Repository navigation
feat(gatewayapi): add Gateway API RBAC for L7 log collector - #4282
Merged
electricjesus merged 4 commits intoDec 17, 2025
Merged
Conversation
electricjesus
changed the title
electricjesus
force-pushed
the
l7-collector-rbac-reuse
branch
from
December 8, 2025 20:43
e1168ec to
43fc0e5
Compare
tmjd
reviewed
Dec 17, 2025
tmjd
approved these changes
Dec 17, 2025
Extends the waf-http-filter ClusterRole to include Gateway API permissions needed by the l7-log-collector sidecar for log enrichment. The L7 Log Collector watches Gateway API resources (Gateways, HTTPRoutes, GRPCRoutes) and core resources (Pods, Services) to enrich access logs with Gateway context information. This approach reuses the existing ServiceAccount shared by WAF and l7-log-collector containers in the EnvoyProxy deployment.
Add comprehensive unit test to verify the ClusterRole permissions added for L7 log collector enrichment. The test validates: - ClusterRole has correct Gateway API permissions (gateways, httproutes, grpcroutes) - ClusterRole has correct core resource permissions (pods, services) - ClusterRole maintains existing WAF HTTP filter permissions - ClusterRoleBinding correctly references the ClusterRole - ServiceAccount is properly created in tigera-gateway namespace The test ensures the RBAC configuration allows the L7 log collector sidecar to watch Gateway API resources and resolve pod/service ownership for log enrichment purposes.
electricjesus
force-pushed
the
l7-collector-rbac-reuse
branch
from
December 17, 2025 17:19
458454e to
8e2c097
Compare
electricjesus
added a commit
to electricjesus/operator
that referenced
this pull request
Dec 17, 2025
) Extends the waf-http-filter ClusterRole to include Gateway API permissions needed by the l7-log-collector sidecar for log enrichment. The L7 Log Collector watches Gateway API resources (Gateways, HTTPRoutes, GRPCRoutes) and core resources (Pods, Services) to enrich access logs with Gateway context information. This approach reuses the existing ServiceAccount shared by WAF and l7-log-collector containers in the EnvoyProxy deployment.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extends the waf-http-filter ClusterRole to include Gateway API permissions needed by the l7-log-collector sidecar for log enrichment.
The L7 Log Collector watches Gateway API resources (Gateways, HTTPRoutes, GRPCRoutes) and core resources (Pods, Services) to enrich access logs with Gateway context information.
This approach reuses the existing ServiceAccount shared by WAF and l7-log-collector containers in the EnvoyProxy deployment.
Description
Release Note
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this is a bugfix.kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.