{"id":15130014,"url":"https://github.com/statcan/ingress-istio-controller","last_synced_at":"2025-10-23T06:30:37.424Z","repository":{"id":45354769,"uuid":"313656785","full_name":"StatCan/ingress-istio-controller","owner":"StatCan","description":"Creates and configures Istio Virtual Services objects from Ingress objects / Crée et configure des VirtualService d'Istio en utilisant les Ingress de Kubernetes comme définition.","archived":false,"fork":false,"pushed_at":"2023-11-03T12:54:24.000Z","size":111,"stargazers_count":4,"open_issues_count":1,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-06T15:47:45.927Z","etag":null,"topics":["cloud-native","cns","ingress-controller","istio","k8s","k8s-ingress","kubernetes"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/StatCan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-11-17T15:10:49.000Z","updated_at":"2023-05-05T07:16:47.000Z","dependencies_parsed_at":"2024-06-19T09:51:21.029Z","dependency_job_id":"86bb2e2a-d411-4f6b-aaec-b5c5e787f26d","html_url":"https://github.com/StatCan/ingress-istio-controller","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/StatCan/ingress-istio-controller","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/StatCan%2Fingress-istio-controller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/StatCan%2Fingress-istio-controller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/StatCan%2Fingress-istio-controller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/StatCan%2Fingress-istio-controller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/StatCan","download_url":"https://codeload.github.com/StatCan/ingress-istio-controller/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/StatCan%2Fingress-istio-controller/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280577108,"owners_count":26354071,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-23T02:00:06.710Z","response_time":142,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-native","cns","ingress-controller","istio","k8s","k8s-ingress","kubernetes"],"created_at":"2024-09-26T02:26:53.128Z","updated_at":"2025-10-23T06:30:37.145Z","avatar_url":"https://github.com/StatCan.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[(Français)](#contr%C3%B4leur-distio-pour-ingress)\n\n## Ingress Istio Controller\n\nBased on https://github.com/kubernetes/sample-controller\n\nThis controller is a reimplementation of the logic implemented by the [Istio Ingress](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/)\nwhich creates VirtualServices based on Ingress objects and routes their traffic through a Gateway.\n\nThis reimplementation is due to that fact that in Istio 1.6, the core logic changed and instead of all of the generated VirtualServices routing through a single\nGateway object, each VirtualService received their own. This caused issues for the Cloud Native Platform at Statistics Canada due to the fact that\na wildcard certificate is used to simplify application deployment. The issue is documented here: [istio/istio#24385](https://github.com/istio/istio/issues/24385).\n\n### Compatibility and Behaviour\n\nThis controller is designed and tested to work with the `istio.io/api/networking/v1beta1` and `k8s.io/api/networking/v1`  APIs.\nIt has been tested to run on Istio 1.5, 1.6, and 1.7 and on Kubernetes 1.17, 1.18, and 1.19, however, it should work with all versions of Istio.\n\nBoth the `kubernetes.io/ingress.class` annotation and the IngressClass can be used as a way to identify the Ingresses that should be handled by the controller.\n\n#### `kubernetes.io/ingress.class` Annotation\n\nStarting with Kubernetes 1.18, `kubernetes.io/ingress.class` [is deprecated](https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation) in favour of\nthe IngressClass. The use of the annotation is still supported by this controller and by design, as defined in the documentation of the\n[IngressClassName field](https://github.com/kubernetes/api/blob/648b77825832f4e96433407e4b406a3bdbb988bd/networking/v1beta1/types.go#L72), will take\nprecedence over the `IngressClass`.\n\n#### IngressClass\n\nThe controller will handle Ingresses with references to IngressClasses that have the `spec.controller` value of `ingress.statcan.gc.ca/ingress-istio-controller`.\nFollowing is an example of an IngressClass that can be used:\n\n```yaml\napiVersion: networking.k8s.io/v1\nkind: IngressClass\nmetadata:\n  name: ingress-istio-controller\nspec:\n  controller: ingress.statcan.gc.ca/ingress-istio-controller\n```\n\n### How to Contribute\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md)\n\n### License\n\nUnless otherwise noted, the source code of this project is covered under Crown Copyright, Government of Canada, and is distributed under the [MIT License](LICENSE).\n\nThe Canada wordmark and related graphics associated with this distribution are protected under trademark law and copyright law.\nNo permission is granted to use them outside the parameters of the Government of Canada's corporate identity program.\nFor more information, see [Federal identity requirements](https://www.canada.ca/en/treasury-board-secretariat/topics/government-communications/federal-identity-requirements.html).\n\n### Installation\n\nA Helm chart is available from the [StatCan/Charts repository](https://github.com/statcan/charts/stable/ingress-istio-controller) and images can be found in the\n[statcan/ingress-istio-controller](https://hub.docker.com/r/statcan/ingress-istio-controller).