[2.2] feat: added reference grant mode (#14209)#14239
Merged
davidjumani merged 2 commits intoJun 15, 2026
Merged
Conversation
Signed-off-by: Andy Fong <[email protected]>
gateway-bot
added
kind/feature
Contributor
There was a problem hiding this comment.
Pull request overview
This backport introduces a configurable ReferenceGrant enforcement mode across kgateway, allowing operators to choose between backward-compatible behavior and stricter cross-namespace reference validation (including TrafficPolicy -> GatewayExtension).
Changes:
- Adds
ReferenceGrantMode(OFF,PERMISSIVEdefault,STRICT) toapi/settingswith env var parsing forKGW_REFERENCE_GRANT_MODE. - Wires the mode into
RefGrantIndexand short-circuits all ReferenceGrant checks when mode isOFF. - Enforces ReferenceGrant for cross-namespace
ExtensionRefresolution in Strict mode and adds translator golden tests + documentation covering all modes.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/pluginsdk/collections/collections.go | Passes Settings.ReferenceGrantMode into NewRefGrantIndex during common collection setup. |
| pkg/krtcollections/policy.go | Extends RefGrantIndex to store mode and bypass checks when mode is OFF. |
| pkg/krtcollections/secrets_test.go | Updates test construction of RefGrantIndex with explicit mode. |
| pkg/krtcollections/policy_test.go | Updates test construction of RefGrantIndex with explicit mode. |
| pkg/krtcollections/grpc_route_test.go | Updates test construction of RefGrantIndex with explicit mode. |
| pkg/kgateway/query/query_test.go | Updates test construction of RefGrantIndex with explicit mode. |
| pkg/kgateway/extensions2/plugins/trafficpolicy/constructor.go | Adds Strict-mode ReferenceGrant enforcement for cross-namespace ExtensionRef to GatewayExtension. |
| api/settings/settings.go | Introduces ReferenceGrantMode type, decoding, and Settings.ReferenceGrantMode envconfig field. |
| api/settings/settings_test.go | Adds coverage for default, strict env var parsing, and invalid mode error case. |
| devel/reference_grant/reference-grant-mode.md | Adds operator/developer documentation for the three modes, their coverage, and test guidance. |
| pkg/kgateway/translator/gateway/gateway_translator_test.go | Adds golden test cases validating behavior for OFF / PERMISSIVE / STRICT modes. |
| pkg/kgateway/translator/gateway/testutils/inputs/reference-grant-mode/strict-extensionref-with-grant.yaml | Adds strict-mode input fixture (with ReferenceGrant) for golden testing. |
| pkg/kgateway/translator/gateway/testutils/inputs/reference-grant-mode/strict-extensionref-no-grant.yaml | Adds strict-mode input fixture (missing grant) for golden testing. |
| pkg/kgateway/translator/gateway/testutils/inputs/reference-grant-mode/permissive-extensionref-no-grant.yaml | Adds permissive-mode input fixture (no grant required for ExtensionRef) for golden testing. |
| pkg/kgateway/translator/gateway/testutils/inputs/reference-grant-mode/off-backendref-no-grant.yaml | Adds off-mode input fixture (no grants required) for golden testing. |
| pkg/kgateway/translator/gateway/testutils/outputs/reference-grant-mode/strict-extensionref-with-grant.yaml | Adds strict-mode expected output (grant present). |
| pkg/kgateway/translator/gateway/testutils/outputs/reference-grant-mode/strict-extensionref-no-grant.yaml | Adds strict-mode expected output (grant missing, policy rejected). |
| pkg/kgateway/translator/gateway/testutils/outputs/reference-grant-mode/permissive-extensionref-no-grant.yaml | Adds permissive-mode expected output (ExtensionRef allowed without grant). |
| pkg/kgateway/translator/gateway/testutils/outputs/reference-grant-mode/off-backendref-no-grant.yaml | Adds off-mode expected output (cross-namespace BackendRef allowed). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
andy-fong
changed the title
Signed-off-by: Andy Fong <[email protected]>
andy-fong
added
work in progress
davidjumani
approved these changes
Jun 15, 2026
Merged
via the queue into
kgateway-dev:v2.2.x
with commit Jun 15, 2026
851b73b
38 of 39 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
backport of #14209
Change Type
/kind feature
Changelog