@opensoha/contracts 0.1.27 → 0.2.0

package/resource/runtime/network_topology_builder_ingress.go

@@ -0,0 +1,302 @@
+package runtime
+
+import (
+	"fmt"
+	cr "github.com/opensoha/soha/contracts/resource"
+	"strings"
+)
+
+func (g *topologyGraph) ingress(o topologyObject) {
+	provider := g.classProvider("IngressClass", text(at(o.body, "spec", "ingressClassName")), "kubernetes")
+	entry := g.objectNode(o, "entry", provider, "HTTP")
+	if len(items(at(o.body, "spec", "tls"))) > 0 {
+		g.properties(entry, cr.NetworkTopologyProperty{Name: "TLS", Value: "Configured; certificate and controller execution unverified"})
+	}
+	index := 0
+	active := func() bool { return g.ctx.Err() == nil && !g.budgetReached() }
+	forEachIngressBackendDeclaration(o.body, active, func(ref ingressBackendDeclaration) {
+		matches := [][]cr.NetworkTopologyMatch{{{Type: "host", Value: ref.host}, {Type: "path", Operator: text(ref.path["pathType"]), Value: text(ref.path["path"])}}}
+		rule := g.rule(o, provider, "HTTP", index, "", matches)
+		index++
+		g.link(entry, rule, "matches", "HTTP", "")
+		if !ref.serviceDeclared {
+			g.state(rule, "unsupported_fragment")
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Backend", Value: "Custom resource backend requires its provider resolver"})
+			return
+		}
+		target := g.backend(rule, o.ref.Namespace, ref.serviceName, ref.port, "HTTP")
+		edge := g.link(rule, target, "forwards", "HTTP", ref.port)
+		edge.FieldPath = ref.fieldPath
+		edge.SourceRef = &o.ref
+	})
+	for _, tls := range items(at(o.body, "spec", "tls")) {
+		g.properties(entry, cr.NetworkTopologyProperty{Name: "TLS hosts", Value: strings.Join(texts(tls["hosts"]), ", ")})
+	}
+}
+
+func (g *topologyGraph) classProvider(kind, name, fallback string) string {
+	class, ok := g.objects[topologyKey(kind, "", name)]
+	if !ok {
+		return fallback
+	}
+	controller := text(at(class.body, "spec", "controller"))
+	if kind == "GatewayClass" {
+		controller = text(at(class.body, "spec", "controllerName"))
+	}
+	switch controller {
+	case "traefik.io/ingress-controller", "traefik.io/gateway-controller":
+		return "traefik"
+	case "apisix.apache.org/ingress-controller", "apisix.apache.org/apisix-ingress-controller":
+		return "apisix"
+	}
+	return fallback
+}
+
+func (g *topologyGraph) gatewayRoute(o topologyObject) {
+	protocol := gatewayRouteProtocol(o.ref.Kind)
+	entry := g.objectNode(o, "entry", "gateway", protocol)
+	g.properties(entry, cr.NetworkTopologyProperty{Name: "Hostnames", Value: strings.Join(texts(at(o.body, "spec", "hostnames")), ", ")})
+	for _, parent := range items(at(o.body, "spec", "parentRefs")) {
+		g.gatewayParent(o, entry, parent, protocol)
+	}
+	for index, raw := range items(at(o.body, "spec", "rules")) {
+		groups := gatewayMatchGroups(raw)
+		if o.ref.Kind == "TLSRoute" {
+			for _, host := range texts(at(o.body, "spec", "hostnames")) {
+				groups = append(groups, []cr.NetworkTopologyMatch{{Type: "sni", Value: host}})
+			}
+		}
+		rule := g.rule(o, "gateway", protocol, index, text(raw["name"]), groups)
+		if o.ref.Kind == "TLSRoute" && rule != "" {
+			node := g.nodes[rule]
+			node.Rule.TLSMode = "Passthrough"
+			g.nodes[rule] = node
+		}
+		g.link(entry, rule, "matches", protocol, "")
+		total := int64(0)
+		for _, backend := range items(raw["backendRefs"]) {
+			total += integer(backend["weight"], 1)
+		}
+		for backendIndex, backend := range items(raw["backendRefs"]) {
+			edge := g.gatewayBackend(o, rule, backend, "weights", protocol)
