Skip to content

Commit 0c3303d

Browse files
jukiejukie
authored
Merge branch 'main' into dependabot/go_modules/gomod-066bf06994
2 parents f7f6670 + 15b62c0 commit 0c3303d

File tree

70 files changed

+2000
-438
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+2000
-438
lines changed

‎api/v1alpha1/authorization_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,8 +178,8 @@ type JWTPrincipal struct {
178178

179179
// Scopes are a special type of claim in a JWT token that represents the permissions of the client.
180180
//
181-
// The value of the scopes field should be a space delimited string that is expected in the scope parameter,
182-
// as defined in RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749#page-23.
181+
// The value of the scopes field should be a space delimited string that is expected in the
182+
// scope (or scp) claim, as defined in RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749#page-23.
183183
//
184184
// If multiple scopes are specified, all scopes must match for the rule to match.
185185
//

‎api/v1alpha1/backendtrafficpolicy_types.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,15 @@ type BackendTrafficPolicySpec struct {
122122
//
123123
// +optional
124124
Telemetry *BackendTelemetry `json:"telemetry,omitempty"`
125+
126+
// RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend,
127+
// or it can be set to "Endpoint" to use Endpoint routing.
128+
// When specified, this overrides the EnvoyProxy-level setting for the relevant targeRefs.
129+
// If not specified, the EnvoyProxy-level setting is used.
130+
//
131+
// +optional
132+
// +notImplementedHide
133+
RoutingType *RoutingType `json:"routingType,omitempty"`
125134
}
126135

127136
type BackendTelemetry struct {

‎api/v1alpha1/clienttrafficpolicy_types.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,18 @@ type ClientTrafficPolicySpec struct {
107107
//
108108
// +optional
109109
HealthCheck *HealthCheckSettings `json:"healthCheck,omitempty"`
110+
// Scheme configures how the :scheme pseudo-header is set for requests forwarded to backends.
111+
//
112+
// - Preserve (default): Preserves the :scheme from the original client request.
113+
// Use this when backends need to know the original client scheme for URL generation or redirects.
114+
//
115+
// - MatchBackend: Sets the :scheme to match the backend transport protocol.
116+
// If the backend uses TLS, the scheme is "https", otherwise "http".
117+
// Use this when backends require the scheme to match the actual transport protocol,
118+
// such as strictly HTTPS services that validate the :scheme header.
119+
//
120+
// +optional
121+
Scheme *SchemeHeaderTransform `json:"scheme,omitempty"`
110122
}
111123

112124
// HeaderSettings provides configuration options for headers on the listener.
@@ -413,6 +425,21 @@ type ClientTrafficPolicyList struct {
413425
Items []ClientTrafficPolicy `json:"items"`
414426
}
415427

428+
// SchemeHeaderTransform defines how the :scheme pseudo-header is set for requests forwarded to backends.
429+
//
430+
// +kubebuilder:validation:Enum=Preserve;MatchBackend
431+
type SchemeHeaderTransform string
432+
433+
const (
434+
// SchemeHeaderTransformPreserve preserves the :scheme from the original client request.
435+
// This is the default behavior.
436+
SchemeHeaderTransformPreserve SchemeHeaderTransform = "Preserve"
437+
438+
// SchemeHeaderTransformMatchBackend sets the :scheme to match the backend transport protocol.
439+
// If the backend uses TLS, the scheme is "https", otherwise "http".
440+
SchemeHeaderTransformMatchBackend SchemeHeaderTransform = "MatchBackend"
441+
)
442+
416443
func init() {
417444
localSchemeBuilder.Register(&ClientTrafficPolicy{}, &ClientTrafficPolicyList{})
418445
}

‎api/v1alpha1/envoygateway_helpers.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,12 @@ func (e *EnvoyGateway) TopologyInjectorDisabled() bool {
123123
return false
124124
}
125125

