feat: Add OpenShift Route support for Listeners

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - Add `/ready` endpoint to the operator Deployment, which reports the CRD installation status ([#434]).
 - Add startup probe to the operator Deployment ([#434]).
+- Add the `OpenShiftRoute` ListenerClass service type, which exposes Listeners through OpenShift Routes.
 
 ### Changed
 

Cargo.toml

@@ -41,5 +41,6 @@ tracing = "0.1.40"
 walkdir = "2.5.0"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
+stackable-operator = { git = "https://github.com/marc-merino/operator-rs.git", branch = "knit/openshift-route-listeners" }
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
 # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }

deploy/helm/listener-operator/templates/roles.yaml

@@ -76,6 +76,17 @@ rules:
       - create
       - patch
       - delete
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - patch
+      - delete
   # PersistentVolumes are watched to retrigger Listener reconciliation on node affinity
   # changes. The CSI node driver patches PV labels via Server-Side Apply to associate PVs
   # with their Listener. The external-provisioner sidecar creates and deletes PVs for PVC

docs/modules/listener-operator/pages/listenerclass.adoc

@@ -161,6 +161,13 @@ If a pinned node becomes unavailable, the service may become unreachable until t
 * **Requirements**: Kubernetes cluster must have a LoadBalancer controller
 * **Cost**: Cloud providers typically charge for load balancer usage
 
+[#servicetype-openshift-route]
+==== OpenShiftRoute
+Exposes a single Listener port through an OpenShift Route, using a hostname assigned by OpenShift.
+Set `openshiftRoute.port` to choose the port if the Listener has more than one.
+By default (`openshiftRoute.tls: Passthrough`), TLS traffic is forwarded to the application on port 443; `tls: None` forwards plain HTTP on port 80.
+Only hostnames that the Route has been admitted for are published.
+
 === Advanced Configuration
 
 [#servicetype-loadbalancer-class]

extra/crds.yaml

@@ -38,6 +38,22 @@ spec:
                   Ignored unless serviceType is LoadBalancer.
                 nullable: true
                 type: string
+              openshiftRoute:
+                description: Ignored unless `serviceType` is `OpenShiftRoute`.
+                nullable: true
+                properties:
+                  port:
+                    description: Required when the Listener has more than one port.
+                    nullable: true
+                    type: string
+                  tls:
+                    default: Passthrough
+                    description: '`Passthrough` (default) uses port 443; `None` serves plain HTTP on port 80.'
+                    enum:
+                    - Passthrough
+                    - None
+                    type: string
+                type: object
               pinnedNodePorts:
                 default: false
                 description: |-
@@ -106,6 +122,7 @@ spec:
                 - NodePort
                 - LoadBalancer
                 - ClusterIP
+                - OpenShiftRoute
                 type: string
             required:
             - serviceType

rust/operator-binary/Cargo.toml

@@ -25,6 +25,7 @@ tonic.workspace = true
 tonic-reflection.workspace = true
 anyhow.workspace = true
 serde.workspace = true
+serde_json.workspace = true
 serde_yaml.workspace = true
 snafu.workspace = true
 strum.workspace = true