+			edge.FieldPath = fmt.Sprintf("spec.rules[%d].backendRefs[%d]", index, backendIndex)
+			edge.SourceRef = &o.ref
+			if total >= 0 {
+				edge.TotalWeight = &total
+			}
+		}
+		for filterIndex, filter := range items(raw["filters"]) {
+			g.gatewayFilter(o, rule, filter, protocol, fmt.Sprintf("spec.rules[%d].filters[%d]", index, filterIndex))
+		}
+	}
+	g.gatewayConditions(o, entry)
+}
+
+func gatewayRouteProtocol(kind string) string {
+	switch kind {
+	case "GRPCRoute":
+		return "GRPC"
+	case "TCPRoute":
+		return "TCP"
+	case "TLSRoute":
+		return "TLS"
+	case "UDPRoute":
+		return "UDP"
+	default:
+		return "HTTP"
+	}
+}
+
+func gatewayMatchGroups(rule map[string]any) [][]cr.NetworkTopologyMatch {
+	result := [][]cr.NetworkTopologyMatch{}
+	for _, match := range items(rule["matches"]) {
+		group := []cr.NetworkTopologyMatch{}
+		if path := object(match["path"]); len(path) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: "path", Operator: text(path["type"]), Value: text(path["value"])})
+		}
+		if method, ok := match["method"].(string); ok {
+			group = append(group, cr.NetworkTopologyMatch{Type: "method", Value: method})
+		} else if method := object(match["method"]); len(method) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: "grpc-method", Operator: text(method["type"]), Name: text(method["service"]), Value: text(method["method"])})
+		}
+		for _, kind := range []string{"headers", "queryParams"} {
+			for _, value := range items(match[kind]) {
+				group = append(group, cr.NetworkTopologyMatch{Type: kind, Name: text(value["name"]), Operator: text(value["type"]), Value: "[redacted]"})
+			}
+		}
+		result = append(result, group)
+	}
+	return result
+}
+
+func (g *topologyGraph) gatewayBackend(o topologyObject, rule string, backend map[string]any, relation, protocol string) *cr.NetworkTopologyGraphEdge {
+	ns := firstTopology(text(backend["namespace"]), o.ref.Namespace)
+	kind := firstTopology(text(backend["kind"]), "Service")
+	name := text(backend["name"])
+	port := text(backend["port"])
+	if kind != "Service" || text(backend["group"]) != "" {
+		return g.link(rule, g.unknown(rule, kind, ns, name, "unsupported_fragment"), relation, protocol, port)
+	}
+	target := ""
+	if ns != o.ref.Namespace && !g.grantsBackend(o, ns, name) {
+		state := "unknown"
+		if g.completeSource("gateway.referencegrants", ns) {
+			state = "unresolved"
+		}
+		target = g.unknown(rule, kind, ns, name, state)
+	} else {
+		target = g.backend(rule, ns, name, port, protocol)
+	}
+	edge := g.link(rule, target, relation, protocol, port)
+	if service, ok := g.objects[topologyKey("Service", ns, name)]; ok && target == service.id() && port != "" && !servicePortExists(service, port, protocol) {
+		edge.ResolutionState = "unresolved"
+		edge.Note = "Service port/protocol does not match the route backend"
+	}
+	weight := integer(backend["weight"], 1)
+	if weight >= 0 {
+		edge.Weight = &weight
+	} else {
+		edge.ResolutionState = "unsupported_fragment"
+	}
+	return edge
+}
+
+func (g *topologyGraph) grantsBackend(o topologyObject, namespace, name string) bool {
+	return g.referenceAuthorized(o, "", "Service", namespace, name)
+}
+
+func (g *topologyGraph) completeSource(source, namespace string) bool {
+	for _, coverage := range g.view.Coverage {
+		if coverage.Name == "" && coverage.SourceID == source && (coverage.Namespace == "" || coverage.Namespace == namespace) && coverage.State == "available" && !coverage.Truncated {
+			return true
+		}
+	}
+	return false
+}
+
