Support Standalone Service Creation & Surface Service ARN #818

rlymbur · 2025-09-18T23:05:20Z

What type of PR is this?
Feature

Which issue does this PR fix:
#691

What does this PR do / Why do we need it:
This PR implements standalone VPC Lattice services that are not automatically associated with service networks. Currently, the AWS Application Networking Controller only processes routes that are always associated with a service network. This enhancement allows for decoupling of service creation and ownership from service network membership, providing more flexibility in service management scenarios.

Key changes:

Adds annotation-based configuration (application-networking.k8s.aws/standalone: "true") to control service network association behavior
Supports both Gateway-level and Route-level annotations with Route-level taking precedence
Maintains full backward compatibility - existing deployments continue to work unchanged
Surfaces VPC Lattice service ARN in route annotations for external integrations (e.g., AWS RAM sharing)

If an issue # is not available please add repro steps and logs from aws-gateway-controller showing the issue:
See issue #691 for detailed requirements and use case description. The issue requests the ability to create VPC Lattice services without automatic service network association to support scenarios where service creation and service network membership need to be managed independently.

Testing done on this change:

Unit tests added for annotation processing and validation logic
Unit tests for service model building with standalone mode detection
Unit tests for service manager handling of standalone services
Integration tests for end-to-end standalone service creation
Integration tests for annotation precedence and inheritance behavior
Integration tests for transition scenarios (standalone ↔ service network modes)

Automation added to e2e:
Yes - Integration tests have been added covering:

Standalone service creation and verification
Annotation precedence testing (Gateway vs Route level)
Service transition scenarios
Service ARN surfacing in route status

Will this PR introduce any new dependencies?:
No new dependencies. The feature uses existing Kubernetes annotations and AWS VPC Lattice APIs that are already in use by the controller.

Will this break upgrades or downgrades. Has updating a running cluster been tested?:
No breaking changes. The feature is fully backward compatible:

Existing routes without annotations continue to work exactly as before
New annotation support is additive and optional
Graceful handling of annotation transitions ensures no service disruption
Controller upgrade/downgrade scenarios have been tested

Does this PR introduce any user-facing change?:
Yes - This introduces new annotation-based configuration options for users.

Add support for standalone VPC Lattice services via annotations. Users can now create VPC Lattice services without automatic service network association by adding `application-networking.k8s.aws/standalone: "true"` annotation to Gateway or Route resources. Route-level annotations take precedence over Gateway-level annotations. VPC Lattice service ARNs are now surfaced in route annotations for external integrations. This feature is fully backward compatible and existing deployments continue to work unchanged.

Do all end-to-end tests successfully pass when running make e2e-test?:
Yes - All existing e2e tests pass, and new integration tests for standalone functionality have been added and are passing.

Ran 110 of 110 Specs in 5485.152 seconds SUCCESS! -- 110 Passed | 0 Failed | 0 Pending | 0 Skipped --- PASS: TestIntegration (5485.16s) PASS ok github.com/aws/aws-application-networking-k8s/test/suites/integration 5486.311s

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

mikestvz

Minor comments

docs/faq.md

docs/guides/standalone-services.md

pkg/controllers/route_controller.go

mikestvz · 2025-09-19T23:38:17Z

pkg/k8s/utils.go

+return false
+}
+
+// Trim whitespace to be more forgiving of user input


Let's combine this with previous if?

Good point, I will address this in the next revision.

mikestvz · 2025-09-19T23:39:28Z

pkg/k8s/utils.go

+}
+
+// Convert to lowercase for case-insensitive comparison
+switch strings.ToLower(trimmed) {


are we thinking for a different set of values in the future? If not why do we need a switch?

You're right, this is overkill now. I'll simplify it.

satishckAWS · 2025-09-23T17:25:30Z

docs/faq.md

+
+1. **AWS RAM sharing** to share the service with other accounts/VPCs
+2. **VPC peering or Transit Gateway** for network connectivity
+3. **Manual service network association** in target VPCs


AWS RAM sharing to share the service with other accounts to associate with service networks
2.remove VPC peering or Transit Gateway for networking connectivity. Standalone Lattice services resolve to 169.254.171.0/24, which are not routable.

I have removed this wording in the latest revision.

satishckAWS · 2025-09-23T17:28:10Z

docs/guides/standalone-services.md

+The controller will:
+1. Remove existing service network associations
+2. Keep the VPC Lattice service running
+3. Update the route status


will have to make sure that the service is removed only from the Gateway that is set to stand-alone, as the same service could belong to other Gateways that are not standlone.

