feat(k8s): Support new Gateway api

internal/service/access_controls_service.go

@@ -10,8 +10,12 @@ import (
 	"go.uber.org/dig"
 )
 
+// LabelProvider looks up the apps it knows about for the given domain. A
+// provider that knows which hosts its apps are served on MUST only yield the
+// ones that are actually served on domain, so that an unrelated app cannot
+// claim it by name.
 type LabelProvider interface {
-	Lookup(locator func(name string, app *model.App) bool) error
+	Lookup(domain string, locator func(name string, app *model.App) bool) error
 }
 
 type AccessControlsService struct {
@@ -113,7 +117,9 @@ func (service *AccessControlsService) GetAccessControls(domain string) (*model.A
 
 	// If we have a label provider configured, try to get ACLs from it
 	if service.labelProvider != nil {
-		return service.getACLs(domain, service.labelProvider.Lookup)
+		return service.getACLs(domain, func(locator func(name string, app *model.App) bool) error {
+			return service.labelProvider.Lookup(domain, locator)
+		})
 	}
 
 	// No labels

internal/service/access_controls_service_test.go

@@ -18,7 +18,7 @@ func newMockProvider(acls map[string]model.App, shouldError bool) *mockProvider
 	return &mockProvider{acls: acls, shouldError: shouldError}
 }
 
-func (m *mockProvider) Lookup(locator func(name string, app *model.App) bool) error {
+func (m *mockProvider) Lookup(_ string, locator func(name string, app *model.App) bool) error {
 	if m.shouldError {
 		return errors.New("mock error")
 	}
@@ -121,7 +121,7 @@ func TestAccessControlsService(t *testing.T) {
 				Config:        &model.Config{},
 				LabelProvider: mock,
 			})
-			app, err := acls.getACLs(test.domain, mock.Lookup)
+			app, err := acls.GetAccessControls(test.domain)
 			require.NoError(t, err)
 			require.Equal(t, test.want, app)
 		})
@@ -145,10 +145,11 @@ func TestAccessControlsService(t *testing.T) {
 	// get acls should return an error when the provider fails
 	mock := newMockProvider(map[string]model.App{}, true)
 	acls := NewAccessControlsService(AccessControlServiceInput{
-		Log:    log,
-		Config: &model.Config{},
+		Log:           log,
+		Config:        &model.Config{},
+		LabelProvider: mock,
 	})
-	_, err := acls.getACLs("example.com", mock.Lookup)
+	_, err := acls.GetAccessControls("example.com")
 	require.Error(t, err)
 
 	// get access controls should get acls from

internal/service/docker_service.go

@@ -67,7 +67,10 @@ func (docker *DockerService) inspectContainer(containerId string) (container.Ins
 	return docker.client.ContainerInspect(docker.context, containerId)
 }
 
-func (docker *DockerService) Lookup(locator func(name string, app *model.App) bool) error {
+// Lookup yields every app labelled on a running container. Container labels
+// carry no routing information, so the domain cannot be used to narrow the
+// results down and the caller is left to match them.
+func (docker *DockerService) Lookup(_ string, locator func(name string, app *model.App) bool) error {
 	if !docker.isConnected {
 		docker.log.App.Debug().Msg("Docker service not connected, returning empty labels")
 		return nil