メニュー
Bidirectional gRPC sync architecture between Controller and Gateway — ConfigSync protocol, Watch/List mechanism, implementation on both sides.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Conventions shared by the in-repo binaries (edgion-controller, edgion-gateway, edgion-cli) — project overview, command line / directory / config-path conventions, Core layering conventions, resource system.
KubernetesCenter implementation — K8s Reflector watching, leader election, HA mode, ResourceController lifecycle, status writeback.
ConfigCenter subsystem — ConfCenter trait abstraction, FileSystemCenter and KubernetesCenter implementations, unified Workqueue + ResourceProcessor pipeline.
edgion-controller control plane architecture — overall design, startup/shutdown, Admin API, ConfigCenter, Workqueue, ResourceProcessor, Requeue, CacheServer, ACME service.
Route matching overview — multi-stage pipeline (Listener→Domain→Path→DeepMatch), per-listener isolation, registration flow, atomic swap.
TLS subsystem overview — TLS Store, SNI matching, certificate management, BoringSSL/OpenSSL backend selection.
| name | controller-gateway-link |
| description | Bidirectional gRPC sync architecture between Controller and Gateway — ConfigSync protocol, Watch/List mechanism, implementation on both sides. |
Controller and Gateway communicate via bidirectional gRPC for configuration sync. Gateway connects to Controller as a client, fetching the full state via List and incremental updates via Watch.
| File | Topic | Recommended reading scenario |
|---|---|---|
| 00-overview.md | ConfigSync gRPC protocol overview | Understanding the sync protocol design, Proto definitions, version tracking |
| 01-controller-side.md | Controller-side gRPC server | Debugging ConfigSyncServer, WatchObj, ClientRegistry |
| 02-gateway-side.md | Gateway-side gRPC client | Debugging ConfigSyncClient, ClientCache, ConfHandler |
| webhook.md | Webhook provider (backendRef target + request-templating redesign) | Webhook outbound request shape, origin/custom allow-list, presence policy, controller-side template compile + secret resolution, consumer path_override API, health-reset semantics |
Controller Gateway
┌─────────────────────────┐ ┌─────────────────────────┐
│ │ │ │
│ ResourceProcessor │ │ ConfigSyncClient │
│ └── ServerCache<T> │ gRPC │ ├── grpc_client │
│ └── EventStore │◄──────────────►│ └── ConfigClient │
│ │ │ └── ClientCache │
│ ConfigSyncServer │ List/Watch │ └── EventDispatch
│ ├── WatchObj (per-kind)│──────────────►│ └── ConfHandler
│ └── ClientRegistry │ │ │
│ │ WatchMeta │ │
│ server_id (per-start) │──────────────►│ Detects server_id change
│ │ │ → triggers full relist │
└─────────────────────────┘ └─────────────────────────┘
sync_version (monotonically increasing) and server_id (UUID) are used together to enable incremental sync and Controller-restart detection.ReferenceGrant and Secret are no_sync_kinds; they are used only on the Controller side and are not sent to the Gateway.conf_sync_security configuration enables mutual TLS authentication on the gRPC channel, supporting multiple named certificate sets ([[conf_sync_security.certs]]) selected by an active field, while remaining backward compatible with the legacy single-set [conf_sync_security.tls] format. Certificates are generated via edgion-cli gen-certs --cert-name <name>. See 00-overview.md § Channel security for details.common/conf_sync (Proto + shared traits), common/config (TLS configuration structs), controller/conf_sync (server side), gateway/conf_sync (client side), ctl/certs (certificate generation).POST controller /api/v1/admin/wipe-all (testing-mode only) deletes all 20 kinds in tier order, used together with cache_residue to verify leaks. See 05-testing/02-cache-residue-detection.md for details.