\n\n### Configuration\n\nThere are two ways to alter the behaviour of the **isto-ingress-controller**.\nThe first is via Command Line Arguments and the second is via Annotations set on Ingresses.\n\n#### Command Line Arguments\n\n| Argument                 | Description                                                                                                                                                                                                                                                            | Default Value                                |\n| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |\n| --kubeconfig             | Defines the path to a kubeconfig file. *Only required if out-of-cluster.*                                                                                                                                                                                              | \"\"                                           |\n| --master                 | The address of the Kubernetes API server. Overrides any value in kubeconfig. \u003cbr\u003e*Only required if out-of-cluster.*                                                                                                                                                    | \"\"                                           |\n| --cluster-domain         | The cluster's domain.                                                                                                                                                                                                                                                  | cluster.local                                |\n| --default-gateway        | The name of the Istio Gateway to which to apply the VirtualServices generated by the controller. \u003cbr\u003eThe supplied value should be in the **\\\u003cnamespace\u003e/\\\u003cname\u003e** format.                                                                                              | istio-system/istio-autogenerated-k8s-ingress |\n| --ingress-class          | The value of the ***kubernetes.io/ingress.class*** annotation set on Ingresses that should be handled by the controller.\u003cbr\u003eIf empty, only the IngressClass referenced by the IngressClassName on the Ingresses will be used to identify those that should be handled. | \"\"                                           |\n| --virtual-service-weight | The proportion of traffic to be forwarded to the service.                                                                                                                                                                                                              | 100                                          |\n\n#### Annotations\n\nAnnotations can be set on Ingresses to change how the Controller behaves. Following are the annotations and their function:\n\n| Annotation                     | Description                                                                                                  | Value Type             | Example Values               |\n| ------------------------------ | ------------------------------------------------------------------------------------------------------------ | ---------------------- | ---------------------------- |\n| ingress.statcan.gc.ca/ignore   | Causes the controller to ignore the Ingress.                                                                 | boolean                | \"true\"                       |\n| ingress.statcan.gc.ca/gateways | Comma-separated list of Gateways that should be passed to the VirtualService instead of the default-gateway. | comma-separated string | mesh,production/prod-gateway |\n\n## Contrôleur d'Istio pour Ingress\n\nBasé sur https://github.com/kubernetes/sample-controller\n\nCe contrôleur est une réimplémentation de la logique du [Istio Ingress *(anglais)*](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/). Celui-ci crée des VirtualServices en utilisant des objets Ingress comme définition afin d'acheminer le trafic réseau par un Gateway.\n\nCette réimplémentation est causée par le changement de la logique à partir d'Istio 1.6 causant qu'un Gateway unique est créé pour chaque VirtualService au lien d'un\nGateway commun. Ce changement a causé des problèmes pour la Plateforme Infonuagique Native à Statistique Canada puisqu'un certificat générique est utilisé afin de simplifier le déploiement d'applications.\n\n### Compatibilité et Fonctionnement\n\nCe crontrôleur est conçu et fonctionne avec les API `istio.io/api/networking/v1beta1` et `k8s.io/api/networking/v1`.\nIl a été testé avec les versions 1.5, 1.6 et 1.7 d'Istio et les versions 1.17, 1.18 et 1.19 de Kubernetes. Ceci dit, il devrait être compatible avec toutes versions d'Istio.\n\nL'annotation `kubernetes.io/ingress.class` ainsi que l'objet IngressClass peuvent être utilisés afin de cibler les Ingresses devrant être gérer par le contrôleur.\n\n\n#### Annotation `kubernetes.io/ingress.class`\n\nDébutant en Kubernetes 1.18, l'annotation `kubernetes.io/ingress.class` [est dépriciée *(anglais)*](https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation)\nen faveur de l'utilisation de l'IngressClass. Ceci dit, l'annotation peut encore être utilisée comme cible par ce contrôleur et comme documentée sur le\n[champ IngressClassName *(anglais)*](https://github.com/kubernetes/api/blob/648b77825832f4e96433407e4b406a3bdbb988bd/networking/v1beta1/types.go#L72),\naura préséance sur l'`IngressClass`.