Repository: envoyproxy/gateway

Issue:
Disable Deep Copy in Controller Runtime for more resources
> hey @shreealt can you raise a follow up to address a few more things> 
> 1. remove ConfigMap which is defined twice> 
> 2. move the top comments around Pod closer to the `mgrOpts.Cache.ByObject[&corev1.Pod{}]`> 
> 3. add comments around disabling deep copy for read only resources> 
> 4. add more read only resources> 
>   * ClusterTrustBundle https://github.com/envoyproxy/gateway/blob/main/internal/provider/kubernetes/controller_watch.go> 
>   * ServiceImport> 
>   * EndpointSlice> 
>   * Deployment> 
>   * Node> 
>   * ReferenceGrant> 
>   * DaemonSet> 
>   https://github.com/envoyproxy/gateway/blob/5e41fac103b7d5188ed255ac2297d1636aa2d8f8/internal/provider/kubernetes/controller.go#L1766  

 _Originally posted by @arkodg in [5e41fac](https://github.com/envoyproxy/gateway/commit/5e41fac103b7d5188ed255ac2297d1636aa2d8f8#r167890135)_

Discussion:

Solution patch:
diff --git a/internal/provider/kubernetes/kubernetes.go b/internal/provider/kubernetes/kubernetes.go
index be77a607b..c35058cb5 100644
--- a/internal/provider/kubernetes/kubernetes.go
+++ b/internal/provider/kubernetes/kubernetes.go
@@ -10,7 +10,9 @@ import (
 	"fmt"
 	"time"
 
+	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
@@ -24,6 +26,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/envoygateway"
@@ -116,9 +119,9 @@ func New(ctx context.Context, restCfg *rest.Config, svrCfg *ec.Server, resources
 	}
 
 	// Limit the cache to only Envoy proxy Pods to reduce memory and sync churn.
-	// ProxyTopologyInjector is the only component that interacts with Pods.
 	if mgrOpts.Cache.ByObject == nil {
 		mgrOpts.Cache.ByObject = map[client.Object]cache.ByObject{
+			// Disable deepcopy for read only resources
 			&corev1.Secret{}: {
 				UnsafeDisableDeepCopy: ptr.To(true),
 			},
@@ -128,12 +131,25 @@ func New(ctx context.Context, restCfg *rest.Config, svrCfg *ec.Server, resources
 			&corev1.Service{}: {
 				UnsafeDisableDeepCopy: ptr.To(true),
 			},
-			&corev1.ConfigMap{}: {
+			&discoveryv1.EndpointSlice{}: {
+				UnsafeDisableDeepCopy: ptr.To(true),
+			},
+			&appsv1.Deployment{}: {
+				UnsafeDisableDeepCopy: ptr.To(true),
+			},
+			&corev1.Node{}: {
+				UnsafeDisableDeepCopy: ptr.To(true),
+			},
+			&gwapiv1b1.ReferenceGrant{}: {
+				UnsafeDisableDeepCopy: ptr.To(true),
+			},
+			&appsv1.DaemonSet{}: {
 				UnsafeDisableDeepCopy: ptr.To(true),
 			},
 		}
 	}
 
+	// ProxyTopologyInjector is the only component that interacts with Pods.
 	mgrOpts.Cache.ByObject[&corev1.Pod{}] = cache.ByObject{
 		Label: labels.SelectorFromSet(proxy.EnvoyAppLabel()),
 	}



Test patch:
diff --git a/internal/infrastructure/kubernetes/proxy/resource_test.go b/internal/infrastructure/kubernetes/proxy/resource_test.go
index 6f8511d60..4bbca074e 100644
--- a/internal/infrastructure/kubernetes/proxy/resource_test.go
+++ b/internal/infrastructure/kubernetes/proxy/resource_test.go
@@ -7,6 +7,7 @@ package proxy
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -65,7 +66,7 @@ func TestExpectedShutdownManagerSecurityContext(t *testing.T) {
 
 func TestResolveProxyImage(t *testing.T) {
 	defaultImage := egv1a1.DefaultEnvoyProxyImage
-	defaultTag := "distroless-dev"
+	defaultTag := strings.Split(defaultImage, ":")[1]
 
