istio-k8s

Istio

  • Canonical Observability
Channel Revision Published Runs on
latest/edge 20 28 Mar 2025
Ubuntu 22.04
juju deploy istio-k8s --channel edge
Show information

Learn to deploy on juju >

Platform:

Ubuntu
22.04

charms.istio_k8s.v0.istio_ingress_config

istio_ingress_config.

This library implements endpoint wrappers for the istio-ingress-config interface. Currently, it facilitates the exchange of external authorizer configuration details such as the service name, port and a provider identifier.

Usage:

Requirer (istio k8s charm):

class FooCharm(CharmBase):
    def __init__(self, framework):
        super().__init__(framework)

        self.ingress_config = IngressConfigRequirer(self.model.relations, self.app, "istio-ingress-config")
        self.framework.observe(self.on["istio-ingress-config"].relation_changed, self._on_ingress_config_changed)
        self.framework.observe(self.on["istio-ingress-config"].relation_broken, self._on_ingress_config_changed)

    def _on_ingress_config_changed(self, event):
        # Publish a unique ext_authz_provider_name for each connected ingress provider.
        for relation in self.ingress_config.relations:
            if self.ingress_config.is_provider_ready(relation):
                ext_authz_info = self.ingress_config.get_provider_ext_authz_info(relation)
                unique_name = generate_provider_name(relation.app.name, ext_authz_info)  # type: ignore
                self.ingress_config.publish_ext_authz_provider_name(relation, unique_name)

def generate_provider_name(
    ingress_app_name: str, ext_authz_info: ProviderIngressConfigData
) -> str:
    data = f"{ext_authz_info.ext_authz_service_name}:{ext_authz_info.ext_authz_port}"
    stable_hash = hashlib.sha256(data.encode("utf-8")).hexdigest()
    return f"ext_authz-{ingress_app_name}-{stable_hash}"
                ...

Provider (istio ingress charm):

class FooCharm(CharmBase):
    def __init__(self, framework):
        super().__init__(framework)
        self.ingress_config = IngressConfigProvider(self.model.relations, self.app, "istio-ingress-config")

        self.framework.observe(self.on.leader_elected, self.publish_config)
        self.framework.observe(self.on["istio-ingress-config"].relation_joined, self.publish_config)
        self.framework.observe(self.on.some_event, self.publish_config)

    def publish_config(self, event):
        # Publish the ext_authz service details to our databag.
        self.ingress_config.publish(ext_authz_service_name="my-ext_authz-service", ext_authz_port="8080")
        # Later, fetch the ext_authz provider name generated by the requirer:
        if self.ingress_config.is_requirer_ready():
            provider_name = self.ingress_config.get_ext_authz_provider_name()
            # Do something with provider_name
            ...

Index

class ProviderIngressConfigData

Data model for the provider side of the relation.

Description

Holds the external authorizer service name and port information.

class RequirerIngressConfigData

Data model for the requirer side of the relation.

Description

Holds the generated external authorizer provider name and the ingress charm's application name.

class IngressConfigProvider

Provider side wrapper for the istio-ingress-config relation.

Description

The provider (ingress charm) publishes its external authorizer service name and port and can fetch the generated external authorizer provider name from the requirer's databag.

Methods

IngressConfigProvider. __init__( self , relation_mapping: RelationMapping , app: Application , relation_name: str )

Initialize the IngressConfigProvider.

Arguments

relation_mapping

The charm's RelationMapping (typically self.model.relations).

app

This application (the ingress charm).

model_name

This application juju model (the ingress charm).

relation_name

The name of the relation.

IngressConfigProvider. relations( self )

Description

Return the relation instances for the monitored relation. None

IngressConfigProvider. publish( self , ext_authz_service_name , ext_authz_port )

Publish external authorizer configuration data to all related applications.

Arguments

ext_authz_service_name

The external authorizer service name.

ext_authz_port

The port number for the external authorizer service.

IngressConfigProvider. get_ext_authz_provider_name( self )

Fetch the external authorizer provider name generated by the requirer for this provider.

Returns

The generated external authorizer provider name if available, else None.

IngressConfigProvider. is_requirer_ready( self )

Guard to check if the generated external authorizer provider name is present.

Returns

True if the external authorizer provider name has been published by the requirer.

class IngressConfigRequirer

Requirer side wrapper for the istio-ingress-config relation.

Description

The requirer generates and publishes a unique external authorizer provider name for a connected ingress charm. It can also check that the provider has published its required external authorizer service configuration.

Methods

IngressConfigRequirer. __init__( self , relation_mapping: RelationMapping , app: Application , relation_name: str )

Initialize the IngressConfigRequirer.

Arguments

relation_mapping

The charm's RelationMapping (typically self.model.relations).

app

This application.

relation_name

The name of the relation.

IngressConfigRequirer. relations( self )

Description

Return the relation instances for the monitored relation. None

IngressConfigRequirer. publish_ext_authz_provider_name( self , relation: Relation , unique_name: str )

Publish a unique external authorizer provider name and ingress provider name for a connected ingress charm.

Arguments

relation

A specific relation instance.

unique_name

The unique external authorizer provider name to publish.

Description

The provided unique_name is stored as the ext_authz_provider_name, and the ingress charm's application name is stored as ingress_provider_name.

IngressConfigRequirer. get_provider_ext_authz_info( self , relation: Relation )

Retrieve the entire provider app databag for the given relation.

Arguments

relation

A specific relation instance.

Returns

An instance of ProviderIngressConfigData if available and valid, else None.

Description

This method retrieves the data that the provider (ingress charm) has published, validates it using the ProviderIngressConfigData model, and returns the model instance.

IngressConfigRequirer. is_provider_ready( self , relation: Relation )

Guard to check if the provider has published its external authorizer service configuration.

Arguments

relation

A specific relation instance.

Returns

True if both ext_authz_service_name and ext_authz_port are present in the provider's databag.

IngressConfigRequirer. get_ext_authz_provider_name( self , relation: Relation )

Retrieve the generated external authorizer provider name for the given provider.

Arguments

relation

A specific relation instance.

Returns

The external authorizer provider name if available, else None.