+func (g *topologyGraph) gatewayParent(o topologyObject, entry string, parent map[string]any, protocol string) {
+	ns := firstTopology(text(parent["namespace"]), o.ref.Namespace)
+	name := text(parent["name"])
+	if (text(parent["kind"]) != "" && text(parent["kind"]) != "Gateway") || (text(parent["group"]) != "" && text(parent["group"]) != "gateway.networking.k8s.io") {
+		g.state(entry, "unsupported_fragment")
+		return
+	}
+	gateway, ok := g.objects[topologyKey("Gateway", ns, name)]
+	if !ok {
+		edge := g.link(g.unknown(entry, "Gateway", ns, name, ""), entry, "matches", protocol, text(parent["port"]))
+		edge.SourceRef = &o.ref
+		edge.FieldPath = "spec.parentRefs"
+		edge.SectionName = text(parent["sectionName"])
+		edge.ResolutionState = g.referenceState("Gateway", ns)
+		return
+	}
+	parentID := g.objectNode(gateway, "entry", g.classProvider("GatewayClass", text(at(gateway.body, "spec", "gatewayClassName")), "gateway"), "")
+	if !g.expanded["listeners:"+parentID] {
+		g.expanded["listeners:"+parentID] = true
+		for _, listener := range items(at(gateway.body, "spec", "listeners")) {
+			g.properties(parentID, cr.NetworkTopologyProperty{Name: "Listener " + text(listener["name"]), Value: strings.Join([]string{text(listener["protocol"]), text(listener["port"]), text(listener["hostname"]), text(at(listener, "tls", "mode"))}, " · ")})
+		}
+	}
+	section := text(parent["sectionName"])
+	port := text(parent["port"])
+	state := "unresolved"
+	ports := []string{}
+	for _, listener := range items(at(gateway.body, "spec", "listeners")) {
+		if (section == "" || text(listener["name"]) == section) && (port == "" || text(listener["port"]) == port) {
+			if g.listenerAllows(o, ns, listener) && gatewayListenerProtocolAllows(o, listener) {
+				state = "resolved"
+				ports = append(ports, text(listener["port"]))
+			} else if state != "resolved" {
+				state = "unknown"
+			}
+		}
+	}
+	edge := g.link(parentID, entry, "matches", protocol, firstTopology(port, strings.Join(ports, ",")))
+	edge.ResolutionState = state
+	edge.SourceRef = &o.ref
+	edge.SectionName = section
+	edge.FieldPath = "spec.parentRefs"
+	edge.Note = "Listener " + section + "; attachment must also be accepted by the controller"
+}
+
+func gatewayListenerProtocolAllows(o topologyObject, listener map[string]any) bool {
+	protocol := text(listener["protocol"])
+	switch o.ref.Kind {
+	case "TCPRoute":
+		return protocol == "TCP"
+	case "UDPRoute":
+		return protocol == "UDP"
+	case "TLSRoute":
+		if protocol != "TLS" || text(at(listener, "tls", "mode")) != "Passthrough" {
+			return false
+		}
+		listenerHost := text(listener["hostname"])
+		for _, host := range texts(at(o.body, "spec", "hostnames")) {
+			if listenerHost == "" || gatewayHostMatches(host, listenerHost) || gatewayHostMatches(listenerHost, host) {
+				return true
+			}
+		}
+		return false
+	default:
+		return protocol == "HTTP" || protocol == "HTTPS"
+	}
+}
+
+func gatewayHostMatches(host, pattern string) bool {
+	return host == pattern || (strings.HasPrefix(pattern, "*.") && strings.HasSuffix(host, pattern[1:]) && len(host) > len(pattern)-1)
+}
+func (g *topologyGraph) listenerAllows(o topologyObject, namespace string, listener map[string]any) bool {
+	from := text(at(listener, "allowedRoutes", "namespaces", "from"))
+	if from == "Selector" {
+		ns, ok := g.objects[topologyKey("Namespace", "", o.ref.Namespace)]
+		if !ok || !g.completeSource("kubernetes.namespaces", "") || !topologySelectorMatches(object(at(listener, "allowedRoutes", "namespaces", "selector")), object(at(ns.body, "metadata", "labels"))) {