126+
// GetEnvoyProxyDefaultSpec returns the default EnvoyProxySpec if specified,
127+
// otherwise returns nil.
128+
func (e *EnvoyGateway) GetEnvoyProxyDefaultSpec() *EnvoyProxySpec {
129+
return e.EnvoyProxy
130+
}
131+
126132
// defaultRuntimeFlags are the default runtime flags for Envoy Gateway.
127133
var defaultRuntimeFlags = map[RuntimeFlag]bool{
128134
XDSNameSchemeV2: false,

‎api/v1alpha1/envoygateway_types.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,23 @@ type EnvoyGatewaySpec struct {
110110
// RuntimeFlags defines the runtime flags for Envoy Gateway.
111111
// Unlike ExtensionAPIs, these flags are temporary and will be removed in future releases once the related features are stable.
112112
RuntimeFlags *RuntimeFlags `json:"runtimeFlags,omitempty"`
113+
114+
// EnvoyProxy defines the default EnvoyProxy configuration that applies
115+
// to all managed Envoy Proxy fleet. This is an optional field and when
116+
// provided, the settings from this EnvoyProxySpec serve as the base
117+
// defaults for all Envoy Proxy instances.
118+
//
119+
// The hierarchy for EnvoyProxy configuration is (highest to lowest priority):
120+
// 1. Gateway-level EnvoyProxy (referenced via Gateway.spec.infrastructure.parametersRef)
121+
// 2. GatewayClass-level EnvoyProxy (referenced via GatewayClass.spec.parametersRef)
122+
// 3. This EnvoyProxy default spec
123+
//
124+
// Currently, the most specific EnvoyProxy configuration wins completely (replace semantics).
125+
// A future release will introduce merge semantics to allow combining configurations
126+
// across multiple levels.
127+
//
128+
// +optional
129+
EnvoyProxy *EnvoyProxySpec `json:"envoyProxy,omitempty"`
113130
}
114131

115132
// GatewayAPI defines an experimental Gateway API resource that can be enabled.

‎api/v1alpha1/envoyproxy_types.go‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -102,12 +102,16 @@ type EnvoyProxySpec struct {
102102
// If unspecified, the default filter order is applied.
103103
// Default filter order is:
104104
//
105+
// - envoy.filters.http.custom_response
106+
//
105107
// - envoy.filters.http.health_check
106108
//
107109
// - envoy.filters.http.fault
108110
//
109111
// - envoy.filters.http.cors
110112
//
113+
// - envoy.filters.http.header_mutation
114+
//
111115
// - envoy.filters.http.ext_authz
112116
//
113117
// - envoy.filters.http.api_key_auth
@@ -138,8 +142,6 @@ type EnvoyProxySpec struct {
138142
//
139143
// - envoy.filters.http.grpc_stats
140144
//
141-
// - envoy.filters.http.custom_response
142-
//
143145
// - envoy.filters.http.credential_injector
144146
//
145147
// - envoy.filters.http.compressor
@@ -246,10 +248,13 @@ type FilterPosition struct {
246248
}
247249

248250
// EnvoyFilter defines the type of Envoy HTTP filter.
249-
// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.custom_response;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
251+
// +kubebuilder:validation:Enum=envoy.filters.http.custom_response;envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.header_mutation;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
250252
type EnvoyFilter string
251253

252254
const (
255+
// EnvoyFilterCustomResponse defines the Envoy HTTP custom response filter.
256+
EnvoyFilterCustomResponse EnvoyFilter = "envoy.filters.http.custom_response"
257+
253258
// EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.
254259
EnvoyFilterHealthCheck EnvoyFilter = "envoy.filters.http.health_check"
255260

@@ -259,6 +264,9 @@ const (
259264
// EnvoyFilterCORS defines the Envoy HTTP CORS filter.
260265
EnvoyFilterCORS EnvoyFilter = "envoy.filters.http.cors"
261266