 	tests := []struct {
 		name        string
diff --git a/test/e2e/tests/oidc-backendcluster.go b/test/e2e/tests/oidc-backendcluster.go
index fec73d743..475ac67b3 100644
--- a/test/e2e/tests/oidc-backendcluster.go
+++ b/test/e2e/tests/oidc-backendcluster.go
@@ -23,10 +23,10 @@ func init() {
 var OIDCBackendClusterTest = suite.ConformanceTest{
 	ShortName:   "OIDC with BackendCluster",
 	Description: "Test OIDC authentication",
-	Manifests:   []string{"testdata/oidc-keycloak.yaml", "testdata/oidc-securitypolicy-backendcluster.yaml"},
+	Manifests:   []string{"testdata/oidc-keycloak.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		t.Run("oidc provider represented by a BackendCluster", func(t *testing.T) {
-			testOIDC(t, suite)
+			testOIDC(t, suite, "testdata/oidc-securitypolicy-backendcluster.yaml")
 		})
 	},
 }
diff --git a/test/e2e/tests/oidc.go b/test/e2e/tests/oidc.go
index 7f1d74fe6..2e7e1de2a 100644
--- a/test/e2e/tests/oidc.go
+++ b/test/e2e/tests/oidc.go
@@ -48,16 +48,22 @@ func init() {
 var OIDCTest = suite.ConformanceTest{
 	ShortName:   "OIDC",
 	Description: "Test OIDC authentication",
-	Manifests:   []string{"testdata/oidc-keycloak.yaml", "testdata/oidc-securitypolicy.yaml"},
+	Manifests:   []string{"testdata/oidc-keycloak.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		t.Run("oidc provider represented by a URL", func(t *testing.T) {
-			testOIDC(t, suite)
+			testOIDC(t, suite, "testdata/oidc-securitypolicy.yaml")
 		})
 
 		t.Run("oidc bypass", func(t *testing.T) {
 			ns := "gateway-conformance-infra"
+
+			podInitialized := corev1.PodCondition{Type: corev1.PodInitialized, Status: corev1.ConditionTrue}
 			// Wait for the keycloak pod to be configured with the test user and client
-			WaitForPods(t, suite.Client, ns, map[string]string{"app": "keycloak"}, corev1.PodRunning, &PodReady)
+			WaitForPods(t, suite.Client, ns, map[string]string{"job-name": "setup-keycloak"}, corev1.PodSucceeded, &podInitialized)
+
+			// Apply the security policy that configures OIDC authentication
+			suite.Applier.MustApplyWithCleanup(t, suite.Client, suite.TimeoutConfig, "testdata/oidc-securitypolicy.yaml", true)
+
 			routeWithOIDCNN := types.NamespacedName{Name: "http-with-oidc", Namespace: ns}
 			routeWithoutOIDCNN := types.NamespacedName{Name: "http-without-oidc", Namespace: ns}
 			gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
@@ -112,7 +118,7 @@ var OIDCTest = suite.ConformanceTest{
 	},
 }
 
-func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {
+func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite, securityPolicyManifest string) {
 	var (
 		testURL   = "http://www.example.com/myapp"
 		logoutURL = "http://www.example.com/myapp/logout"
@@ -121,8 +127,12 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {
 		ns        = "gateway-conformance-infra"
 	)
 
+	podInitialized := corev1.PodCondition{Type: corev1.PodInitialized, Status: corev1.ConditionTrue}
 	// Wait for the keycloak pod to be configured with the test user and client
-	WaitForPods(t, suite.Client, ns, map[string]string{"app": "keycloak"}, corev1.PodRunning, &PodReady)
+	WaitForPods(t, suite.Client, ns, map[string]string{"job-name": "setup-keycloak"}, corev1.PodSucceeded, &podInitialized)
+
+	// Apply the security policy that configures OIDC authentication
+	suite.Applier.MustApplyWithCleanup(t, suite.Client, suite.TimeoutConfig, securityPolicyManifest, true)
 
 	routeNN := types.NamespacedName{Name: route, Namespace: ns}
 	gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
@@ -179,6 +189,7 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {
 					},
 				}
 				require.NoError(t, suite.Client.Delete(context.TODO(), existingSP))
+				suite.Applier.MustApplyWithCleanup(t, suite.Client, suite.TimeoutConfig, securityPolicyManifest, false)
 				SecurityPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: sp, Namespace: ns}, suite.ControllerName, ancestorRef)
 				return false, nil
 			}