I've added detailed steps on how to mitigate this and correctly share with RAM manually.

satishckAWS · 2025-09-23T17:30:46Z

docs/guides/standalone-services.md

+## Limitations
+
+- Standalone services are not discoverable through service network DNS resolution
+- Service network policies do not apply to standalone services


qualify that service network policies do not apply to standalone services only in the Gateways/service networks they are disconnected from. If the same service is also in a different Gateway/service network, the policies on those Gateways/service networks apply.

I clarified this in the latest revision.

satishckAWS · 2025-09-23T17:31:47Z

docs/guides/standalone-services.md

+
+- Standalone services are not discoverable through service network DNS resolution
+- Service network policies do not apply to standalone services
+- Cross-VPC communication requires explicit service sharing or alternative connectivity


requires explicit service sharing and/or association with service networks.
Remove "alternate connectivity" as there is no other way to connect than through a service network

I have updated this wording.

satishckAWS · 2025-09-23T17:33:10Z

files/examples/mixed-standalone-routes.yaml

+ value: /networked
+ backendRefs:
+ - name: networked-service
+ port: 80


an example of httpsroute and TLSroute would be helpful with the TLS certs and how they can be added as well the same way as a connected service.

I have added additional examples now.

mikestvz

LGTM

rlymbur and others added 14 commits September 16, 2025 12:41

Add annotation constants and helper functions

e1069fa

Implement standalone mode detection in service model builder

95cc9e4

Modify service model building to support standalone mode

0d26386

Update service manager to handle standalone services

5b3bda3

Enhance route status updates with service ARN

5af4784

Update route controller to use enhanced status function

2c2fd45

Add validation and error handling for annotation transitions

a2b4de0

Update setup.sh dependencies and address linting issues

388311d

Create integration tests for standalone service creation

fe008a4

Create integration tests for annotation precedence and inheritance

a110e73

Create integration tests for transition scenarios

b4f03ed

Update documentation for standalone VPC Lattice services

8bc255e

Merge branch 'aws:main' into issue/691

971ef60

Upgrade golangci-lint version to v2.4.0 in GitHub workflow

22f78a4

rlymbur enabled auto-merge September 18, 2025 23:05

rlymbur changed the title ~~Issue/691~~ Support Standalone Service Creation Sep 18, 2025

rlymbur changed the title ~~Support Standalone Service Creation~~ Support Standalone Service Creation & Surface Service ARN Sep 18, 2025

rlymbur self-assigned this Sep 18, 2025

rlymbur added 2 commits September 19, 2025 09:42

Merge branch 'main' into issue/691

7a0f722

Merge branch 'main' into issue/691

34fa3d0

mikestvz requested changes Sep 19, 2025

View reviewed changes

Address PR comments

bfab529

satishckAWS reviewed Sep 23, 2025

View reviewed changes

rlymbur added 4 commits September 23, 2025 11:52

Address PR comments related to documentation

f2ee002

Simplify ParseBoolAnnotation()

e0e7a24

Remove switch statement

3587de4

Update action to setup-go@v4

ddc53a0

mikestvz approved these changes Sep 24, 2025

View reviewed changes

rlymbur added this pull request to the merge queue Sep 24, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 24, 2025

rlymbur added this pull request to the merge queue Sep 24, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 24, 2025

rlymbur added this pull request to the merge queue Sep 24, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 24, 2025

rlymbur added this pull request to the merge queue Sep 25, 2025

Merged via the queue into aws:main with commit 5375bad Sep 25, 2025
2 checks passed

rlymbur deleted the issue/691 branch September 25, 2025 23:15

SinghVikram97 mentioned this pull request Sep 29, 2025

Release artifacts for release v1.1.5 #827

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support Standalone Service Creation & Surface Service ARN #818

Support Standalone Service Creation & Surface Service ARN #818

Uh oh!

rlymbur commented Sep 18, 2025

mikestvz left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikestvz Sep 19, 2025

rlymbur Sep 23, 2025

mikestvz Sep 19, 2025

rlymbur Sep 23, 2025

satishckAWS Sep 23, 2025

rlymbur Sep 23, 2025

satishckAWS Sep 23, 2025

rlymbur Sep 23, 2025

satishckAWS Sep 23, 2025

rlymbur Sep 23, 2025

satishckAWS Sep 23, 2025

rlymbur Sep 23, 2025

satishckAWS Sep 23, 2025

rlymbur Sep 23, 2025

mikestvz left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Labels

3 participants

Support Standalone Service Creation & Surface Service ARN #818

Support Standalone Service Creation & Surface Service ARN #818

Uh oh!

Conversation

rlymbur commented Sep 18, 2025

mikestvz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikestvz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Labels

3 participants