+			return false
+		}
+	}
+	if o.ref.Namespace != namespace && from != "All" && from != "Selector" {
+		return false
+	}
+	kinds := items(at(listener, "allowedRoutes", "kinds"))
+	if len(kinds) == 0 {
+		return true
+	}
+	for _, kind := range kinds {
+		if text(kind["kind"]) == o.ref.Kind && (text(kind["group"]) == "" || text(kind["group"]) == "gateway.networking.k8s.io") {
+			return true
+		}
+	}
+	return false
+}
+func (g *topologyGraph) gatewayFilter(o topologyObject, rule string, filter map[string]any, protocol, path string) {
+	kind := text(filter["type"])
+	if kind == "RequestMirror" {
+		mirror := object(filter["requestMirror"])
+		edge := g.gatewayBackend(o, rule, object(mirror["backendRef"]), "mirrors", protocol)
+		edge.FieldPath = path + ".requestMirror.backendRef"
+		edge.SourceRef = &o.ref
+		if value, ok := mirror["percent"].(float64); ok && value >= 0 && value <= 100 {
+			edge.MirrorPercent = &value
+		}
+		return
+	}
+	g.properties(rule, cr.NetworkTopologyProperty{Name: "Configured filter", Value: kind + " (execution order not inferred)"})
+	if kind != "RequestHeaderModifier" && kind != "ResponseHeaderModifier" {
+		g.state(rule, "unsupported_fragment")
+	}
+}
+func (g *topologyGraph) gatewayConditions(o topologyObject, id string) {
+	node := g.nodes[id]
+	for _, parent := range items(at(o.body, "status", "parents")) {
+		for _, condition := range items(parent["conditions"]) {
+			generation := integer(condition["observedGeneration"], 0)
+			node.Conditions = append(node.Conditions, cr.NetworkTopologyCondition{Type: text(condition["type"]), Status: text(condition["status"]), Reason: text(condition["reason"]), ObservedGeneration: &generation, LastTransitionTime: text(condition["lastTransitionTime"])})
+			if generation != o.generation || text(condition["status"]) != "True" {
+				node.ResolutionState = "unresolved"
+			}
+		}
+	}
+	if len(node.Conditions) == 0 {
+		node.ResolutionState = "unknown"
+	}
+	g.nodes[id] = node
+}

package/resource/runtime/network_topology_builder_legacy.go

@@ -0,0 +1,66 @@
+package runtime
+
+import cr "github.com/opensoha/soha/contracts/resource"
+
+// Legacy traces are a bounded projection of the graph, never a separately inferred topology.
+func (g *topologyGraph) projectLegacy() {
+	outgoing := map[string][]cr.NetworkTopologyGraphEdge{}
+	for _, edge := range g.view.Edges {
+		outgoing[edge.Source] = append(outgoing[edge.Source], edge)
+	}
+	for _, node := range g.view.Nodes {
+		if node.Type != "rule" {
+			continue
+		}
+		entry := node
+		for _, edge := range g.view.Edges {
+			if edge.Target == node.ID && g.nodes[edge.Source].Type == "entry" {
+				entry = g.nodes[edge.Source]
+				break
+			}
+		}
+		g.walkLegacy(entry, node, node.ID, outgoing, map[string]bool{}, 0)
+	}
+}
+func (g *topologyGraph) walkLegacy(entry, rule cr.NetworkTopologyGraphNode, id string, outgoing map[string][]cr.NetworkTopologyGraphEdge, seen map[string]bool, depth int) {
+	g.legacyWalks++
+	if g.legacyWalks > 2000 {
+		g.view.Truncated = true
+		return
+	}
+	if depth > 12 || seen[id] || len(g.view.Traces) >= cr.NetworkTopologyDefaultEdges {
+		return
+	}
+	next := cloneTopologySeen(seen)
+	next[id] = true
+	node := g.nodes[id]
+	if node.Type == "service" || len(outgoing[id]) == 0 {
+		state := "pending"
+		if node.ResolutionState == "resolved" {
+			state = "live"
+		}
+		sourceType := "ingress"