267+
// EnvoyFilterHeaderMutation defines the Envoy HTTP header mutation filter
268+
EnvoyFilterHeaderMutation EnvoyFilter = "envoy.filters.http.header_mutation"
269+
262270
// EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.
263271
EnvoyFilterExtAuthz EnvoyFilter = "envoy.filters.http.ext_authz"
264272

@@ -278,15 +286,18 @@ const (
278286
// EnvoyFilterSessionPersistence defines the Envoy HTTP session persistence filter.
279287
EnvoyFilterSessionPersistence EnvoyFilter = "envoy.filters.http.stateful_session"
280288

289+
// EnvoyFilterBuffer defines the Envoy HTTP buffer filter
290+
EnvoyFilterBuffer EnvoyFilter = "envoy.filters.http.buffer"
291+
292+
// EnvoyFilterLua defines the Envoy HTTP Lua filter.
293+
EnvoyFilterLua EnvoyFilter = "envoy.filters.http.lua"
294+
281295
// EnvoyFilterExtProc defines the Envoy HTTP external process filter.
282296
EnvoyFilterExtProc EnvoyFilter = "envoy.filters.http.ext_proc"
283297

284298
// EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.
285299
EnvoyFilterWasm EnvoyFilter = "envoy.filters.http.wasm"
286300

287-
// EnvoyFilterLua defines the Envoy HTTP Lua filter.
288-
EnvoyFilterLua EnvoyFilter = "envoy.filters.http.lua"
289-
290301
// EnvoyFilterRBAC defines the Envoy RBAC filter.
291302
EnvoyFilterRBAC EnvoyFilter = "envoy.filters.http.rbac"
292303

@@ -302,9 +313,6 @@ const (
302313
// EnvoyFilterGRPCStats defines the Envoy HTTP gRPC stats filter.
303314
EnvoyFilterGRPCStats EnvoyFilter = "envoy.filters.http.grpc_stats"
304315

305-
// EnvoyFilterCustomResponse defines the Envoy HTTP custom response filter.
306-
EnvoyFilterCustomResponse EnvoyFilter = "envoy.filters.http.custom_response"
307-
308316
// EnvoyFilterCredentialInjector defines the Envoy HTTP credential injector filter.
309317
EnvoyFilterCredentialInjector EnvoyFilter = "envoy.filters.http.credential_injector"
310318

@@ -317,12 +325,6 @@ const (
317325
// EnvoyFilterRouter defines the Envoy HTTP router filter.
318326
EnvoyFilterRouter EnvoyFilter = "envoy.filters.http.router"
319327

320-
// EnvoyFilterBuffer defines the Envoy HTTP buffer filter
321-
EnvoyFilterBuffer EnvoyFilter = "envoy.filters.http.buffer"
322-
323-
// EnvoyFilterHeaderMutation defines the Envoy HTTP header mutation filter
324-
EnvoyFilterHeaderMutation EnvoyFilter = "envoy.filters.http.header_mutation"
325-
326328
// StatFormatterRouteName defines the Route Name formatter for stats
327329
StatFormatterRouteName string = "%ROUTE_NAME%"
328330

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2137,6 +2137,13 @@ spec:
21372137
type: array
21382138
type: object
21392139
type: object
2140+
routingType:
2141+
description: |-
2142+
RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend,
2143+
or it can be set to "Endpoint" to use Endpoint routing.
2144+
When specified, this overrides the EnvoyProxy-level setting for the relevant targeRefs.
2145+
If not specified, the EnvoyProxy-level setting is used.
2146+
type: string
21402147
targetRef:
21412148
description: |-
21422149
TargetRef is the name of the resource this policy is being attached to.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -880,6 +880,21 @@ spec:
880880
For more information on security implications, see haproxy.org/download/2.1/doc/proxy-protocol.txt
881881
type: boolean
882882
type: object
883+
scheme:
884+
description: |-
885+
Scheme configures how the :scheme pseudo-header is set for requests forwarded to backends.
886+
887+
- Preserve (default): Preserves the :scheme from the original client request.
888+
Use this when backends need to know the original client scheme for URL generation or redirects.
889+
890+
- MatchBackend: Sets the :scheme to match the backend transport protocol.
891+
If the backend uses TLS, the scheme is "https", otherwise "http".
892+
Use this when backends require the scheme to match the actual transport protocol,
893+
such as strictly HTTPS services that validate the :scheme header.
894+
enum:
895+
- Preserve
896+
- MatchBackend
897+
type: string
883898
targetRef:
884899
description: |-
885900
TargetRef is the name of the resource this policy is being attached to.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -284,12 +284,16 @@ spec:
284284
If unspecified, the default filter order is applied.
285285
Default filter order is:
286286

