Merge remote-tracking branch 'upstream/main' into security-policy-for-tls-gateways

Signed-off-by: asif.hasnain@sap.com <asif.hasnain@sap.com>

Author: asHasnain

.github/workflows/build_and_test.yaml

@@ -27,7 +27,7 @@ jobs:
     outputs:
       run_test_workflow: ${{ steps.check-changes.outputs.run_test_workflow }}
     steps:
-    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+    - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
       id: check-changes
       # A dependent job will be automatically skipped if its parent job is skipped.
       # So we skip this step in pull_request event if the changes are not relevant.
@@ -368,7 +368,7 @@ jobs:
 
     # build and push image
     - name: Login to DockerHub
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
       with:
         username: ${{ vars.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/codeql.yml

@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/release.yaml

@@ -107,7 +107,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Login to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         sarif_file: results.sarif

api/v1alpha1/authorization_types.go

@@ -164,7 +164,8 @@ type Principal struct {
 	//
 	// If multiple entries are specified,  one of the ClientIPGeoLocation entries must match for the rule to match.
 	//
-	// The client IP is inferred from the X-Forwarded-For header or a custom header.
+	// The client IP is inferred from the X-Forwarded-For header, a custom header, or the
+	// direct downstream connection source address (the TCP peer of the connection terminated by Envoy).
 	// You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection.
 	//
 	// +optional

api/v1alpha1/backend_types.go

@@ -110,7 +110,7 @@ type FQDNEndpoint struct {
 	//
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=253
-	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\.?$`
 	Hostname string `json:"hostname"`
 
 	// Port defines the port of the backend endpoint.

api/v1alpha1/clienttrafficpolicy_types.go

@@ -281,7 +281,8 @@ const (
 
 // ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.
 //
-// +kubebuilder:validation:XValidation:rule="!(has(self.xForwardedFor) && has(self.customHeader))",message="customHeader cannot be used in conjunction with xForwardedFor"
+// Exactly one of XForwardedFor, CustomHeader, or DirectSourceIP must be set.
+// +kubebuilder:validation:XValidation:rule="[has(self.xForwardedFor), has(self.customHeader), has(self.directSourceIP)].filter(x, x).size() == 1",message="exactly one of xForwardedFor, customHeader, or directSourceIP must be set"
 type ClientIPDetectionSettings struct {
 	// XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address.
 	//
@@ -294,8 +295,25 @@ type ClientIPDetectionSettings struct {
 	//
 	// +optional
 	CustomHeader *CustomHeaderExtensionSettings `json:"customHeader,omitempty"`
+	// DirectSourceIP configures the geoip filter to use the downstream connection
+	// source address (the TCP peer of the connection terminated by Envoy) as the client IP.
+	//
+	// Use this in L4-transparent topologies where a load balancer preserves the original
+	// client source IP at TCP level and does not populate XFF or a custom header — for
+	// example, AWS NLB with target-type=instance + externalTrafficPolicy=Local, or
+	// Azure Standard Load Balancer.
+	//
+	// Mutually exclusive with XForwardedFor and CustomHeader.
+	//
+	// +optional
+	DirectSourceIP *DirectSourceIPSettings `json:"directSourceIP,omitempty"`
 }
 
+// DirectSourceIPSettings configures client IP detection from the downstream
+// connection source address. It currently has no fields; its presence opts the listener
+// into using the TCP peer address as the client IP.
+type DirectSourceIPSettings struct{}
+
 // XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address.
 // Refer to https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for
 // for more details.

api/v1alpha1/ext_proc_types.go

@@ -106,6 +106,14 @@ type ExtProc struct {
 	//
 	// +optional
 	Metadata *ExtProcMetadata `json:"metadata,omitempty"`
+
+	// Sets the HTTP status that is returned to the client when the external processor returns an error
+	// or cannot be reached. Defaults to 500 Internal Server Error.
+	// Only 4xx and 5xx status codes are supported.
+	//
+	// +optional
+	// +kubebuilder:validation:Enum=400;401;402;403;404;405;406;407;408;409;410;411;412;413;414;415;416;417;421;422;423;424;426;428;429;431;500;501;502;503;504;505;506;507;508;510;511
+	StatusOnError *int32 `json:"statusOnError,omitempty"`
 }
 
 // ExtProcMetadata defines options related to the sending and receiving of dynamic metadata to and from the

api/v1alpha1/securitypolicy_types.go

@@ -37,7 +37,7 @@ type SecurityPolicy struct {
 
 // SecurityPolicySpec defines the desired state of SecurityPolicy.
 //
-// NOTE: SecurityPolicy can target Gateway, HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute.
+// NOTE: SecurityPolicy can target Gateway, ListenerSet, HTTPRoute, GRPCRoute, and TCPRoute, and TLSRoute.
 // When a SecurityPolicy targets a TCPRoute or TLSRoute, only client-IP CIDR based authorization
 // (Authorization rules that use Principal.ClientCIDRs) is applied. Other
 // authentication/authorization features such as JWT, API Key, Basic Auth,
@@ -46,17 +46,20 @@ type SecurityPolicy struct {
 //
 // +kubebuilder:validation:XValidation:rule="(has(self.targetRef) && !has(self.targetRefs)) || (!has(self.targetRef) && has(self.targetRefs)) || (has(self.targetSelectors) && self.targetSelectors.size() > 0) ", message="either targetRef or targetRefs must be used"
 // +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.group == 'gateway.networking.k8s.io' : true", message="this policy can only have a targetRef.group of gateway.networking.k8s.io"
-// +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute'] : true", message="this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute/TLSRoute"
+// +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute'] : true", message="this policy can only have a targetRef.kind of Gateway/ListenerSet/HTTPRoute/GRPCRoute/TCPRoute/TLSRoute"
 // +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.group == 'gateway.networking.k8s.io') : true ", message="this policy can only have a targetRefs[*].group of gateway.networking.k8s.io"
-// +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute']) : true ", message="this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute/TLSRoute"
+// +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute']) : true ", message="this policy can only have a targetRefs[*].kind of Gateway/ListenerSet/HTTPRoute/GRPCRoute/TCPRoute/TLSRoute"
+// +kubebuilder:validation:XValidation:rule="!has(self.mergeType) || ((!has(self.targetRef) || self.targetRef.kind in ['HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute']) && (!has(self.targetRefs) || self.targetRefs.all(ref, ref.kind in ['HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute'])) && (!has(self.targetSelectors) || self.targetSelectors.all(sel, sel.kind in ['HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute'])))", message="mergeType can only be used with xRoute targets"
 // +kubebuilder:validation:XValidation:rule="(has(self.authorization) && has(self.authorization.rules) && self.authorization.rules.exists(r, has(r.principal) ? has(r.principal.jwt) : false)) ? has(self.jwt) : true", message="if authorization.rules.principal.jwt is used, jwt must be defined"
 type SecurityPolicySpec struct {
 	PolicyTargetReferences `json:",inline"`
 
 	// MergeType determines how this configuration is merged with existing SecurityPolicy
 	// configurations targeting a parent resource. When set, this configuration will be merged
-	// into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
-	// This field cannot be set when targeting a parent resource (Gateway).
+	// into the closest parent SecurityPolicy in the route's attachment hierarchy (for
+	// example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet
+	// listener).
+	// Currently, this field can only be set when targeting xRoute resources.
 	// If unset, no merging occurs, and only the most specific configuration takes effect.
 	//
 	// +kubebuilder:validation:XValidation:rule="self != 'Replace'",message="Replace is not a valid MergeType for SecurityPolicy"