+		if rule.Resource != nil && (rule.Resource.Kind == "HTTPRoute" || rule.Resource.Kind == "GRPCRoute") {
+			sourceType = "httproute"
+		}
+		service := legacyTopologyNode(node, "service")
+		g.view.Traces = append(g.view.Traces, cr.NetworkTopologyTraceView{ID: rule.ID + ">" + id, SourceType: sourceType, State: state, Entry: legacyTopologyNode(entry, "entry"), Route: legacyTopologyNode(rule, "ingress-route"), Service: &service, Note: "Projected from rule topology; consult graph evidence for ports, weights and resolution state."})
+		return
+	}
+	for _, edge := range outgoing[id] {
+		if edge.Relation != "mirrors" {
+			g.walkLegacy(entry, rule, edge.Target, outgoing, next, depth+1)
+		}
+	}
+}
+func legacyTopologyNode(node cr.NetworkTopologyGraphNode, kind string) cr.NetworkTopologyNodeView {
+	result := cr.NetworkTopologyNodeView{ID: node.ID, Name: node.Label, Kind: kind, State: "pending", Badge: node.Provider, Subtitle: node.ResolutionState}
+	if node.ResolutionState == "resolved" {
+		result.State = "live"
+	}
+	if node.Resource != nil {
+		result.Namespace = node.Resource.Namespace
+		result.ResourceName = node.Resource.Name
+	}
+	return result
+}

package/resource/runtime/network_topology_builder_providers.go

@@ -0,0 +1,242 @@
+package runtime
+
+import (
+	"fmt"
+	cr "github.com/opensoha/soha/contracts/resource"
+	"strings"
+)
+
+func (g *topologyGraph) traefikRoute(o topologyObject) {
+	protocol := map[string]string{"IngressRoute": "HTTP", "IngressRouteTCP": "TCP", "IngressRouteUDP": "UDP"}[o.ref.Kind]
+	entry := g.objectNode(o, "entry", "traefik", protocol)
+	g.properties(entry, cr.NetworkTopologyProperty{Name: "Entry points", Value: strings.Join(texts(at(o.body, "spec", "entryPoints")), ", ")})
+	for index, raw := range items(at(o.body, "spec", "routes")) {
+		rule := g.rule(o, "traefik", protocol, index, "", nil)
+		node := g.nodes[rule]
+		if node.Rule != nil {
+			node.Rule.MatchSummary = text(raw["match"])
+			priority := integer(raw["priority"], 0)
+			node.Rule.Priority = &priority
+			node.Rule.TLSMode = ""
+			if at(o.body, "spec", "tls") != nil {
+				node.Rule.TLSMode = "terminate"
+				if at(o.body, "spec", "tls", "passthrough") == true {
+					node.Rule.TLSMode = "passthrough"
+				}
+			}
+		}
+		g.nodes[rule] = node
+		if text(raw["match"]) == "[redacted match expression]" {
+			g.state(rule, "unsupported_fragment")
+		}
+		g.link(entry, rule, "matches", protocol, "")
+		tail := rule
+		kind := "Middleware"
+		if protocol != "HTTP" {
+			kind = "MiddlewareTCP"
+		}
+		for _, middleware := range items(raw["middlewares"]) {
+			tail = g.traefikMiddleware(o, tail, middleware, kind, protocol, map[string]bool{}, 0)
+		}
+		total := int64(0)
+		for _, backend := range items(raw["services"]) {
+			total += integer(backend["weight"], 1)
+		}
+		for _, backend := range items(raw["services"]) {
+			g.traefikBackend(o, tail, backend, protocol, "weights", total, map[string]bool{}, 0)
+		}
+	}
+}
+
+func (g *topologyGraph) traefikMiddleware(o topologyObject, parent string, ref map[string]any, kind, protocol string, seen map[string]bool, depth int) string {
+	if g.budgetReached() {
+		return ""
+	}
+	namespace := firstTopology(text(ref["namespace"]), o.ref.Namespace)
+	name := text(ref["name"])
+	middleware, ok := g.objects[topologyKey(kind, namespace, name)]
+	if !ok {
+		target := g.unknown(parent, kind, namespace, name, "")
+		g.link(parent, target, "processes", protocol, "")
+		return target
+	}
+	// Each occurrence retains its position in this configured middleware chain.
