feat(provisioner): ContourDeployment loadBalancerSourceRanges and loadBalancerClass by VedantMadane · Pull Request #7665 · projectcontour/contour

VedantMadane · 2026-08-09T15:15:13Z

Summary

Adds loadBalancerSourceRanges and loadBalancerClass to ContourDeployment.spec.envoy.networkPublishing so the Gateway provisioner can set the corresponding Envoy Service fields when publishing as a LoadBalancer.

Fixes #7334

Motivation

When using Contour Gateway Provisioner with a custom ContourDeployment, there was no way to configure:

Service.spec.loadBalancerSourceRanges (restrict source IPs)
Service.spec.loadBalancerClass (select LB implementation)

Changes

API (ContourDeployment / NetworkPublishing): new optional fields
Provisioner model + gateway controller: plumb fields from ContourDeployment params
Envoy Service: set fields when publishing type is LoadBalancerService
Equality: detect changes to reconcile those fields
CRDs / examples: regenerated-style updates for the new schema
Unit test: TestDesiredEnvoyServiceLoadBalancerFields

Example

apiVersion: projectcontour.io/v1alpha1
kind: ContourDeployment
metadata:
  name: contour
spec:
  envoy:
    networkPublishing:
      type: LoadBalancerService
      loadBalancerSourceRanges:
        - 10.0.0.0/8
      loadBalancerClass: service.k8s.aws/nlb

…lass on ContourDeployment Allow ContourDeployment.spec.envoy.networkPublishing to configure the Envoy Service LoadBalancer fields Service.spec.loadBalancerSourceRanges and Service.spec.loadBalancerClass so Gateway provisioner users can restrict source IPs and select a load balancer implementation. Fixes projectcontour#7334 Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>

Add unreleased changelog for projectcontour#7665 and regenerate CRDs, example manifests, and API reference docs so check-generate passes. Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>

Add unreleased changelog for projectcontour#7665 and regenerate CRDs, example manifests, and API reference docs so check-generate passes. Signed-off-by: Vedant Madane <vedantnm@gmail.com>

codecov · 2026-08-18T16:46:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.37%. Comparing base (fdb28b9) to head (74297e0).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7665      +/-   ##
==========================================
+ Coverage   82.35%   82.37%   +0.01%     
==========================================
  Files         131      131              
  Lines       15915    15930      +15     
==========================================
+ Hits        13107    13122      +15     
  Misses       2520     2520              
  Partials      288      288

Files with missing lines	Coverage Δ
internal/provisioner/controller/gateway.go	`60.42% <100.00%> (+0.68%)`	⬆️
internal/provisioner/equality/equality.go	`56.85% <100.00%> (+1.35%)`	⬆️
internal/provisioner/model/model.go	`100.00% <ø> (ø)`
internal/provisioner/objects/service/service.go	`75.80% <100.00%> (+0.66%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add unit coverage for ContourDeployment networkPublishing LB fields through equality change detection, DesiredEnvoyService (LB and ClusterIP ignore paths), and gateway controller copy into the Envoy Service. Improves codecov/patch on the ContourDeployment LB feature. Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>

sufiyanpk7 · 2026-08-25T05:52:11Z

When will this go live? I’m not sure why the LoadBalancer class is restricting us. It’s forcing us to move away from Contour and use Envoy Gateway instead, in the VMware ecosystem :(

tsaarni · 2026-08-27T10:42:33Z

+	if !apiequality.Semantic.DeepEqual(current.Spec.LoadBalancerClass, expected.Spec.LoadBalancerClass) {
+		updated.Spec.LoadBalancerClass = expected.Spec.LoadBalancerClass
+		changed = true
+	}
+


The comment on LoadBalancerClass says (link)

This field can only be set when creating or updating a Service to type 'LoadBalancer'. Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type.

So since we cannot update this, the inequality should be ignored, or what do you think?

tsaarni · 2026-08-27T10:50:18Z

+				if len(networkPublishing.LoadBalancerSourceRanges) > 0 {
+					contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerSourceRanges = networkPublishing.LoadBalancerSourceRanges
+				}
+				if networkPublishing.LoadBalancerClass != nil {
+					contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerClass = networkPublishing.LoadBalancerClass
+				}


I think we can simplify

Suggested change

if len(networkPublishing.LoadBalancerSourceRanges) > 0 {

contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerSourceRanges = networkPublishing.LoadBalancerSourceRanges

}

if networkPublishing.LoadBalancerClass != nil {

contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerClass = networkPublishing.LoadBalancerClass

