feat: Add ability to patch dataplane Service, Deployment, and DaemonSet in NginxProxy #3630

ciarams87 · 2025-07-16T16:02:47Z

Proposed changes

Problem: There are many Deployment and Service fields that can be customized, and having to expose all of them in the NginxProxy resource is tedious and unnecessary for uncommonly used fields.

Solution: Add a way to submit custom patches to unblock users who need to set fields that are not yet exposed in the NginxProxy CRD. This commit adds support for patching the Service, Deployment, and DaemonSet resources using StrategicMerge (default kubernetes patch strategy), Merge (used when the intelligent strategic merge behaviour is not desired, e.g. to replace an array instead of merging them), and JSONPatch (used when precise modifications are needed, such as adding elements to specific array indices or performing conditional operations based on existing values).

Testing: Unit testing, and manual testing all the variations. Example NginxProxy:

apiVersion: gateway.nginx.org/v1alpha2
kind: NginxProxy
metadata:
  name: custom-proxy
spec:
  kubernetes:
    # Service patches - demonstrates all three patch types
    service:
      patches:
        # Strategic merge patch - adds custom labels and annotations
        - type: StrategicMerge
          value:
            metadata:
              labels:
                custom-label: "service-patched"
                environment: "test"
              annotations:
                custom-annotation: "applied-via-patch"
        # Merge patch - modifies spec fields
        - type: Merge
          value:
            spec:
              sessionAffinity: "ClientIP"
        # JSON patch - adds a specific annotation
        - type: JSONPatch
          value:
            - op: add
              path: "/metadata/annotations/patched-by"
              value: "json-patch"
            - op: add
              path: "/spec/loadBalancerSourceRanges"
              value: ["10.0.0.0/8", "192.168.0.0/16"]

    # Deployment patches - for when nginx.kind is "deployment"
    deployment:
      patches:
        # Strategic merge patch - adds deployment-specific labels
        - type: StrategicMerge
          value:
            metadata:
              labels:
                deployment-type: "nginx-proxy"
                patched: "true"
            spec:
              template:
                metadata:
                  labels:
                    pod-patched: "true"
        # JSON patch - modifies strategy and adds env var
        - type: JSONPatch
          value:
            - op: add
              path: "/spec/strategy"
              value:
                type: "RollingUpdate"
                rollingUpdate:
                  maxUnavailable: 1
                  maxSurge: 1
            - op: add
              path: "/spec/template/spec/containers/0/env"
              value:
                - name: "PATCHED_BY"
                  value: "json-patch"
                - name: "DEPLOYMENT_MODE"
                  value: "patched"

Note 1: We don't have the ability to perform validation on patches. Errors in Patches will be logged in the control plane, but will not be reported in the status of the NginxProxy. Additionally, the resources will be created regardless - I don't believe we should fail the resource creation because of patch errors. It will be on the user to ensure patches have been applied correctly (this will be documented in the data plane configuration doc)

Note 2: Uses gopkg.in/evanphx/json-patch.v4 instead of the latest v5 to match Kubernetes ecosystem libraries and ensure consistent RFC 6902 compliance with kubectl. See this issue for a similar example

Closes #3568

Checklist

Before creating a PR, run through this checklist and mark each as complete.

I have read the CONTRIBUTING doc
I have added tests that prove my fix is effective or that my feature works
I have checked that all unit tests pass after adding my changes
I have updated necessary documentation
I have rebased my branch onto main
I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

Release notes

If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.

Added the ability to patch the dataplane Service, Deployment, and DaemonSet resources through NginxProxy

codecov · 2025-07-16T16:05:01Z

Codecov Report

Attention: Patch coverage is 83.51648% with 15 lines in your changes missing coverage. Please review.

Project coverage is 87.02%. Comparing base (0ca388f) to head (20b981d).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/controller/provisioner/objects.go	83.51%	10 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3630      +/-   ##
==========================================
- Coverage   87.11%   87.02%   -0.09%     
==========================================
  Files         127      127              
  Lines       15517    15579      +62     
  Branches       62       62              
==========================================
+ Hits        13517    13557      +40     
- Misses       1847     1862      +15     
- Partials      153      160       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sjberman · 2025-07-16T19:27:35Z

apis/v1alpha2/nginxproxy_types.go

+	// For JSONPatch patches, this should be a JSON array of patch operations.
+	//
+	// +kubebuilder:validation:XPreserveUnknownFields
+	Value *apiextv1.JSON `json:"value"`


Should this field be marked as optional?