+	target := g.addNode(cr.NetworkTopologyGraphNode{ID: parent + "/middleware/" + middleware.id(), Type: "processor", Label: name, Provider: "traefik", Protocol: protocol, ResolutionState: "resolved", Resource: &middleware.ref})
+	edge := g.link(parent, target, "processes", protocol, "")
+	if namespace != o.ref.Namespace {
+		edge.ResolutionState = "unknown"
+		edge.Note = "Controller allowCrossNamespace setting unverified"
+	}
+	g.properties(target, cr.NetworkTopologyProperty{Name: "Types", Value: strings.Join(texts(middleware.body["processorTypes"]), ", ")})
+	if depth >= 8 || seen[middleware.id()] {
+		g.state(target, "unsupported_fragment")
+		return target
+	}
+	next := cloneTopologySeen(seen)
+	next[middleware.id()] = true
+	for _, child := range items(at(middleware.body, "spec", "chain", "middlewares")) {
+		target = g.traefikMiddleware(middleware, target, child, kind, protocol, next, depth+1)
+	}
+	return target
+}
+
+func (g *topologyGraph) traefikBackend(o topologyObject, parent string, ref map[string]any, protocol, relation string, total int64, seen map[string]bool, depth int) {
+	if g.budgetReached() {
+		return
+	}
+
+	namespace := firstTopology(text(ref["namespace"]), o.ref.Namespace)
+	name := text(ref["name"])
+	kind := firstTopology(text(ref["kind"]), "Service")
+	port := text(ref["port"])
+	target := ""
+	switch kind {
+	case "TraefikService":
+		target = g.traefikService(o, parent, namespace, name, protocol, seen, depth)
+	case "Service":
+		target = g.backend(parent, namespace, name, port, protocol)
+	default:
+		target = g.unknown(parent, kind, namespace, name, "unsupported_fragment")
+	}
+	edge := g.link(parent, target, relation, protocol, port)
+	weight := integer(ref["weight"], 1)
+	edge.Weight = &weight
+	if relation == "weights" {
+		edge.TotalWeight = &total
+	}
+	if value, ok := ref["percent"].(float64); ok {
+		edge.MirrorPercent = &value
+	}
+	if namespace != o.ref.Namespace {
+		edge.ResolutionState = "unknown"
+		edge.Note = "Controller allowCrossNamespace setting unverified"
+	}
+}
+func (g *topologyGraph) traefikService(o topologyObject, parent, namespace, name, protocol string, seen map[string]bool, depth int) string {
+	if g.budgetReached() {
+		return ""
+	}
+
+	item, ok := g.objects[topologyKey("TraefikService", namespace, name)]
+	if !ok {
+		return g.unknown(parent, "TraefikService", namespace, name, "")
+	}
+	target := g.objectNode(item, "backend-group", "traefik", protocol)
+	if depth >= 8 || seen[item.id()] {
+		g.state(target, "unsupported_fragment")
+		return target
+	}
+	next := cloneTopologySeen(seen)
+	next[item.id()] = true
+	weighted := items(at(item.body, "spec", "weighted", "services"))
+	total := int64(0)
+	for _, backend := range weighted {
+		total += integer(backend["weight"], 1)
+	}
+	for _, backend := range weighted {
+		g.traefikBackend(item, target, backend, protocol, "weights", total, next, depth+1)
+	}
+	if mirror := object(at(item.body, "spec", "mirroring")); len(mirror) > 0 {
+		g.traefikBackend(item, target, mirror, protocol, "forwards", 0, next, depth+1)
+		for _, backend := range items(mirror["mirrors"]) {
+			g.traefikBackend(item, target, backend, protocol, "mirrors", 0, next, depth+1)
+		}
+	}
+	return target
+}
+func cloneTopologySeen(seen map[string]bool) map[string]bool {
+	next := map[string]bool{}
+	for key, value := range seen {
+		next[key] = value
+	}
+	return next
+}
+
+func (g *topologyGraph) apisixRoute(o topologyObject) {
+	entry := g.objectNode(o, "entry", "apisix", "")
+	for index, raw := range items(at(o.body, "spec", "http")) {
+		rule := g.rule(o, "apisix", "HTTP", index, text(raw["name"]), apisixMatches(object(raw["match"])))
+		node := g.nodes[rule]
+		if node.Rule != nil {
+			priority := integer(raw["priority"], 0)
+			node.Rule.Priority = &priority
+		}
+		g.nodes[rule] = node
+		g.link(entry, rule, "matches", "HTTP", "")