\n\n#### IngressClass\n\nLe contrôleur ciblera les Ingresses référant aux IngressClasses ayant comme valeur `ingress.statcan.gc.ca/ingress-istio-controller` au champ `spec.controller`.\nCi-dessous est un exemple d'un IngressClass pouvant être utilisé:\n\n```yaml\napiVersion: networking.k8s.io/v1beta1\nkind: IngressClass\nmetadata:\n  name: ingress-istio-controller\nspec:\n  controller: ingress.statcan.gc.ca/ingress-istio-controller\n```\n\n### Comment contribuer\n\nVoir [CONTRIBUTING.md](CONTRIBUTING.md)\n\n### Licence\n\nSauf indication contraire, le code source de ce projet est protégé par le droit d'auteur de la Couronne du gouvernement du Canada et distribué sous la [licence MIT](LICENSE).\n\nLe mot-symbole « Canada » et les éléments graphiques connexes liés à cette distribution sont protégés en vertu des lois portant sur les marques de commerce et le droit d'auteur.\nAucune autorisation n'est accordée pour leur utilisation à l'extérieur des paramètres du programme de coordination de l'image de marque du gouvernement du Canada.\nPour obtenir davantage de renseignements à ce sujet, veuillez consulter les [Exigences pour l'image de marque](https://www.canada.ca/fr/secretariat-conseil-tresor/sujets/communications-gouvernementales/exigences-image-marque.html).\n\n### Installation\n\nUn chart Helm est publié dans le [dépot StatCan/charts](https://github.com/statcan/charts/stable/ingress-istio-controller) et des images Docker sont publiés dans le\ndépot [statcan/ingress-istio-controller](https://hub.docker.com/r/statcan/ingress-istio-controller).\n\n### Configuration\n\nIl y a deux façons d'altérer le fonctionnement de l'**isto-ingress-controller**.\nLa première étant des arguments de la ligne de commande et la deuxième étant des Annotations sur les Ingresses.\n\n#### Ligne de Commande\n\n| Argument                 | Description                                                                                                                                                                                                                                                      | Valeur par défaut                            |\n| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |\n| --kubeconfig             | Le chemin de fichier local au kubeconfig. \u003cbr\u003e*Seulement requis à l'extérieur du cluster.*                                                                                                                                                                       | \"\"                                           |\n| --master                 | L'adresse au serveur API de Kubernetes. Cet argument prendra l'avance des configurations du kubeconfig. \u003cbr\u003e*Seulement requis à l'extérieur du cluster.*                                                                                                         | \"\"                                           |\n| --cluster-domain         | Le domaine du cluster.                                                                                                                                                                                                                                           | cluster.local                                |\n| --default-gateway        | Le nom de l'Istio Gateway duquel les VirtualServices seront servit. \u003cbr\u003eL'argument devrait être en format **\\\u003cnamespace\u003e/\\\u003cnom\u003e**.                                                                                                                               | istio-system/istio-autogenerated-k8s-ingress |\n| --ingress-class          | La valeur de l'Annotation ***kubernetes.io/ingress.class*** sur les Ingresses devrant être ciblés par le contrôleur.\u003cbr\u003eSi la valeur est vide, seulement le IngressClass référé par IngressClassName dans les Ingresses sera utilisé comme paramètre de ciblage. | \"\"                                           |\n| --virtual-service-weight | La valeur proportionnelle de trafic réseau devrant être achimenée au service.                                                                                                                                                                                    | 100                                          |\n\n#### Annotations\n\nDes Annotations peuvent être ajouter aux Ingresses afin de modifier le fonctionnement du contrôleur. Ci-dessous est une table des annotations possibles :\n\n| Annotation                     | Description                                                                                                              | Value Type                 | Example Values               |\n| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | -------------------------- | ---------------------------- |\n| ingress.statcan.gc.ca/ignore   | Cause que le contrôleur ne cible pas l'Ingress annoté.                                                                   | booléen                    | \"true\"                       |\n| ingress.statcan.gc.ca/gateways | Une liste de noms de Gateway séparés par virgules devrant être référée par le VirtualService au lieu du default-gateway. | string séparé par virgules | mesh,production/prod-gateway |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstatcan%2Fingress-istio-controller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstatcan%2Fingress-istio-controller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstatcan%2Fingress-istio-controller/lists"}