[cmd/tunnelproxy] Support TunnelNode label selector

Author: dilyevsky

cmd/tunnelproxy/main.go

@@ -47,6 +47,8 @@ var (
 apiServerAddr = flag.String("apiserver_addr", "host.docker.internal:8443", "APIServer address.")
 jwksURLs = flag.String("jwks_urls", "", "Comma-separated URLs of the JWKS endpoints.")
 
+tunnelNodeSelector = flag.String("label_selector", "", "Label selector for TunnelNode objects.")
+
 extIPv6SubnetSize = flag.Int("ext_ipv6_subnet_size", 64, "IPv6 subnet size.")
 extIPv6Ifc = flag.String("ext_ipv6_ifc", "", "IPv6 interface name.")
 cksumRecalc = flag.Bool("cksum_recalc", false, "Recalculate checksum.")
@@ -133,6 +135,7 @@ func main() {
 jwtValidator,
 r,
 tunnel.WithExternalIPv6Prefix(extIPv6Prefix),
+tunnel.WithLabelSelector(*tunnelNodeSelector),
 )
 g.Go(func() error {
 log.Infof("Starting Tunnel Proxy server")

pkg/tunnel/server.go

@@ -25,8 +25,10 @@ import (
 "k8s.io/client-go/util/retry"
 "k8s.io/utils/ptr"
 ctrl "sigs.k8s.io/controller-runtime"
+"sigs.k8s.io/controller-runtime/pkg/builder"
 "sigs.k8s.io/controller-runtime/pkg/client"
 "sigs.k8s.io/controller-runtime/pkg/log"
+"sigs.k8s.io/controller-runtime/pkg/predicate"
 "sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 "github.com/apoxy-dev/apoxy/pkg/tunnel/connection"
@@ -50,6 +52,7 @@ type tunnelServerOptions struct {
 keyPath string
 ipam tunnet.IPAM
 extIPv6Prefix netip.Prefix
+selector string
 }
 
 func defaultServerOptions() *tunnelServerOptions {
@@ -60,6 +63,7 @@ func defaultServerOptions() *tunnelServerOptions {
 keyPath: "/etc/apoxy/certs/tunnelproxy.key",
 ipam: tunnet.NewRandomULA(),
 extIPv6Prefix: netip.MustParsePrefix("fd00::/64"),
+selector: "",
 }
 }
 
@@ -106,6 +110,13 @@ func WithExternalIPv6Prefix(prefix netip.Prefix) TunnelServerOption {
 }
 }
 
+// WithLabelSelector sets the label selector to filter TunnelNodes.
+func WithLabelSelector(labelSelector string) TunnelServerOption {
+return func(o *tunnelServerOptions) {
+o.selector = labelSelector
+}
+}
+
 type TunnelServer struct {
 http3.Server
 client.Client
@@ -156,8 +167,21 @@ func NewTunnelServer(
 }
 
 func (t *TunnelServer) SetupWithManager(mgr ctrl.Manager) error {
+lss, err := metav1.ParseToLabelSelector(t.options.selector)
+if err != nil {
+return fmt.Errorf("failed to parse label selector: %w", err)
+}
+ls, err := predicate.LabelSelectorPredicate(*lss)
+if err != nil {
+return fmt.Errorf("failed to create label selector predicate: %w", err)
+}
 return ctrl.NewControllerManagedBy(mgr).
-For(&corev1alpha.TunnelNode{}).
+For(&corev1alpha.TunnelNode{},
+builder.WithPredicates(
+&predicate.ResourceVersionChangedPredicate{},
+ls,
+),
+).
 Complete(reconcile.Func(t.reconcile)) // Using this contraption to keep reconcile method private.
 }