+		for _, plugin := range items(raw["plugins"]) {
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Configured plugin", Value: fmt.Sprintf("%s (enabled=%v; runtime priority not inferred)", text(plugin["name"]), plugin["enable"] == true)})
+		}
+		backends := items(raw["backends"])
+		if backend := object(raw["backend"]); len(backend) > 0 {
+			backends = append(backends, backend)
+		}
+		total := int64(0)
+		for _, backend := range backends {
+			total += integer(backend["weight"], 100)
+		}
+		for _, backend := range backends {
+			g.apisixBackend(o, rule, backend, "HTTP", total)
+		}
+		if len(items(at(raw, "match", "exprs"))) > 0 {
+			g.state(rule, "unsupported_fragment")
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Expressions", Value: "Configured expression values redacted; evaluation not simulated"})
+		}
+	}
+	for index, raw := range items(at(o.body, "spec", "stream")) {
+		protocol := strings.ToUpper(firstTopology(text(raw["protocol"]), "TCP"))
+		rule := g.rule(o, "apisix", protocol, index, "stream/"+firstTopology(text(raw["name"]), fmt.Sprint(index)), [][]cr.NetworkTopologyMatch{{{Type: "ingress-port", Value: text(at(raw, "match", "ingressPort"))}}})
+		g.link(entry, rule, "matches", protocol, text(at(raw, "match", "ingressPort")))
+		g.apisixBackend(o, rule, object(raw["backend"]), protocol, 100)
+	}
+}
+func apisixMatches(match map[string]any) [][]cr.NetworkTopologyMatch {
+	// APISIX arrays are OR within one dimension and AND across dimensions; do not fabricate their Cartesian product.
+	group := []cr.NetworkTopologyMatch{}
+	for _, kind := range []string{"hosts", "paths", "methods", "remoteAddrs"} {
+		values := texts(match[kind])
+		if len(values) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: kind, Operator: "oneOf", Value: strings.Join(values, " | ")})
+		}
+	}
+	return [][]cr.NetworkTopologyMatch{group}
+}
+func (g *topologyGraph) apisixBackend(o topologyObject, parent string, backend map[string]any, protocol string, total int64) {
+	name := text(backend["serviceName"])
+	port := text(backend["servicePort"])
+	target := ""
+	if upstream, ok := g.objects[topologyKey("ApisixUpstream", o.ref.Namespace, name)]; ok {
+		if len(items(at(upstream.body, "spec", "externalNodes"))) == 0 {
+			target = g.backend(parent, o.ref.Namespace, name, port, protocol)
+		}
+		target = g.apisixUpstream(upstream, target, protocol)
+	} else {
+		target = g.backend(parent, o.ref.Namespace, name, port, protocol)
+	}
+	edge := g.link(parent, target, "weights", protocol, port)
+	weight := integer(backend["weight"], 100)
+	edge.Weight = &weight
+	edge.TotalWeight = &total
+}
+func (g *topologyGraph) apisixUpstream(upstream topologyObject, service, protocol string) string {
+	id := g.objectNode(upstream, "backend-group", "apisix", protocol)
+	if g.expanded[id] {
+		return id
+	}
+	g.expanded[id] = true
+	g.properties(id, cr.NetworkTopologyProperty{Name: "Scheme", Value: text(at(upstream.body, "spec", "scheme"))}, cr.NetworkTopologyProperty{Name: "Load balancer", Value: text(at(upstream.body, "spec", "loadbalancer", "type"))})
+	nodes := items(at(upstream.body, "spec", "externalNodes"))
+	if len(nodes) == 0 {
+		g.link(id, service, "resolves", protocol, "")
+	}
+	for index, raw := range nodes {
+		target := g.addNode(cr.NetworkTopologyGraphNode{ID: fmt.Sprintf("%s/external/%d", id, index), Type: "external", Label: text(raw["name"]), Provider: "apisix", Protocol: protocol, ResolutionState: "external"})
+		edge := g.link(id, target, "forwards", protocol, text(raw["port"]))
+		weight := integer(raw["weight"], 1)
+		edge.Weight = &weight
+	}
+	for _, subset := range items(at(upstream.body, "spec", "subsets")) {
+		g.properties(id, cr.NetworkTopologyProperty{Name: "Configured subset", Value: text(subset["name"]) + " (endpoint subset resolution unverified)"})
+		g.state(id, "unsupported_fragment")
+	}
+	return id
+}