}

contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerSourceRanges = networkPublishing.LoadBalancerSourceRanges

contourModel.Spec.NetworkPublishing.Envoy.LoadBalancerClass = networkPublishing.LoadBalancerClass

tsaarni · 2026-08-27T10:55:33Z

+	// Optional LoadBalancer Service fields from ContourDeployment networkPublishing.
+	if epType == model.LoadBalancerServicePublishingType {
+		if len(contour.Spec.NetworkPublishing.Envoy.LoadBalancerSourceRanges) > 0 {
+			svc.Spec.LoadBalancerSourceRanges = contour.Spec.NetworkPublishing.Envoy.LoadBalancerSourceRanges
+		}
+		if contour.Spec.NetworkPublishing.Envoy.LoadBalancerClass != nil {
+			svc.Spec.LoadBalancerClass = contour.Spec.NetworkPublishing.Envoy.LoadBalancerClass
+		}
+	}


Lets move these under load balancer type case

switch epType { case model.LoadBalancerServicePublishingType: // all loadbalancer type related fields set here

tsaarni · 2026-08-27T11:03:06Z

+	// LoadBalancerSourceRanges is an optional list of IP ranges in CIDR form
+	// which are allowed to access the LoadBalancer type Envoy Service.
+	// This maps to Service.spec.loadBalancerSourceRanges.
+	// Only applies when Type is LoadBalancerService.


We could add This field may be ignored if the cloud-provider does not support it

Suggested change

// LoadBalancerSourceRanges is an optional list of IP ranges in CIDR form

// which are allowed to access the LoadBalancer type Envoy Service.

// This maps to Service.spec.loadBalancerSourceRanges.

// Only applies when Type is LoadBalancerService.

// LoadBalancerSourceRanges is an optional list of IP ranges in CIDR form

// which are allowed to access the LoadBalancer type Envoy Service.

// This maps to Service.spec.loadBalancerSourceRanges.

// This field may be ignored if the cloud-provider does not support it.

// Only applies when Type is LoadBalancerService.

tsaarni · 2026-08-27T11:04:43Z

+	// LoadBalancerClass is the class of the load balancer implementation
+	// to use for the Envoy Service when Type is LoadBalancerService.
+	// This maps to Service.spec.loadBalancerClass.


Suggested change

// LoadBalancerClass is the class of the load balancer implementation

// to use for the Envoy Service when Type is LoadBalancerService.

// This maps to Service.spec.loadBalancerClass.

// LoadBalancerClass is the class of the load balancer implementation

// to use for the Envoy Service when Type is LoadBalancerService.

// This maps to Service.spec.loadBalancerClass.

// Once set, it cannot be changed without recreating the Service.

// Only applies when Type is LoadBalancerService.

tsaarni

@VedantMadane Thanks for contributing! I left some inline comments to check.

VedantMadane requested a review from a team as a code owner August 9, 2026 15:15

VedantMadane requested review from sunjayBhatia and tsaarni and removed request for a team August 9, 2026 15:15

tsaarni added the release-note/small A small change that needs one line of explanation in the release notes. label Aug 18, 2026

VedantMadane added 2 commits August 18, 2026 15:29

chore: add changelog and regenerate codegen for LB fields

df76deb

Add unreleased changelog for projectcontour#7665 and regenerate CRDs, example manifests, and API reference docs so check-generate passes. Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>

VedantMadane force-pushed the feat/contourdeployment-lb-source-ranges-class-7334 branch from 1b726e3 to 96edf5e Compare August 18, 2026 15:39

VedantMadane force-pushed the feat/contourdeployment-lb-source-ranges-class-7334 branch from 42fb60a to 74297e0 Compare August 22, 2026 13:23

tsaarni reviewed Aug 27, 2026

View reviewed changes

tsaarni requested changes Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(provisioner): ContourDeployment loadBalancerSourceRanges and loadBalancerClass - #7665

feat(provisioner): ContourDeployment loadBalancerSourceRanges and loadBalancerClass#7665
VedantMadane wants to merge 3 commits into
projectcontour:mainfrom
VedantMadane:feat/contourdeployment-lb-source-ranges-class-7334

VedantMadane commented Aug 9, 2026

Uh oh!

codecov Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

sufiyanpk7 commented Aug 25, 2026

Uh oh!

tsaarni Aug 27, 2026

Uh oh!

tsaarni Aug 27, 2026

Uh oh!

tsaarni Aug 27, 2026

Uh oh!

tsaarni Aug 27, 2026 •

edited

Loading

Uh oh!

tsaarni Aug 27, 2026

Uh oh!

tsaarni left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

VedantMadane commented Aug 9, 2026

Summary

Motivation

Changes

Example

Uh oh!

codecov Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sufiyanpk7 commented Aug 25, 2026

Uh oh!

tsaarni Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

tsaarni Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

tsaarni Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

tsaarni Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tsaarni Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

tsaarni left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Aug 18, 2026 •

edited

Loading

tsaarni Aug 27, 2026 •

edited

Loading