Do we omitempty or does the linter say it's unnecessary?

Good catch, it's not required but it is actually best practice so I'll add it

I just know that sometimes my IDE or linter says that it's not necessary for certain nested structs. Can't remember the reasoning, but functionally it ends up the same.

sjberman · 2025-07-16T19:29:51Z

internal/controller/provisioner/objects.go

+	if len(errs) > 0 {
+		return objects, errors.Join(errs...)
+	}
+
+	return objects, nil


I think you could just do return objects, errors.Join(errs...). If errs is empty, it should return nil.

sjberman · 2025-07-16T19:44:51Z

apis/v1alpha2/nginxproxy_types.go

+
+const (
+	// PatchTypeStrategicMerge uses strategic merge patch.
+	PatchTypeStrategicMerge PatchType = "StrategicMerge"


Does k8s define these types at all? If so, it'd be nice to alias our types to theirs, instead of using the string literal.

I see there are some definitions here: https://github.com/kubernetes/apimachinery/blob/1ebcba2516a6683ca3be753b0b7e2cb203daf5dd/pkg/types/patch.go#L22

Which are used in the apiextentions-apiserver test code here: https://github.com/kubernetes/apiextensions-apiserver/blob/9fbc252b2071ab031a4011dd3d07fde4e281fe3c/test/integration/scope_test.go#L132-L138

Not really. The definitions @bjee19 links above are MIME types. I couldn't find any appropriate user friendly, CRD style definitions we could reference.

internal/controller/provisioner/objects.go

internal/controller/provisioner/objects_test.go

…NginxProxy

bjee19

nice job! 🚀

ciarams87 requested a review from a team as a code owner July 16, 2025 16:02

github-project-automation bot added this to NGINX Gateway Fabric Jul 16, 2025

github-project-automation bot moved this to 🆕 New in NGINX Gateway Fabric Jul 16, 2025

nginx-bot bot added the release-notes label Jul 16, 2025

github-actions bot added enhancement New feature or request dependencies Pull requests that update a dependency file labels Jul 16, 2025

sjberman reviewed Jul 16, 2025

View reviewed changes

bjee19 reviewed Jul 16, 2025

View reviewed changes

internal/controller/provisioner/objects.go Outdated Show resolved Hide resolved

bjee19 reviewed Jul 16, 2025

View reviewed changes

internal/controller/provisioner/objects.go Outdated Show resolved Hide resolved

bjee19 reviewed Jul 16, 2025

View reviewed changes

internal/controller/provisioner/objects_test.go Outdated Show resolved Hide resolved

sjberman mentioned this pull request Jul 17, 2025

Add extra containers entry to inject side cars into deployment #3486

Open

6 tasks

Add ability to patch dataplane Service, Deployment, and DaemonSet in …

0d0cd31

…NginxProxy

ciarams87 force-pushed the feat/patch-nginx-proxy branch from da6ed02 to 086855b Compare July 21, 2025 14:30

Review feedback

d03daba

ciarams87 force-pushed the feat/patch-nginx-proxy branch from 086855b to d03daba Compare July 21, 2025 14:33

ciarams87 requested review from sjberman and bjee19 July 21, 2025 14:34

Add omitempty, regenerate CRDs

20b981d

sjberman approved these changes Jul 21, 2025

View reviewed changes

bjee19 approved these changes Jul 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add ability to patch dataplane Service, Deployment, and DaemonSet in NginxProxy #3630

feat: Add ability to patch dataplane Service, Deployment, and DaemonSet in NginxProxy #3630

ciarams87 commented Jul 16, 2025

Uh oh!

codecov bot commented Jul 16, 2025 •

edited

Loading

Uh oh!

sjberman Jul 16, 2025

Uh oh!

sjberman Jul 21, 2025

Uh oh!

ciarams87 Jul 21, 2025

Uh oh!

sjberman Jul 21, 2025

Uh oh!

sjberman Jul 16, 2025

Uh oh!

sjberman Jul 16, 2025

Uh oh!

bjee19 Jul 16, 2025

Uh oh!

ciarams87 Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bjee19 left a comment

Uh oh!

Uh oh!

feat: Add ability to patch dataplane Service, Deployment, and DaemonSet in NginxProxy #3630

Are you sure you want to change the base?

feat: Add ability to patch dataplane Service, Deployment, and DaemonSet in NginxProxy #3630

Conversation

ciarams87 commented Jul 16, 2025

Proposed changes

Checklist

Release notes

Uh oh!

codecov bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bjee19 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Jul 16, 2025 •

edited

Loading