287+
- envoy.filters.http.custom_response
288+
287289
- envoy.filters.http.health_check
288290

289291
- envoy.filters.http.fault
290292

291293
- envoy.filters.http.cors
292294

295+
- envoy.filters.http.header_mutation
296+
293297
- envoy.filters.http.ext_authz
294298

295299
- envoy.filters.http.api_key_auth
@@ -320,8 +324,6 @@ spec:
320324

321325
- envoy.filters.http.grpc_stats
322326

323-
- envoy.filters.http.custom_response
324-
325327
- envoy.filters.http.credential_injector
326328

327329
- envoy.filters.http.compressor
@@ -340,9 +342,11 @@ spec:
340342
After defines the filter that should come after the filter.
341343
Only one of Before or After must be set.
342344
enum:
345+
- envoy.filters.http.custom_response
343346
- envoy.filters.http.health_check
344347
- envoy.filters.http.fault
345348
- envoy.filters.http.cors
349+
- envoy.filters.http.header_mutation
346350
- envoy.filters.http.ext_authz
347351
- envoy.filters.http.api_key_auth
348352
- envoy.filters.http.basic_auth
@@ -358,7 +362,6 @@ spec:
358362
- envoy.filters.http.ratelimit
359363
- envoy.filters.http.grpc_web
360364
- envoy.filters.http.grpc_stats
361-
- envoy.filters.http.custom_response
362365
- envoy.filters.http.credential_injector
363366
- envoy.filters.http.compressor
364367
- envoy.filters.http.dynamic_forward_proxy
@@ -368,9 +371,11 @@ spec:
368371
Before defines the filter that should come before the filter.
369372
Only one of Before or After must be set.
370373
enum:
374+
- envoy.filters.http.custom_response
371375
- envoy.filters.http.health_check
372376
- envoy.filters.http.fault
373377
- envoy.filters.http.cors
378+
- envoy.filters.http.header_mutation
374379
- envoy.filters.http.ext_authz
375380
- envoy.filters.http.api_key_auth
376381
- envoy.filters.http.basic_auth
@@ -386,17 +391,18 @@ spec:
386391
- envoy.filters.http.ratelimit
387392
- envoy.filters.http.grpc_web
388393
- envoy.filters.http.grpc_stats
389-
- envoy.filters.http.custom_response
390394
- envoy.filters.http.credential_injector
391395
- envoy.filters.http.compressor
392396
- envoy.filters.http.dynamic_forward_proxy
393397
type: string
394398
name:
395399
description: Name of the filter.
396400
enum:
401+
- envoy.filters.http.custom_response
397402
- envoy.filters.http.health_check
398403
- envoy.filters.http.fault
399404
- envoy.filters.http.cors
405+
- envoy.filters.http.header_mutation
400406
- envoy.filters.http.ext_authz
401407
- envoy.filters.http.api_key_auth
402408
- envoy.filters.http.basic_auth
@@ -412,7 +418,6 @@ spec:
412418
- envoy.filters.http.ratelimit
413419
- envoy.filters.http.grpc_web
414420
- envoy.filters.http.grpc_stats
415-
- envoy.filters.http.custom_response
416421
- envoy.filters.http.credential_injector
417422
- envoy.filters.http.compressor
418423
- envoy.filters.http.dynamic_forward_proxy

0 commit comments

Comments
 (0)