?

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 16, 2025

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 16, 2025

k8s-ci-robot added the docs label Oct 16, 2025

k8s-ci-robot requested review from ivankatliarchuk and szuecs October 16, 2025 16:42

k8s-ci-robot added source size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 16, 2025

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch 3 times, most recently from da56738 to c996a08 Compare October 16, 2025 17:01

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from c996a08 to a8c674c Compare October 17, 2025 06:12

ivankatliarchuk suggested changes Oct 17, 2025

View reviewed changes

docs/annotations/annotations.md Show resolved Hide resolved

k8s-ci-robot assigned ivankatliarchuk Oct 17, 2025

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 17, 2025

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from a8c674c to f9dec1c Compare October 17, 2025 10:37

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from f9dec1c to 3b2a8e7 Compare October 17, 2025 10:42

mloiseleur reviewed Oct 20, 2025

View reviewed changes

docs/annotations/annotations.md Outdated Show resolved Hide resolved

mloiseleur reviewed Oct 20, 2025

View reviewed changes

docs/annotations/annotations.md Outdated Show resolved Hide resolved

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from 3b2a8e7 to 1ffb257 Compare October 20, 2025 20:52

ivankatliarchuk suggested changes Oct 21, 2025

View reviewed changes

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from 1ffb257 to 02121fe Compare October 22, 2025 17:04

k8s-ci-robot added the chart label Oct 22, 2025

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 22, 2025

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch 6 times, most recently from a6995f0 to 3045a8d Compare October 22, 2025 18:40

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from 3045a8d to 3b4f28d Compare October 22, 2025 18:55

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from 3b4f28d to 2c49455 Compare October 23, 2025 16:14

mloiseleur reviewed Oct 26, 2025

View reviewed changes

feat: add support for ingress backed GlooEdge Gateway

c71158d

cucxabong force-pushed the feat/gloo-gateway-ingress-annotation branch from 2c49455 to c71158d Compare October 26, 2025 10:06


		## Gateway Annotation

		To support setups where an Ingress resource is used provision an external LB you can add the following annotation to your Gateway

feat: add support for ingress backed GlooEdge Gateway #5909

Are you sure you want to change the base?

feat: add support for ingress backed GlooEdge Gateway #5909

Conversation

cucxabong commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does it do ?

More

Uh oh!

k8s-ci-robot commented Oct 16, 2025

Uh oh!

k8s-ci-robot commented Oct 16, 2025

Uh oh!

AndrewCharlesHay commented Oct 16, 2025

Uh oh!

ivankatliarchuk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ivankatliarchuk commented Oct 17, 2025

Uh oh!

coveralls commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 18816420063

Details

💛 - Coveralls

Uh oh!

k8s-ci-robot commented Oct 17, 2025

Uh oh!

cucxabong commented Oct 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cucxabong commented Oct 22, 2025

Uh oh!

mloiseleur commented Oct 22, 2025

Uh oh!

ivankatliarchuk commented Oct 24, 2025

Uh oh!

cucxabong commented Oct 25, 2025

Uh oh!

mloiseleur Oct 26, 2025

Choose a reason for hiding this comment

Uh oh!

mloiseleur Oct 26, 2025

Choose a reason for hiding this comment

Uh oh!

cucxabong Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cucxabong commented Oct 16, 2025 •

edited

Loading

coveralls commented Oct 17, 2025 •

edited

Loading

cucxabong Oct 26, 2025 •

edited

Loading