The gateway can forward traffic from extra source cidrs

pkg/yurtmanager/controller/raven/gatewaypickup/gateway_pickup_controller.go

@@ -189,6 +189,7 @@
 	}
 	sort.Slice(nodes, func(i, j int) bool { return nodes[i].NodeName < nodes[j].NodeName })
 	gw.Status.Nodes = nodes
+	r.addExtraAllowedSubnet(&gw)
 	err = r.Status().Update(ctx, &gw)
 	if err != nil {
 		if apierrs.IsConflict(err) {
@@ -372,3 +373,23 @@
 	}
 	return
 }
+
+func (r *ReconcileGateway) addExtraAllowedSubnet(gw *ravenv1beta1.Gateway) {
+	if gw.Annotations == nil || gw.Annotations[util.ExtraAllowedSourceCIDRs] == "" {
+		return
+	}
+	subnets := strings.Split(gw.Annotations[util.ExtraAllowedSourceCIDRs], ",")
+	var gatewayName string
+	for _, aep := range gw.Status.ActiveEndpoints {
+		if aep.Type == ravenv1beta1.Tunnel {
+			gatewayName = aep.NodeName
+			break
+		}
+	}
+	for idx, node := range gw.Status.Nodes {
+		if node.NodeName == gatewayName {
+			gw.Status.Nodes[idx].Subnets = append(gw.Status.Nodes[idx].Subnets, subnets...)
+			break
+		}
+	}
+}

pkg/yurtmanager/controller/raven/gatewaypickup/gateway_pickup_controller_test.go

@@ -18,6 +18,7 @@ package gatewaypickup
 
 import (
 	"context"
+	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -465,3 +466,79 @@ func TestReconcileGateway_getPodCIDRs(t *testing.T) {
 		})
 	}
 }
+
+func TestReconcileGateway_addExtraAllowedSubnet(t *testing.T) {
+	mockReconciler := &ReconcileGateway{}
+	gw := &ravenv1beta1.Gateway{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "gateway",
+			Annotations: map[string]string{
+				util.ExtraAllowedSourceCIDRs: "1.1.1.1/32,2.2.2.2/32",
+			},
+		},
+		Spec: ravenv1beta1.GatewaySpec{
+			TunnelConfig: ravenv1beta1.TunnelConfiguration{
+				Replicas: 1,
+			},
+			Endpoints: []ravenv1beta1.Endpoint{
+				{
+					NodeName: "node-1",
+					Type:     ravenv1beta1.Tunnel,
+				},
+			},
+		},
+		Status: ravenv1beta1.GatewayStatus{
+			ActiveEndpoints: []*ravenv1beta1.Endpoint{
+				{
+					NodeName: "node-1",
+					Type:     ravenv1beta1.Tunnel,
+				},
+			},
+			Nodes: []ravenv1beta1.NodeInfo{
+				{
+					NodeName:  "node-1",
+					PrivateIP: "10.10.10.10",
+					Subnets:   []string{"10.244.10.0/24"},
+				},
+			},
+		},
+	}
+	expect := &ravenv1beta1.Gateway{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "gateway",
+			Annotations: map[string]string{
+				util.ExtraAllowedSourceCIDRs: "1.1.1.1/32,2.2.2.2/32",
+			},
+		},
+		Spec: ravenv1beta1.GatewaySpec{
+			TunnelConfig: ravenv1beta1.TunnelConfiguration{
+				Replicas: 1,
+			},
+			Endpoints: []ravenv1beta1.Endpoint{
+				{
+					NodeName: "node-1",
+					Type:     ravenv1beta1.Tunnel,
+				},
+			},
+		},
+		Status: ravenv1beta1.GatewayStatus{
+			ActiveEndpoints: []*ravenv1beta1.Endpoint{
+				{
+					NodeName: "node-1",
+					Type:     ravenv1beta1.Tunnel,
+				},
+			},
+			Nodes: []ravenv1beta1.NodeInfo{
+				{
+					NodeName:  "node-1",
+					PrivateIP: "10.10.10.10",
+					Subnets:   []string{"10.244.10.0/24", "1.1.1.1/32", "2.2.2.2/32"},
+				},
+			},
+		},
+	}
+	mockReconciler.addExtraAllowedSubnet(gw)
+	if !reflect.DeepEqual(gw.Status.Nodes, expect.Status.Nodes) {
+		t.Errorf("failed add extra allowed subnet, expect %v, but get %v", expect.Status.Nodes, gw.Status.Nodes)
+	}
+}

pkg/yurtmanager/controller/raven/util/constants.go

@@ -25,6 +25,7 @@ const (
 	GatewayProxyInternalService    = "x-raven-proxy-internal-svc"
 	GatewayProxyServiceNamePrefix  = "x-raven-proxy-svc"
 	GatewayTunnelServiceNamePrefix = "x-raven-tunnel-svc"
+	ExtraAllowedSourceCIDRs        = "raven.openyurt.io/extra-allowed-source-cidrs"
 
 	RavenProxyNodesConfig      = "edge-tunnel-nodes"
 	ProxyNodesKey              = "tunnel-nodes"